Senior Data Privacy Lead — Anonymisation & Privacy Impact Assessment (10–15 yrs)

Overview We're building a privacy-critical machine-learning capability on sensitive HR and workforce data, and we need a senior Data Privacy expert to own the privacy architecture end to end. This is the defining control on the project: no data pipeline activates until your anonymisation framework is approved, and no output ships until you've verified zero individual-level exposure. Privacy-by-design is non-negotiable, and this role is the named privacy authority in front of HR, security, and legal stakeholders. What you'll do - Design and document a full anonymisation and privacy framework: anonymisation and pseudonymisation techniques, k-anonymity thresholds, minimum cohort sizes, aggregation rules, and data-retention policy, applied before any model training. - Own the Privacy Impact Assessment (PIA) end to end: maintain the live PIA log, present at milestone gates, and deliver the final signed PIA. - Lead re-identification risk management: quasi-identifier inventory, generalisation and suppression rules, l-diversity checks, and documented motivated-intruder testing. - Design RBAC access tiers for dashboards and alerts carrying sensitive aggregated outputs, and validate zero individual-level exposure at every tier. - Run privacy-focused testing gates (SIT): verify no individual-level data is accessible through any interface, API, or dashboard view. - Advise the ML and data engineering team on privacy-preserving design; review features, model outputs, and explainability (SHAP) artefacts before release. Required skills & experience - 10–15 years in data privacy / data protection, including hands-on delivery of anonymisation frameworks for HR / people analytics or comparably sensitive data. - Practical command of privacy-preserving techniques: k-anonymity, l-diversity, aggregation, pseudonymisation, and re-identification risk assessment. - Proven experience running Privacy Impact Assessments through formal enterprise approval processes. - Working knowledge of GDPR and comparable data-protection regimes. - Experience defining RBAC for sensitive analytics applications. - The gravitas to hold the line with senior stakeholders when privacy and delivery pressure collide. Nice to have - IAPP CIPM certification (strongly preferred; CIPP/E or CIPT also valued). - Familiarity with the ISO/IEC 29101 privacy architecture framework. - Experience in ML / AI delivery environments and awareness of explainability techniques (SHAP). - Experience working alongside data science teams on anonymised data pipelines.