HR Data Privacy Lead (DSAR)

Location: Warsaw

Your responsibilities

• Leading the global HR Data Subject Access Request (DSAR) process - from case intake to closure, within the required deadlines.
• Preliminary analysis of requests: checking if they concern personal data, confirming identity, verifying duplicates, and compliance with data retention policies.
• Clarifying the content of the request in contact with the requester when the scope of the request is unclear.
• Coordinating data collection from systems and stakeholders (HR, Legal, IT, system owners); cooperating with the e-discovery team for email correspondence if necessary.
• Organizing material reviews with HR and Legal, and determining which information can be disclosed and which requires redaction or anonymization.
• Preparing responses: organizing documents, anonymizing data, securing files, and securely transferring information.
• Handling data deletion requests: initiating deletions in the appropriate systems and confirming completion.
• Administering and improving the request management tool (e.g., OneTrust) as well as the application form and workflows.
• Maintaining and updating response templates and operating procedures (procedures, standards).
• Ongoing consultation for HR and the business on personal data protection, and cooperating with the Privacy/Legal team on unusual cases.

Our requirements

• Experience in data protection (GDPR), compliance, or operational management of regulatory processes.
• Practical experience in handling Data Subject Access Requests (DSAR).
• Very good knowledge of GDPR and the ability to apply regulations in practice.
• Experience working with a DSAR management tool, preferably OneTrust, or another privacy rights / case management solution.
• Ability to collaborate and coordinate the work of multiple parties simultaneously (HR, Legal, IT, system owners).
• High accuracy and ability to work with sensitive data.
• Ability to prepare materials for disclosure: organizing documents, anonymizing data, quality control before sending.
• Very good work organization and resilience under time pressure.
• English language at a minimum C1 level - fluent communication in an international environment, including formal and legal topics.

Nice to have

• Experience in a global environment or a large-scale organization.
• Knowledge of HR data and systems.

What we offer

• Employment based on a temporary employment contract for 12 months, with the possibility of extending the cooperation.
• Benefits package: sports card, medical care, lunch card.
• Opportunity for development and gaining experience in an international environment.
• Hybrid work - 2 days in the office (remaining days remotely).

Benefits

• private medical care

Grafton Recruitment

We are Grafton Recruitment – a team of creative recruitment experts for whom every candidate is unique. We know that recruitment is not just about finding a job, but above all about creating the right fit between a candidate and an employer. Our goal is to ensure candidates achieve professional fulfillment and satisfaction in their work.

At Grafton Recruitment, we focus not only on professional skills but also on the individual personality traits, work style, and career goals of each candidate. This allows us to match the best job offer that meets our candidates' expectations and needs.

We cooperate with thousands of companies in Poland across various industries, giving our candidates access to a wide range of job offers and career development opportunities. Our presence throughout Poland, including Warsaw, Poznań, Wrocław, Krakow, Katowice, and Łódź, and our projects in the Tricity area, enable us to act effectively and efficiently for our candidates and clients.

Grafton is a global recruitment company, part of the Gi Group Holding, an international ecosystem offering HR services, with operations in over 30 countries.

Learn more at www.grafton.pl

The advertisement is published in cooperation with Grafton Recruitment sp. z o.o. (Entry Number to the Employment Agencies Register: 20329) and Grafton Recruitment Services sp. z o.o. (Entry Number to the Employment Agencies Register: 593). By applying for the advertisement, you agree to the processing of your personal data contained in your application in accordance with the principles set out at the following link: Data Processing and Protection Policy | Grafton RecruitmentThe administrator of your personal data are: Grafton Recruitment Sp. z o.o., with its registered office in Warsaw, Mokotowska 64 (KRS: 0000744760), Grafton Recruitment Services sp. z o. o. with its registered office in Lublin, ul. Królewska 3 (KRS 0000027957) and entities indicated in the Privacy Policy. You can contact the Data Protection Officer using the address: iod(at)gigroup.com or in writing to the registered office address. Personal data will be processed for the purpose of carrying out the recruitment process (legal basis: art. 22(1) § 1 of the Act of 26.06.1974 - Labor Code in conjunction with art. 6 sec. 1 lit. c or lit. a (in the scope of data processing based on consent). Regulation of 27 April 2016 'GDPR Regulation' within the framework of fulfilling the legal obligation incumbent on the data administrator. Providing data and giving consent to their processing is voluntary, but necessary to participate in the ongoing recruitment. Data storage period: entrusted personal data will be stored for the duration of ongoing recruitment processes - no longer than 48 months from the last user activity or until the withdrawal of consent. Expected categories of data recipients: recruitment personnel and those making employment decisions, HR and payroll departments, and personnel responsible for IT supervision, supervision over the correctness of recruitment activities, including lawyers. Your rights: you have the right to request from the administrator access to personal data concerning you, their rectification, erasure, or restriction of processing, withdrawal of consent, and the right to object to the processing of data, as well as the right to lodge a complaint with a supervisory authority. We inform you that the internal procedure for reporting legal violations and taking follow-up actions (Whistleblower Reporting Procedure) is available on the website at the following address: https://pl.gigroup.com/dla-pracownikow/sygnalisci Reports under the Whistleblower Reporting Procedure can be submitted at the following address: https://gigroupholding.vco.ey.com/