Data Protection Officer
Role Overview
The Data Protection Officer (DPO) leads the enterprise data privacy strategy, regulatory compliance, and risk management framework across all projects, cloud services, and internal operations. This role embeds privacy-by-design into technical architectures and software deployments while acting as the primary privacy authority for internal teams, enterprise clients, third-party vendors, and regulatory bodies.
Key Responsibilities
Data Privacy & Compliance Governance
Draft, maintain, and enforce local privacy policies, guidelines, and frameworks aligned with regulatory requirements (e.g., Act 709 / PDPA, GDPR) and technology industry standards.
Embed privacy-by-design and privacy-by-default principles across software development, cloud infrastructure, and custom system integration projects.
Develop and maintain a centralized Record of Processing Activities (ROPA) covering enterprise operations, client data streams, and hosted infrastructure.
Maintain a privacy risk register integrated directly with the Enterprise Risk Management (ERM) framework.
Lead, review, and approve Data Privacy Impact Assessments (DPIAs) for internal platforms, software releases, and complex client implementation solutions.
Conduct regular privacy audits, gap assessments, and control testing across business operations and technical environments.
Third-Party Governance & Client Solutions
Conduct privacy due diligence on third-party software vendors, cloud providers, and technology partners.
Collaborate with Legal, Procurement, and Solutions Architecture teams to draft and execute Data Processing Agreements (DPAs), enforcing disclosure limitations, breach notification timelines, and right-to-audit clauses.
Provide pragmatic, solutions-focused privacy advice to technical delivery teams to help clients navigate cross-border data transfer, multi-tenant environments, and data residency requirements.
Incident Management & Data Subject Rights
Oversee processes for handling Data Subject Access Requests (DSARs), consent revocations, and privacy complaints from employees, client contacts, and end-users.
Establish, test, and maintain a robust data breach response plan; lead investigations, documentation, root-cause analyses, and regulatory reporting within mandatory timelines.
Regulatory Engagement & Culture
Serve as the primary liaison with local Data Protection Commissioners, external auditors, and supervisory authorities.
Track regulatory trends, enforcement actions, and international privacy developments impacting IT services and data management.
Design and deliver targeted data privacy training for engineering, consulting, project management, and corporate staff to foster a privacy-conscious organizational culture.
Minimum Requirements
Education & Certifications
Bachelor’s degree in Law, Information Security, Computer Science, Business Administration, or a related technical discipline.
Preferred certifications: Certified Information Privacy Professional (CIPP/A or CIPP/E), Certified Information Privacy Manager (CIPM), Certified Data Protection Officer (CDPO), or relevant ISACA/IAPP accreditations.
Experience
7–10+ years of progressive experience in data protection, legal compliance, or information security governance.
Minimum 5 years in a dedicated privacy leadership role, preferably within IT systems integration, cloud services, tech consulting, or managed services.
Demonstrated experience managing privacy frameworks across multi-tenant environments, complex software systems, or multi-entity business structures.
Skills & Competencies
Deep knowledge of Act 709 (PDPA), global data privacy laws (GDPR), and IT compliance standards (e.g., ISO/IEC 27701, ISO/IEC 27001, SOC 2).
Strong technical literacy regarding software architecture, API integrations, cloud infrastructure (AWS/Azure/GCP), and cybersecurity principles.
Exceptional cross-functional leadership, stakeholder management, and technical communication skills.