Data Protection Officer
About the role
The Data Privacy Officer (DPO) is responsible for ensuring that the hospital complies with applicable data privacy and data protection laws, regulations, and internal policies. The DPO oversees the protection of sensitive personal data, particularly patient health information, and promotes a culture of privacy and confidentiality across the organization.
Key responsibilities
Ensure hospital compliance with data privacy laws and regulations (e.g., Data Privacy Act, healthcare data regulations).
Monitor the Hospital/PIC's or PIP's compliance with the DPA, its IRR, issuances by the National Privacy Commission and other applicable laws and policies.
Develop, implement, and monitor data privacy policies, procedures, and guidelines.
Ascertain renewal of accreditations or certifications necessary to maintain the required standards in personal data processing.
Collect information to identify the processing operations, activities, measures, projects, programs, or systems of the Hospital/PIC or PIP, and maintain a record thereof.
Analyze and check the compliance of processing activities, including the issuance of security clearances to and compliance by third-party service providers.
Ensure the conduct of Privacy Impact Assessments (PIA) relative to activities, measures, projects, programs, or systems of the Hospital/PIC or PIP.
Guide, review and validate the PIA's findings.
Ensure proper data breach and security incident management by the Hospital/PIC or PIP, including preparation and submission to the NPC of reports and other documentation concerning security incidents or data breaches within the prescribed period.
Lead the investigation and documentation of data privacy incidents and breaches.
About you
Well-versed in privacy principles and the conduct of PIAs.
Expert guidance on data privacy compliance and protection.
Ability to perform regular data privacy audits and risk assessments across departments.
Ability to identify privacy risks and recommend mitigation strategies.
Capability to serve as the contact person for data subjects, the NPC and other authorities in matters concerning data privacy or security issues.