Data Security and Protection Advisor

Job description

Job responsibilities

Data Security and Protection (DSP) Advisor

• Provide specialist advice and assistance to staff where required on areas of complex information governance legislation, such as UK GDPR, Data Protection Act 2018 and the NHS Code of Practice on Confidentiality
• To work closely with department colleagues, support services, clinical services, operational and strategic Data Security and Protection leads and internal and external DSP colleagues to promote excellent Information Governance, Data Security and Data Protection practice, by advising and supporting them in their understanding and delivery of these requirements.
• To be aware of Data Security and Protection incidents and where appropriate support in the investigation process, ensuring relevant actions are taken and lessons learnt to prevent reoccurrence
• Provide support for a programme of Data Security and Protection related work managed by the Head of DSP and locally directed by the DSP Manager and Team Leader
• Log Serious Information Governance incidents on Data Security and Protection Toolkit incident reporting tool and the CCG STEIS tool as appropriate
• Review and report key indicators to provide information for Data Governance Group (DGG) and Information Governance Group (IGG), including data statistics and analysis of incidents.
• Conduct Data Security and Protection user satisfaction surveys in line with Data Security and Protection Toolkit requirements.
• Deputise for the DSP Team Leader, attending relevant meetings when necessary.
• Provide support to other areas of the Data Security and Protection Team as directed by the Head of Data Security and Protection.
• Be the first line of response for data security and protection queries providing support, advice and guidance to key areas of the Trust including Research and Innovation, Complaints, Governance and IT.
• Develop and maintain standard operating procedures for all routine tasks carried out within the role.
• Support the development, review and roll-out of appropriate DSP related policies and procedures.
• Manage DSP records, both paper and electronic, updating reports, maintaining action plans, policies and procedures etc.
• Take a proactive role in the collation of the evidence required for the annual Data Security and Protection Toolkit submission and participate in improvement plans.
• Maintain a register of Information Governance related incidents and produce regular reports from Datix, liaising with all departments and Risk Management as appropriate, leading on incident investigations where appropriate.
• Maintain the Trusts Information Asset Register and undertake reviews in coordination with Information Asset Owners and Information Asset Administrators.
• Supporting internal colleagues with the completion of Data Protection Impact Assessments, including highlighting data protection and security risks.
• Update and maintain the Trusts Privacy Notice to ensure compliance with UK GDPR standards and internal policies.
• Understand and monitor compliance with relevant legislation, particularly the common law duty of confidentiality, the Data Protection Act 2018, the General Data Protection Regulation, the Computer Misuse Act 1990, the Human Rights Act 1998;
• Manage Information Sharing Agreements and flows via the Information Sharing Gateway, working with internal and external stakeholders to make sure these are appropriately documented.
• Liaise with relevant internal and external stakeholders to ensure Information Sharing Agreements are completed and reviewed in line with GDPR.
• Establish good working relationships with key staff in all departments across the Trust.
• Implement policies and propose changes to Group DSP policies as appropriate, conducting monitoring compliance with those policies and protocols
• conduct data protection impact assessments (DPIA) where necessary and ensure the Group adheres to the data privacy by design and default as set out in Article 25 GDPR
• complete DPIAs to relevant team members and ensure cross partnership working with relevant project and transformation leads
• Assist the DSP Team Leader in the collation of relevant reports and information for compliance reporting, inspections and internal assurance
• Assist with the Data Governance Group and Information Governance Group meetings, ensuring relevant reports, minutes actions and decisions are recorded
• Escalate incidents to the Team Leader immediate when they may meet the criteria for a Serious Incident / reportable to the ICO
• Provide IG input, advice, guidance for R&D programmes
• Deputise for the DSP Team Leader when required
• work with the complaints team and directly with members of the public to communicate appropriately regarding any DSP grievances and queries
• to maintain their specialist knowledge in Data Protection Law and UK GDPR
• update the Internet and Intranet pages for DSP as appropriate, ensuring it is up to date with pertinent advice and guidance, including applicable FAQs and relevant legislation

Training & Audit

• To be responsible for the Data Security and Protection training programme, including planning and liaison with the Learning and Development Team for the regular delivery of DSP training sessions
• To monitor Data Security and Protection training compliance and to take all reasonable action to ensure that compliance levels are maintained at above 90% at all times and take all possible steps to ensure 95% compliance is achieved annually for the DSP Toolkit assertion.
• To ensure that this specialist knowledge is kept up to date and changes in legislation or national and local policy are communicated effectively to staff at all levels within the organisation
• To input into and to support the Data Security and Protection communication strategy.
• To undertake Data Security and Protection spot check audits in clinical and non-clinical areas, to report findings and work with relevant teams to develop and monitor action plans for improvement.
• To review the Information Asset Register against the Information Sharing Gateway to identify assets and data flows which have not been documented.
• Ensure that learning from Data Security and Protection incidents is incorporated into DSP training and awareness.
• Training colleagues on the use of the Information Sharing Gateway and Information Asset Register.
• Training colleagues on the practice of completing Data Protection Impact Assessments.
• Developing training and awareness materials and guidelines.

Person Specification

Educations, Training and Qualifications

• Educated to degree level or equivalent level of education, training or experience
• Professional relevant qualification, for example GPDR Foundation

• Formal Data Protection Act Training

Knowledge and Experience

• Working knowledge of Data Protection Act 2018, UK GDPR
• Knowledge of the information governance roles within the Trust (e.g. Senior Information Risk Owner, Caldicott Guardian and Information Asset Owner).
• Experience of supporting the completion of Data Protection Impact Assessments and identifying information risks.

• Experience of working in the NHS.
• Analytical and judgement skills for problem solving.

Skills

• Excellent written and verbal communication skills.
• Developed attention to detail and accuracy.
• Excellent IT skills, including experience of Microsoft Word, Excel, PowerPoint, Outlook and Visio.
• Organisational skills and the ability to work methodically and prioritise.

• Ability to interpret and judge conflicting views.
• Advanced Excel skills, including data presentation.

Key Competencies/Personal Qualities and Attributes

• Self-motivated and tenacious
• Ability to use own initiative to prioritise and problem solve.
• Courteous, tactful and efficient telephone manner.

• Able to deal with difficult situations with tact and sensitivity.

Disclosure and Barring Service Check

This post is subject to the Rehabilitation of Offenders Act (Exceptions Order) 1975 and as such it will be necessary for a submission for Disclosure to be made to the Disclosure and Barring Service (formerly known as CRB) to check for any previous criminal convictions.

Certificate of Sponsorship

Applications from job seekers who require current Skilled worker sponsorship to work in the UK are welcome and will be considered alongside all other applications. For further information visit the UK Visas and Immigration website.

From 6 April 2017, skilled worker applicants, applying for entry clearance into the UK, have had to present a criminal record certificate from each country they have resided continuously or cumulatively for 12 months or more in the past 10 years. Adult dependants (over 18 years old) are also subject to this requirement. Guidance can be found here Criminal records checks for overseas applicants.

Employer details

Employer name

Kettering General Hospital NHS Foundation Trust

Address

Cytringham House

Robinson Way

Kettering

NN16 8PT

https://www.kgh.nhs.uk/working-for-us