Data Privacy Expert

About the Role
This role focuses on developing and implementing Data Privacy Policies, Processes, Procedures, Standards, Principles, Guidelines, and Templates that comply with KSA PDPL and NDMO regulations. The primary responsibilities include advising on data processing requirements, ensuring compliance with the regulations, and managing data privacy risks within the bank. The candidate will work closely with various stakeholders and external authorities to ensure comprehensive data protection practices are established and maintained.

Responsibilities

• Develop and operationalize Data Privacy Policies and procedures to comply with KSA PDPL and NDMO regulations, including Personal Data Breach procedures, DPIA, PIA, and RoPA.
• Advise the bank and employees regarding data processing requirements under the KSA PDPL.
• Provide guidance on data protection impact assessments (DPIA) for data collection and processing.
• Ensure all bank records and systems containing personal data comply with PDPL.
• Develop and maintain a comprehensive risk register for identified risks, including treatment plans, closure dates, and responsible stakeholders.
• Define Personal Data Protection Standards for the Information Security Team to follow.
• Conduct due diligence on vendors and monitor their compliance with privacy obligations.
• Regularly review and update personal data privacy and protection practices.
• Review and advise on controls implemented by the business for compliance with data protection requirements and internal policies.
• Collaborate with SAMA, SDAIA, and other authorities on data protection matters.
• Serve as the point of contact for data subjects and regulatory authorities concerning data privacy issues.
• Collaborate with procurement and legal teams to evaluate privacy risks with third-party vendors and service providers.
• Review and negotiate privacy terms in vendor contracts for compliance with data protection requirements.
• Provide regular reports to senior management on privacy program effectiveness, compliance status, and emerging privacy risks.
• Collaborate with the legal team on privacy-related legal requirements, inquiries, and investigations.
• Act as a liaison between Business and Functional areas and technology to ensure data-related business requirements are clearly defined.
• Manage and advise on data transfers across borders, including necessary approvals and monitoring.
• Establish processes for managing personal data transfers and data sharing agreements with external parties while ensuring privacy compliance.
• Support the bank in prioritizing processing activities.
• Conduct data flow mapping exercises covering personal data journey from collection to destruction.
• Conduct and maintain a repository for the RoPA exercise for all personal data processing activities.
• Conduct PIAs for processing activities identified in the RoPAs to determine the need for DPIAs.
• Perform DPIAs as necessary based on PIA results.
• Offer consultation during data breaches or incidents, report to senior management, and take necessary actions.
• Provide clear and transparent privacy notices to data subjects across all channels.
• Respond to Data Subject Rights Requests (DSRs) and establish handling procedures.
• Define performance metrics to ensure compliance with data protection and privacy policies, standards, roles, and responsibilities.

Requirements

• Bachelor’s degree in engineering, Information Technology, Cybersecurity, or a related field.
• Fluent in spoken and written Arabic and English.
• A minimum of 5+ years of experience in a dedicated data privacy or data protection role.
• Fair experience in Data Management; CDMP certification is a plus.
• Demonstrable expertise in the Saudi Personal Data Protection Law (PDPL) and its Implementing Regulations.
• Proven experience with data governance, privacy, and cybersecurity frameworks specific to the Saudi financial sector.
• Strong understanding of privacy principles such as data minimization, purpose limitation, and accountability.
• Excellent communication, interpersonal, and leadership skills, with the ability to influence stakeholders at all levels.
• High level of integrity and professional ethics, capable of handling confidential information with discretion.

Skills

• Excellent IT skills, including proficiency with the full Microsoft Office suite.
• In-depth knowledge of PDPL and other relevant data protection laws and regulations.
• Sufficient knowledge of IT and data management systems.
• Well-developed interpersonal skills for effective interaction at all organizational levels.
• Experience working in a large organization is preferred.
• Detail-oriented approach to recommend and implement strategic improvements in data privacy and protection.