Data Privacy & Protection Officer

As a Data Privacy & Protection Officer within our team, you will be responsible for leading and overseeing the implementation of the Enterprise Data Privacy & Protection programme across the organization, ensuring compliance with applicable data protection regulations and privacy requirements. You will work closely with business stakeholders, Legal, Compliance, Information Security, technology teams and other relevant functions to embed privacy-by-design and privacy-by-default principles across business processes, applications, data platforms and enterprise initiatives. You will lead privacy governance, regulatory compliance assessments, Data Protection Impact Assessments, data processing reviews, cross-border data transfer assessments and privacy risk management initiatives. You will also provide expert guidance to senior management and business stakeholders, oversee privacy compliance monitoring and reporting, and drive continuous improvement of the enterprise Data Privacy & Protection framework, processes and tools.

Responsibilities: Privacy Governance & Regulatory Compliance: Lead the implementation and continuous improvement of the Enterprise Data Privacy & Protection framework, policies, guidelines and controls, ensuring compliance with applicable regulations across the Middle East and Southeast Asia. Regulatory Interpretation & Advisory: Monitor regulatory developments and provide guidance on applicable data protection laws, including UAE PDPL, Saudi Arabia PDPL, Bahrain PDPL, Qatar privacy regulations, Oman PDPL, Kuwait privacy requirements, Singapore PDPA, Malaysia PDPA, Hong Kong PDP and other applicable regional regulations. Privacy Risk Assessments & Privacy by Design: Lead and oversee DPIAs, privacy risk assessments and privacy-by-design reviews for business initiatives, applications, AI solutions, data platforms and technology implementations, ensuring appropriate mitigation measures are established. Personal Data Governance & Processing Oversight: Oversee Personal Data mapping, Records of Processing Activities (RoPA), data lifecycle management, data minimization, lawful processing, consent management, privacy notices, data retention and deletion requirements. Data Subject Rights & Privacy Incident Management: Establish and oversee processes for Data Subject Rights requests, privacy complaints, Personal Data breach assessments, incident response coordination and regulatory notifications in accordance with applicable legal requirements. Third-Party & Cross-Border Data Governance: Lead privacy assessments of vendors, processors, third-party integrations, data sharing arrangements and international data transfers, ensuring appropriate contractual safeguards and compliance requirements are implemented. Stakeholder Management, Reporting & Awareness: Advise senior management and business stakeholders on privacy risks and obligations, coordinate with Legal, Compliance and Information Security, manage regulatory engagement where required, and drive privacy awareness, training and compliance reporting.

Requirements Skills: Strong expertise in Data Privacy & Protection governance, regulatory compliance, privacy risk management and implementation of enterprise privacy frameworks, policies, standards and controls. In-depth knowledge of Middle East data protection regulations, including UAE PDPL, Saudi Arabia PDPL and applicable regulatory requirements across GCC jurisdictions and knowledge of Southeast Asian privacy regulations, including Singapore PDPA, Malaysia PDPA, Thailand PDPA, Hong Kong PDP Law and other applicable regional requirements. Expertise in conducting DPIAs, privacy risk assessments, RoPA, Personal Data mapping, privacy-by-design reviews, Data Subject Rights management and Personal Data breach assessments. Strong knowledge of cross-border data transfers, international data sharing, data processing agreements, third-party privacy risk assessments and contractual privacy safeguards. Excellent stakeholder management, advisory, analytical and communication skills, with the ability to engage senior management, business leaders, Legal, Compliance, Information Security and technology teams. Experience in implementing and managing enterprise privacy tools and platforms such as OneTrust, Securiti.ai, BigID or equivalent solutions, with knowledge of ISO 27701, GDPR and other international privacy frameworks considered an advantage. Qualifications and Experience: 10-12 years of relevant professional experience in Data Privacy & Protection, Privacy Governance, Regulatory Compliance, Data Protection or related disciplines. Demonstrable experience in leading or implementing enterprise-wide or regional Data Privacy & Protection programmes across multiple business functions and jurisdictions. Strong practical experience in interpreting and implementing data protection regulations across the Middle East and Southeast Asia, including managing cross-border compliance requirements. Experience in conducting DPIAs, privacy assessments, regulatory compliance reviews, Personal Data mapping, RoPA and third-party privacy assessments. Experience in managing Personal Data breach response, Data Subject Rights processes, regulatory engagement and privacy compliance reporting. Experience working with multinational organizations, diversified business groups or regulated industries with complex data processing and cross-border operations. Bachelor’s degree in law, Information Technology, Information Security, Risk Management, Compliance, Business Administration or an allied field of study. Professional certifications such as CIPP/E, CIPP/A, CIPM, CIPT, CDPSE, ISO 27701 Lead Implementer / Lead Auditor or equivalent will be considered an added advantage. Excellent written and verbal communication skills in English