Data Protection Officer

About Roots Academy

At Roots Academy, we’ve built a learning experience that’s changing the lives of the ummah’s future leaders, change-makers and visionaries.

Our vision is enabling university students to live God-centred lives, so we teach structured, engaging and transformative face-to-face foundational Islamic education to over 1,800 students across the UK.

Role Summary

As a Data Protection Officer (DPO), you will be responsible for ensuring that Roots Academy complies with data protection laws and best practices. You will oversee data security policies, advise on compliance matters, and support teams in handling personal data responsibly. Your role is key in ensuring the organisation meets legal requirements and protects sensitive information.

Key tasks

• Compliance & Advisory
  • Ensure compliance with data protection regulations, including GDPR and other relevant laws.
  • Advise the Governance Lead and wider team on data protection policies and best practices.
  • Serve as the main point of contact for data protection queries and external regulators if required.
• Policy & Process Development
  • Develop and maintain data protection policies, privacy notices, and consent forms.
  • Ensure policies align with legal requirements and organisational needs.
  • Regularly review and update policies in response to regulatory changes.
• Training & Awareness
  • Provide training sessions for staff and volunteers on data protection principles and responsibilities.
  • Raise awareness about data security risks and how to mitigate them.
  • Develop guidance materials for teams handling personal data.
• Data Security & Risk Management
  • Support the organisation in identifying and mitigating data protection risks.
  • Conduct regular audits to assess data handling processes and compliance.
  • Assist teams in responding to data breaches, ensuring proper reporting and corrective actions.
• Record-Keeping & Documentation
  • Maintain records of data processing activities and ensure they are up to date.
  • Assist with data subject requests (e.g., access, rectification, and deletion requests).
  • Work with relevant teams to ensure secure data storage and handling.
• Third-Party Management
  • Assess and monitor the data protection practices of suppliers, contractors, and external partners.
  • Review contracts with third-party vendors to ensure appropriate data processing clauses and agreements are in place.
  • Work with legal and procurement teams to ensure compliance with GDPR and organisational policies when engaging external providers.

What we’re looking for

• Knowledge of data protection laws, particularly GDPR.
• Experience in data compliance, governance, or legal advisory roles.
• Strong organisational and problem-solving skills.
• Ability to communicate complex regulations in an accessible manner.
• Experience with risk management and security best practices (desirable but not essential).

What we have to offer

• Be part of a dedicated team of 90+ volunteers across the UK.
• Contribute to a growing organisation that educates and empowers the Muslim community.
• Access to in-house tarbiyah sessions to develop your deen.
• Receive continuous rewards for facilitating Islamic education through Roots Academy.

Please note: This is an unpaid volunteer position. Volunteers can claim expenses for food, travel, and equipment in line with the Expenses Policy.