Olayinka Obalola

I am a hands-on Compliance and Information Governance professional with over 8 years’ experience ensuring organisations handle personal and sensitive information responsibly and in line with UK GDPR, FOI, and EIR regulations. I thrive in roles that require attention to detail, strong organisation, and the ability to manage multiple priorities across governance, compliance, and information security. I have extensive experience managing Data Subject Access Requests (DSARs), FOI/EIR requests, Records of Processing Activities (ROPA), and Privacy Impact Assessments (DPIAs).

I enjoy turning complex regulations into practical, workable processes that teams can follow confidently. Trusted by colleagues and senior stakeholders, I take pride in strengthening governance frameworks, supporting smooth and efficient administrative processes, and ensuring organisations are audit-ready. I am motivated by the opportunity to make processes clearer, more compliant, and easier for teams to follow.

Data Privacy Analyst - The Royal Orthopaedic Hospital - Birmingham

(2024-05)

• Support the handling of DSAR, FOI, and EIR requests, ensuring accurate, timely, and compliant responses within statutory deadlines
• Conduct DPIAs and data protection risk assessments across projects, systems, and third-party engagements
• Embed Privacy by Design into project lifecycles, advising stakeholders on proportionate risk controls
• Review and draft data protection agreements, including data processing and data sharing arrangements
• Support international data transfers, ensuring appropriate safeguards and legal mechanisms are applied
• Maintain and enhance ROPA to strengthen accountability and transparency across business functions
• Perform third-party due diligence and vendor risk assessments, identifying and mitigating privacy risks
• Deliver targeted training sessions to improve staff awareness of GDPR, FOI, and information governance obligations
• Collaborate with IT and Information Security teams to align technical and organisational controls
• Support audit and compliance reviews, ensuring documentation and controls meet regulatory expectations

GDPR Specialist / Interim Data Protection Officer - GoldCrest Holiday - London

(2017-09 - 2024-04)

• Designed and implemented organisation-wide data protection and information governance frameworks
• Managed high volumes of DSARs, including validation, data collation, redaction, and response delivery
• Established structured processes and templates to improve response efficiency and consistency
• Conducted gap analysis across business and IT functions, defining and delivering remediation plans
• Support DPIAs and privacy risk assessments for new and existing processing activities
• Developed and maintained data mapping and ROPA to support compliance and audit requirements
• Reviewed and updated contracts to include GDPR-compliant clauses and data protection safeguards
• Advised on lawful basis, data sharing, and retention practices across business units
• Supported incident management, including personal data breach assessment and escalation
• Maintained regulatory documentation and supported engagement with supervisory authorities

GDPR Specialist - Bank of India - London

(2016-05 - 2017-08)

• Provided specialist GDPR advice to business, legal, and technology teams across multiple functions
• Supported the design and implementation of GDPR-compliant frameworks, policies, and operational controls
• Conducted detailed GDPR gap analysis against existing processes, systems, and third-party arrangements
• Led data mapping exercises to identify personal data flows, processing purposes, and lawful bases
• Drafted and updated GDPR documentation including privacy notices, internal policies, and procedures
• Supported and reviewed Data Protection Impact Assessments (DPIAs) in line with ICO guidance
• Assisted with third-party GDPR compliance, including vendor due diligence, contract reviews, and remediation actions
• Advised on data sharing arrangements and international data transfers, including SCCs
• Supported the management of data subject rights requests (SARs, erasure, rectification, restriction)
• Assisted with personal data breach assessments, incident response, and regulatory notifications
• Maintained GDPR compliance records, including Records of Processing Activities (ROPA)

KYC Officer - Unity Bank Plc

(2011-12 - 2015-12)

• Managed customer onboarding and KYC verification processes.
• Ensured compliance with AML and CTF regulatory requirements.
• Reviewed and updated customer records in accordance with governance standards.
• Identified and escalated potential financial crime risks.
• Supported regulatory compliance and internal control procedures.

Msc - Enterprise Systems Management - Birmingham City University (2019-09 - 2021-07)

Bsc - Accounting - University of Ilorin (2006-10 - 2010-06)