Job Description

Work with us at Riverford, and join a thriving employee-owned business

Be part of a supportive, down-to-earth and solutions driven Finance team
Beyond the Veg Box – At Riverford, our passion for organic vegetables is unmatched. We’re not just about delivering veg boxes; we’re dedicated to sustainable farming and community building. As a part of our team, you become a co-owner, sharing in our successes and contributing to a mission that goes beyond profit. We aim to make Riverford a fulfilling place to work, where our co-owners feel valued.
Our HQ at Wash Farm in Devon is a beautiful place to work, surrounded by good people, good food, and plenty of fresh air. As a co-owner, you’ll benefit from 33 days holiday (pro rata, including bank holidays), an ethical & generous company pension scheme, and an annual profit share, where 10% of all profits are split equally among co-owners. We also offer heavily discounted organic breakfasts and lunches, free organic fruit and veg to take home and free parking.
Grow with Riverford – Take the next step in your personal and professional journey with training tailored to help you grow and achieve your goals.

As our DPO, you’ll help shape Riverford’s future.

This is a hands-on role where you’ll help keep Riverford’s data protection and compliance activities running smoothly while we transition to a longer-term solution. You’ll be the go-to person for day-to-day privacy matters, providing practical, straightforward advice to teams across the business and making sure we continue to meet our legal obligations. Whether it’s supporting Subject Access Requests, investigating data protection incidents, reviewing DPIAs or helping colleagues navigate privacy questions, you’ll bring a calm, pragmatic approach that balances compliance with the realities of how the business operates.

Alongside keeping things moving day to day, you’ll take a step back to review how we currently manage data protection across Riverford. You’ll look at our processes, controls and ways of working, identifying what’s working well and where we could do things better. Working closely with stakeholders across the business, you’ll recommend practical improvements, help shape a proportionate future operating model and leave us with a clear roadmap that strengthens our approach long after your contract has finished.

This role would suit someone who’s happy working independently, enjoys getting stuck in, and can build trust with people across the business. We’re looking for someone who can explain complex requirements in plain English, take a balanced approach to risk, and leave things in a better place than they found them.

Salary: Circa £50,000 per annum (pro rata) D.O.E

Location – We encourage flexitime and hybrid working, based at Wash Farm, Buckfastleigh, Devon, TQ11 0JU.

Hours – 40 hours per week, Monday to Friday, different working patterns can be considered.

Contract – Initial 6 month fixed term contract.

What You’ll Be Doing….

Manage day-to-day data protection activities, including Subject Access Requests, Right to Erasure requests, CCTV requests, privacy enquiries and data incidents.
Provide practical data protection advice and support to teams across the business, including completing and reviewing DPIAs and maintaining compliance documentation.
Help ensure Riverford remains compliant with UK data protection legislation and monitor compliance risks, recommending improvements where needed.
Review Riverford’s current data protection and compliance arrangements, identifying strengths, gaps, risks and opportunities.
Recommend practical improvements to processes, controls, governance, training and the overall data protection operating model, supported by a clear implementation roadmap.
Document key processes, support knowledge transfer and make recommendations on future capability and resource requirements.
Ensure critical privacy and compliance activities continue smoothly throughout the transition period.

Please download the full JD for all responsibilities.

What We’re Looking For…

Strong experience in data protection, privacy or compliance roles.
Possession of a recognised privacy qualification (e.g. IAPP CIPP/E, CIPM, CIPT, BCS Practitioner Certificate in Data Protection, IBITGQ C-DPO or equivalent).
Experience managing Individual Rights Requests, DPIAs and supporting documentation, privacy incidents, Experience of legitimate interest (including LIA), and contract supporting documentation (NDA, ISA, Contract review).
Experience managing Subject Access Requests, DPIAs and privacy incidents.
Experience undertaking compliance reviews, audits or gap assessments.
Ability to work independently and provide pragmatic, risk-based advice.
Strong written communication and reporting skills.

Application Process: We’re reviewing applications on a rolling basis and may close the advert early, so we encourage you to apply soon.