Specialist - Information Lifecycle Management

About the role

The Data Governance Specialist executes a range of workstreams in delivering the design and implementation of BT Group's data governance strategy, advancing the organisation's thinking of data governance concepts and understanding of the benefits of data governance policies and procedures.

What you’ll be doing

• Maintain accurate information asset registers, including ownership, purpose, location, classification, processing activity, retention requirement and lifecycle status.
• Develop, maintain and operationalise retention and disposal schedules using legal, regulatory, contractual and business requirements.
• Apply and assure security classification, handling, access, storage, transfer, archival and disposal requirements across information assets.
• Support the establishment and ongoing maintenance of Records of Processing Activities (RoPA), ensuring processing purposes, personal-data categories, data subjects, recipients, transfers, retention periods and security measures are recorded.
• Perform data and information mapping to identify where information is created, stored, shared, transformed, archived and deleted.
• Work with Legal, Privacy, Security, Records Management and Data Owners to interpret obligations and document defensible control decisions.
• Configure, test or support lifecycle controls in Microsoft 365, Microsoft Purview, cloud platforms, repositories and business applications.
• Coordinate periodic reviews, exception management and remediation for assets with missing ownership, classification, retention rules or disposal evidence.
• Support legal holds, investigations, eDiscovery, data-subject rights, audits and regulatory requests by locating and preserving relevant information.
• Monitor control effectiveness and prepare evidence and reporting on register coverage, RoPA completeness, retention compliance, overdue disposal and exceptions.
• Identify opportunities to automate classification, retention labelling, disposition review, evidence capture and control monitoring.
• Provide guidance and training to information owners and custodians, and promote consistent lifecycle-management practices across BT.
• Support continuous improvement by tracking changes in legislation, regulation, standards, technology and business processes

Essential Skills / Experience

• 5+ years of experience in information lifecycle management, records management, information governance, privacy operations, data governance or a related control discipline.
• Practical experience maintaining information asset registers, records inventories, retention schedules, file plans or disposal processes.
• Good understanding of UK GDPR principles and accountability requirements, including lawful processing, purpose limitation, data minimisation, storage limitation, security, individual rights and privacy by design.
• Experience establishing, maintaining or assuring Records of Processing Activities (RoPA) and supporting data or information mapping.
• Knowledge of records classification, security classification, retention, archival, legal hold, defensible disposal and evidence requirements.
• Working knowledge of relevant legislation and regulation, including UK GDPR, the Data Protection Act 2018, the Data (Use and Access) Act 2025, the Freedom of Information Act 2000 and the Privacy and Electronic Communications Regulations 2003.
• Experience with information-governance or records tooling such as Microsoft Purview, Microsoft 365 retention and records management, OneTrust, BigID, ServiceNow GRC or equivalent.
• Ability to interpret policy and legal requirements and translate them into clear operational controls, procedures and records.
• Experience supporting assurance, audit, information requests, data-subject rights, investigations or regulatory evidence collection.
• Strong analytical, documentation, stakeholder-management and communication skills across business, legal and technology teams.

Desirable Skills / Experience

• Knowledge of ISO 15489, ISO/IEC 27001, ISO/IEC 27701, DAMA-DMBOK or equivalent information-governance practices.
• Experience implementing lifecycle controls across cloud environments, particularly GCP, and across structured and unstructured information.
• Awareness of AI information-lifecycle risks, including provenance, permissions, retention, model or use-case inventories and the NIST AI Risk Management Framework.
• Experience with Power BI or equivalent reporting and dashboarding tools.
• A relevant degree or professional certification such as IGP, CIP, CIPP/E, CIPM, DAMA CDMP, Microsoft Purview or a recognised records-management qualification.