Information Governance, Security and Compliance Officer

Reports to: Head of Digital

Responsible to: Director of Operations

Proposed salary: Band 5.1 – 5.4 on the ABC pay scale, which is equivalent to £28,888.23- £30,656.42 per annum dependent on experience (pro rata)

Hours of work: 37.5 per week

Tenure: Permanent

Base: Horley Health Hub / Remote

About Alliance for Better Care CIC

Alliance for Better Care (ABC) is a GP Federation uniting 77 NHS GP member practices across 98 sites within 24 Primary Care Networks in Sussex and Surrey. We support our Primary Care colleagues - and their patients - to transform how healthcare is delivered in their communities.

We work closely with GP Practices, PCNs, Hospitals, Community Organisations, and the Third Sector. These vital partnerships enable us to deliver a truly integrated approach that offers the support and expertise needed to effectively serve our populations.

Our Values

• We innovate

If we can do something better, we should.

• We are honest

Even when it is difficult.

• We care

And put the patient first.

• We are inclusive

We listen and we act.

• We deliver

And we’re known to like a challenge!

Benefits

• Generous annual leave allowance
• Access to NHS pension
• Bespoke training programme
• Cycle to Work Scheme
• Employee Assistance Programme
• Enhanced maternity pay
• NHS discounts
• Leadership Development Programme
• Salary sacrifice schemes – technology and electric vehicle
• Opportunities for secondments

Study Leave/Training

There are opportunities for a study leave allowance.

Supervision

Regular supervisions on a one-to-one basis including an annual formal appraisal are held with a line manager. If you are in a patient-facing role, you will also receive regular Clinical Supervisions with a Clinical Supervisor.

Induction Programme

You will receive an in-depth induction programme and will be invited to a face-to-face induction day within your first week to give you relevant information about the organisation and your job role.

Job summary

The Information Governance, Security & Compliance Officer leads ABC's digital information governance. The postholder owns ABC's Cyber Essentials Plus (CE+) and NHS Data Security & Protection Toolkit (DSPT) compliance programmes, provides the evidence that supports the ISO 27001 internal audit programme, and supports ISMS documentation and staff training.

This role does not own ABC's information governance function as a whole. Some of it sits with the Quality team. The postholder leads on digital information governance, which covers ABC's systems, digital services, suppliers and data flows, and works closely with the Quality team where the two meet, so that staff and practices get one answer rather than two. Within that remit the postholder keeps the Record of Processing Activities and the Information Asset Register up to date, completes Data Protection Impact Assessments (DPIAs), drafts and maintains data sharing agreements, joint controller and processor agreements and memoranda of understanding, and owns ABC's digital and information governance policy framework. Decisions on lawful basis, controllership and risk acceptance that sit above the role go to ABC's Data Protection Officer and Caldicott Guardian. Where that work covers clinical systems, the postholder works closely with ABC's Clinical Safety Officer, so that what is recorded for digital information governance and what is recorded for clinical safety say the same thing.

This role does not hold ownership of the ISO 27001 Information Security Management System (ISMS). Strategic oversight and day-to-day ISMS operation is led by the IT & Cyber Security Support Technician (ISMS Lead), who also plans and conducts the internal audit programme. The postholder provides the evidence that supports those audits, contributes to ISMS documentation as directed by the ISMS Lead, and designs and delivers all staff-facing information security training and awareness.

The postholder does not carry out remediation work. Where an audit, assessment or assurance activity finds something that needs fixing, they work with the team or colleague who runs that system or process to agree what will be done, who owns it and by when, and then track it to completion and report on progress.

The postholder is the named responsible person for CE+ annual certification and the NHS DSPT annual submission. For ABC's digital services and systems they also maintain the Article 30 Record of Processing Activities, the Information Asset Register, the DPIA register and the register of information sharing and data protection agreements. They work closely and regularly with the IT & Cyber Security Support Technician to gather technical evidence, track remediation and keep ABC compliant across all three assurance frameworks.

This role is essential to ABC keeping NHS supplier status, sharing data lawfully and with a proper record of it with member practices, PCNs and partner organisations, holding active data processor agreements, and keeping the trust of contracted GP practice clients across England.

INTERNAL AUDIT — EVIDENCE AND SUPPORT ROLE

• Provide the evidence that supports ABC's ISO 27001 internal audit programme. The ISMS Lead (IT & Cyber Security Support Technician) plans and conducts the audits.
• Keep the evidence for the compliance areas the postholder owns, CE+, DSPT, digital information governance, the policy framework and staff training, current and to hand, so it can be produced on request without rework.
• Supply the documents, records, reports and system extracts the auditor asks for within agreed timescales and state the period and scope each item covers.
• Attend internal audits as auditee for the processes the postholder owns, show how the controls work in practice and answer the auditor's questions accurately.
• Accept nonconformities, observations and opportunities for improvement raised against these areas. Work with the ISMS Lead and the people who run the system or process to agree the corrective action, a named owner and a target date.
• Follow those actions up to completion and give the ISMS Lead objective evidence that the work is done, so each one can be verified and closed.
• Pass information governance, CE+ and DSPT findings, incidents and risks to the ISMS Lead so that audit coverage can be planned by risk.
• Provide input on these areas to the annual ISMS management review pack when the ISMS Lead asks for it.

CYBER ESSENTIALS PLUS — LEAD RESPONSIBILITY

• Own the annual CE+ certification cycle end-to-end: scope definition, gap analysis, remediation tracking, assessor liaison, and certificate award.
• Maintain the CE+ scope document, accurately reflecting in-scope IP ranges, devices, operating systems, cloud services, and user populations; review following any significant IT change.
• Conduct a formal pre-assessment gap analysis at least 8 weeks before the CE+ assessment date; produce a remediation tracker with named owners and deadlines.
• Maintain the CE+ evidence pack for all five control domains (firewalls, secure configuration, access control, malware protection, patch management), coordinating technical evidence from the IT & Cyber Security Support Technician.
• Act as primary contact with the CE+ assessor; coordinate access and evidence provision during the assessment.
• Track CE+ nonconformities to verified closure; where technical remediation is required, raise with the IT & Cyber Security Support Technician and track to resolution.

NHS DSPT — LEAD RESPONSIBILITY

• Own ABC's annual DSPT submission, ensuring it is completed and submitted to NHS England at Standards Met level or above by the published deadline.
• Maintain a live DSPT evidence tracker mapped to each assertion, with evidence owners, current status, and planned completion dates; maintained throughout the year, not only at submission.
• Coordinate mandatory data security training completion; ensure the 95% completion threshold is met with sufficient lead time before the submission deadline.
• Manage data security incidents within DSPT reporting scope; coordinate with the IT & Cyber Security Support Technician; notify the ICO under UK GDPR Article 33 where required.
• Provide DSPT advisory support to contracted GP practice clients within ABC's contracted scope.

ISMS DOCUMENTATION — CONTRIBUTOR ROLE

• Draft new ISMS policies and procedures as commissioned by the ISMS Lead (IT & Cyber Security Support Technician); apply correct structure, ISO clause mapping, and document control formatting.
• Review and quality-assure existing ISMS documents at scheduled review dates as directed by the ISMS Lead; identify gaps against ISO 27001:2022/27002:2022 and flag for revision.
• Raise documentation gaps or inconsistencies found during compliance work and escalate them to the ISMS Lead.

TRAINING & AWARENESS — LEAD RESPONSIBILITY

• Design ABC's information security training and awareness programme for all staff, covering induction and annual refresher training.
• Develop targeted awareness content for higher-risk topics identified through audit findings, incident activity, or the risk register.
• Maintain training completion records and report completion rates to the ISMS Lead and line manager.
• Evaluate training effectiveness through testing, surveys, or audit observation; report outcomes to the ISMS Lead for management review.

DIGITAL INFORMATION GOVERNANCE — LEAD RESPONSIBILITY

• Maintain ABC's Article 30 Record of Processing Activities (RoPA) for digital services, systems and suppliers. Review it at least annually, and whenever processing changes or a new activity starts.
• Set up and maintain ABC's Information Asset Register (IAR), recording assets, named Information Asset Owners, data flows, systems, retention periods and risk. Check it against the RoPA at each review.
• Complete DPIAs for new or significantly changed processing, for new suppliers, and for new digital systems and AI tools. Keep the DPIA register, and agree with the teams who own the agreed mitigations what each will do and by when, then track them to completion.
• Advise projects when they start on whether a DPIA is needed and how far it needs to go, so that data protection is settled before a system is chosen or a contract awarded.
• Act as the first point of contact for digital information governance questions from ABC staff, member practices and partner organisations. Give practical advice in writing, pass matters held by the Quality team to that team, and refer questions of legal interpretation, controllership or risk acceptance to ABC's SIRO.
• Maintain ABC's records management and retention schedule in line with the Records Management Code of Practice for Health and Social Care, and arrange scheduled review and disposal with information asset owners.
• Keep ABC's privacy notices, other transparency material and its position on the national data opt-out up to date. Review them at least annually and whenever processing changes.
• Work closely with the Quality team, which holds some information governance within its own remit. Agree in writing where each team leads, meet regularly on shared matters, give staff and practices a single agreed answer, and take unresolved boundary questions to the Head of Digital.

DATA SHARING AND PROCESSING AGREEMENTS — LEAD RESPONSIBILITY

• Keep ABC's register of information sharing and data protection agreements, recording for each one the parties, purpose, lawful basis, data items, duration, review date and signatory.
• Draft, negotiate and maintain Data Sharing Agreements (controller to controller) with member practices, PCNs, ICBs, local authorities, acute and community providers and third sector partners. Confirm the lawful basis and, where confidential patient information is shared, the basis for sharing it under the Common Law Duty of Confidentiality.
• Draft and maintain joint controller arrangements under UK GDPR Article 26, including the summary made available to data subjects.
• Draft, review and maintain Data Processing Agreements and Article 28 terms, both where ABC is the controller and where ABC acts as processor for contracted GP practice clients. Check that the same obligations pass down to sub-processors.
• Draft and maintain Memoranda of Understanding setting out what each party is responsible for operationally and in governance terms, and keep each one consistent with the agreement beneath it.
• Maintain the supplier and sub-processor register, carry out annual due diligence, and keep DPAs current.
• Assess and record international transfers, applying the IDTA or UK Addendum and completing a transfer risk assessment where personal data is processed outside the UK.
• Run a review cycle across all agreements. Identify those expiring, superseded or still unsigned, and escalate them for renewal, variation or decommissioning.
• Issue, record and retain system and Registration Authority administrator agreements in line with the relevant access control policy.

POLICY FRAMEWORK — LEAD RESPONSIBILITY

• Own ABC's digital and information governance policy framework: the policy register, numbering, version control and publication. Every policy should have a named owner, an approval date and a review date. Align with the Quality team where a policy sits in their remit.
• Draft and revise ABC's corporate digital and information governance policies, covering data protection, confidentiality, records management, acceptable use, IT and device use, and AI and digital transformation, in consultation with the Head of Digital and the relevant service leads.
• Take policies through ABC's approval route, preparing papers that set out what has changed and what it means in practice for the approving group.
• Run the review cycle so that no policy passes its review date unreviewed, and revise policies when legislation, national guidance or NHS contractual requirements change.
• Tell staff about new and revised policies, and member practices and contracted clients where it affects them. Record acknowledgement where it is required.
• Add ISMS policies and procedures drafted under 2.4 to the policy framework and register. Their content remains the responsibility of the ISMS Lead.

MANAGEMENT REPORTING AND ASSURANCE — LEAD RESPONSIBILITY

• Produce quarterly management information for senior management on CE+, DSPT and digital information governance, covering DPIA, agreement and policy status, incidents, and the status of audit findings in these areas.
• Keep a digital information governance risk log and feed material risks to ABC's corporate risk register through the Head of Digital. Share risks that cross into the Quality team's remit with that team.
• Answer requests for digital information governance evidence and assurance from commissioners, member practices and contracted clients, within the agreed contractual scope, and with the Quality team where a return spans both remits.
• Co-ordinate remediation across CE+, DSPT, internal audit and digital information governance. Agree each action with the wider team, record a named owner and a deadline for it, keep one tracker, chase progress and report anything overdue to the line manager. The remediation work itself is carried out by the team that owns the system or process.

Person Specification

Qualifications

Essential

• A-level qualifications or equivalent

Desirable

• Degree level qualification in relevant topic
• Practitioner Certificate in Data Protection (BCS PC.dp) or an equivalent data protection qualification

Experience

Essential

• Minimum 2 years of working within the Health Service or allied profession
• Experience of working with range of professionals including senior clinicians
• Experience of working with Primary Care Clinical Software systems (S1 / EMIS)
• Experience of service delivery
• Working knowledge of UK GDPR, the Data Protection Act 2018 and the Common Law Duty of Confidentiality
• Experience of completing Data Protection Impact Assessments and of keeping information governance records such as a Record of Processing Activities or Information Asset Register
• Experience of drafting, reviewing or maintaining data sharing agreements, data processing agreements or memoranda of understanding
• Experience of writing and maintaining organisational policies through a formal approval and review cycle

Desirable

• Experience of working in a primary care setting
• Experience of NHS information governance frameworks, including the Data Security and Protection Toolkit, the Caldicott Principles and the national data opt-out

Skills and abilities

Essential

• Excellent written and verbal communication skills
• Demonstrable leadership and collaborative working qualities
• Motivates and inspires colleagues to provide patient-centred care
• Ability to work flexibly, use initiative, prioritise workload and delegate
• Sound financial acumen and business management skills
• Ability to establish excellent working relationships
• Change management skills and ability to cope with stress and ambiguity
• Pro-active self-starter able to set and deliver own objectives
• Able to read information governance law and national guidance and turn it into practical advice that clinical and operational colleagues can act on
• Accurate and attentive to detail when keeping registers, agreements and documentation
• Handles confidential and sensitive information with discretion, and knows when something needs to be escalated
• Works well with quality, governance and clinical colleagues where responsibility for information governance is shared

Desirable

• Commitment and evidence of Continuing Professional Development (CPD)

Behaviours and values

Essential

• Champion of equality and valuing diversity
• Operates at all time in line with Confidentiality and Data Protection Act
• Supports open, proportionate information sharing that helps patient care while protecting confidentiality

We are committed to building a diverse team and fostering an inclusive workplace where everyone’s unique strengths are valued. We welcome applicants from all backgrounds, including underrepresented groups such as ethnic minorities, people of all faiths or beliefs, members of the LGBTQ+ community, and individuals with disabilities or neurodivergent conditions.

We provide adjustments during the recruitment process and in the workplace to support you in fulfilling this role. If you require reasonable adjustments, we will work with you to ensure you can meet the criteria and perform effectively.

You don’t need to meet every element of the person specification to apply. If you have relevant skills and experience and share our values, we encourage you to apply. We value diverse perspectives, including those from neurodiverse individuals.

Pay: £28,888.23-£30,656.42 per year

Benefits:

• Company pension
• Cycle to work scheme
• Employee discount
• Enhanced maternity leave
• Enhanced paternity leave
• Health & wellbeing programme
• On-site parking
• Sick pay

Ability to commute/relocate:

• Horley (Surrey): reliably commute or plan to relocate before starting work (required)

Education:

• A-Level or equivalent (required)

Experience:

• Health Service or allied profession: 2 years (required)
• Primary Care: 1 year (preferred)

Work authorisation:

• United Kingdom (required)

Work Location: In person