Global Compliance Manager & Data Protection OfficerDepartment:Enabling : Legal and InsuranceEmployment Type:Permanent
- Full TimeLocation:SpainThe Integral Compliance Manager owns and manages Anthesis's global compliance and data protection framework across all jurisdictions, ensuring the Group meets its regulatory, privacy, and client due-diligence obligations, and that policies are current, embedded, monitored and reported to leadership.
The Global Compliance Manager also holds the legal role of Data Protection Manager, and ensures that personal data risks are systematically identified, controlled and continuously improved within the ISO 27001 ISMS framework
- turning privacy obligations into enforceable security controls.

Key Responsibilities
General Compliance

responsibilities:
Compliance framework & policies: Maintain and develop the Group's compliance policies (e.
G. anti-bribery & corruption, anti-fraud & tax evasion, AML, whistleblowing, code of conduct, conflicts of interest, and gifts & hospitality). Own the policy inventory and control matrix; monitor adherence and report to leadership.
Know Your Client (KYC) / due diligence & AML: Run risk-based client onboarding and ongoing due diligence, beneficial-ownership verification, and anti-money laundering (AML) checks.
Sanctions:Support in the screening of clients and counterparties against UK, EU, US (OFAC) and UN sanctions lists; consider red flags; maintain awareness of export-control considerations.
Training & culture: Deliver compliance and data protection training; embed a culture of compliance across the business.
Cross-functional partnering: Work closely with Legal, IT&Tech;, Finance, People & Development and the business lines; support internal and client audits.




Working with external legal counsel on compliance and data protection mattersISO 27001 & audit support:Support ISO 27001 certification and surveillance audits (and client or SOC audits where relevant) by providing privacy evidence, maintaining privacy controls in the ISMS and working with the Cyber Risk & Compliance team.
Data Protection

responsibilities:
Lead global privacy compliance (UK & EU GDPR, US state privacy laws, and other applicable regimes). vendor/third-party due diligence and data processing agreements (DPAs).
Named DPO where registration required and serve as point of contact for supervisory authorities and data subjectsDevelopment of group-wide policies and procedures required to implement global data protection complianceData Protection advisory for Technology, P&D;, Marketing, Finance,Maintenance of Record of Processing Activities (ROPA) and other mandatory registers and documentations under relevant data protection lawCreation and provision of privacy notices where requiredHandle Data Subject Access Requests, liaising where relevant with Tech/IT TeamAdvise on data breaches/incidents where relevantCreation and delivery of data protection training where relevantReview of data protection relevant contractual requirements (including, but not limited to,



mandatory processor DPAs for GDPR compliance)Conducting Data Protection Impact Assessments where relevantImplementing Intergroup Data Transfer agreements to ensure compliance with international data transfer requirementsReview of data protection/privacy questionnaires and similar as part of onboarding, RfP, annual review etc.
Due Diligence on potential processors that engage AG and use AG personal dataData protection representative on the AI Governance CommitteeAct as the privacy and compliance contact for client due diligence, third-party risk management (inbound and outbound) and contractual negotiations on data protection, data deletion, sub-processors and AI use clausesSupport the Acceptable Use of AI Policy, the AI capability inventory and AI risk assessments; advise on EU AI Act deployer obligations, client disclosure and consent requirements for AI use, and AI-related data retention and deletion queries from clientsData protection input on Cyber Security Working GroupContribute to the Group data governance programme, including data classification, retention and deletion policy and process, and client data segregation, working with IT and LegalOwn and maintain the Group Data Protection Policy and lead the Data Privacy Team, including coordination with any Deputy DPO or privacy support rolesAny other relevant data protection requirementsInterface with IT/Tech Team:Privacy-by-design across technology platforms
- ensures all systems, applications, and integrations embed data protection controls (access, encryption, logging) aligned with privacy regulations.
Personal data risk ownership in technology landscapes
- identifies, assesses, and mitigates privacy risks arising from technology platforms are tracked within ISMS risk registers.
Data availability and protection in business continuity plan and disaster recovery
- ensures business continuity and disaster recovery plans protect personal data confidentiality and integrity while maint

📌 Global Compliance Manager (Madrid)
🏢 Anthesis ESP
📍 Madrid