Data Privacy & Protection Officer

About the Role
As a Data Privacy & Protection Officer, you will be instrumental in leading and overseeing the implementation of the Enterprise Data Privacy & Protection programme across the organization. Your focus will be on ensuring compliance with applicable data protection regulations and privacy requirements. Collaborating closely with business stakeholders, Legal, Compliance, Information Security, technology teams, and other relevant functions, you will embed principles of privacy-by-design and privacy-by-default across business processes, applications, data platforms, and enterprise initiatives.
Your role will extend to leading privacy governance, regulatory compliance assessments, Data Protection Impact Assessments, data processing reviews, cross-border data transfer assessments, and privacy risk management initiatives. Furthermore, you will provide expert guidance to senior management and business stakeholders while overseeing privacy compliance monitoring and reporting, driving continuous improvement of the enterprise Data Privacy & Protection framework, processes, and tools.

Responsibilities:

• Privacy Governance & Regulatory Compliance: Lead the implementation and continuous improvement of the Enterprise Data Privacy & Protection framework, policies, guidelines, and controls, ensuring compliance with applicable regulations across the Middle East and Southeast Asia.
• Regulatory Interpretation & Advisory: Monitor regulatory developments and provide guidance on applicable data protection laws, including UAE PDPL, Saudi Arabia PDPL, Bahrain PDPL, Qatar privacy regulations, Oman PDPL, Kuwait privacy requirements, Singapore PDPA, Malaysia PDPA, Hong Kong PDP, and other applicable regional regulations.
• Privacy Risk Assessments & Privacy by Design: Lead and oversee DPIAs, privacy risk assessments, and privacy-by-design reviews for business initiatives, applications, AI solutions, data platforms, and technology implementations, ensuring appropriate mitigation measures are established.
• Personal Data Governance & Processing Oversight: Oversee Personal Data mapping, Records of Processing Activities (RoPA), data lifecycle management, data minimization, lawful processing, consent management, privacy notices, data retention, and deletion requirements.
• Data Subject Rights & Privacy Incident Management: Establish and oversee processes for Data Subject Rights requests, privacy complaints, Personal Data breach assessments, incident response coordination, and regulatory notifications in accordance with applicable legal requirements.
• Third-Party & Cross-Border Data Governance: Lead privacy assessments of vendors, processors, third-party integrations, data sharing arrangements, and international data transfers, ensuring appropriate contractual safeguards and compliance requirements are implemented.
• Stakeholder Management, Reporting & Awareness: Advise senior management and business stakeholders on privacy risks and obligations, coordinate with Legal, Compliance, and Information Security, manage regulatory engagement where required, and drive privacy awareness, training, and compliance reporting.

Requirements

Skills:

• Strong expertise in Data Privacy & Protection governance, regulatory compliance, privacy risk management, and implementation of enterprise privacy frameworks, policies, standards, and controls.
• In-depth knowledge of Middle East data protection regulations, including UAE PDPL, Saudi Arabia PDPL, and applicable regulatory requirements across GCC jurisdictions, as well as knowledge of Southeast Asian privacy regulations, including Singapore PDPA, Malaysia PDPA, Thailand PDPA, Hong Kong PDP Law, and other applicable regional requirements.
• Expertise in conducting DPIAs, privacy risk assessments, RoPA, Personal Data mapping, privacy-by-design reviews, Data Subject Rights management, and Personal Data breach assessments.
• Strong knowledge of cross-border data transfers, international data sharing, data processing agreements, third-party privacy risk assessments, and contractual privacy safeguards.
• Excellent stakeholder management, advisory, analytical, and communication skills, with the ability to engage senior management, business leaders, Legal, Compliance, Information Security, and technology teams.
• Experience in implementing and managing enterprise privacy tools and platforms such as OneTrust, Securiti.ai, BigID, or equivalent solutions, with knowledge of ISO 27701, GDPR, and other international privacy frameworks considered an advantage.

Qualifications and Experience:

• 10–12 years of relevant professional experience in Data Privacy & Protection, Privacy Governance, Regulatory Compliance, Data Protection, or related disciplines.
• Demonstrable experience in leading or implementing enterprise-wide or regional Data Privacy & Protection programmes across multiple business functions and jurisdictions.
• Strong practical experience in interpreting and implementing data protection regulations across the Middle East and Southeast Asia, including managing cross-border compliance requirements.
• Experience in conducting DPIAs, privacy assessments, regulatory compliance reviews, Personal Data mapping, RoPA, and third-party privacy assessments.
• Experience in managing Personal Data breach responses, Data Subject Rights processes, regulatory engagement, and privacy compliance reporting.
• Experience working with multinational organizations, diversified business groups, or regulated industries with complex data processing and cross-border operations.
• Bachelor’s degree in law, Information Technology, Information Security, Risk Management, Compliance, Business Administration, or an allied field of study.
• Professional certifications such as CIPP/E, CIPP/A, CIPM, CIPT, CDPSE, ISO 27701 Lead Implementer / Lead Auditor, or equivalent will be considered an added advantage.
• Excellent written and verbal communication skills in English.