Data Privacy Senior Manager

About the Role
The Senior Manager – Data Privacy Governance will lead the data privacy governance pillar of the company's Data Privacy Function within the Group Information Security Department (GISD). This position involves the design, implementation, and continuous improvement of the Bank’s privacy governance framework, which encompasses policies, standard operating procedures, records of processing, privacy risk management, and regulatory reporting. The role is essential to ensuring that the company, along with its subsidiaries and branches, processes personal data in compliance with the UAE Personal Data Protection Law, CBUAE Consumer Protection Regulation & Standards, and other local and international data protection requirements. The Senior Manager will provide assurance to Senior Management, Board Committees, and regulators about the effectiveness of the privacy control environment.

Key Accountabilities of the Role

Privacy Governance Framework

• Own, draft and maintain the Data Privacy Framework, Policy, Standards, SOPs and supporting templates, including version control, approval workflows, and periodic review cycles.
• Maintain the regulatory obligation register and map PDPL, CBUAE, and other applicable requirements to internal controls, ensuring the supporting evidence library is complete and audit-ready.

Records of Processing and Data Mapping

• Oversee the Record of Processing Activities (RoPA) program end to end – from Business Unit onboarding, completeness and quality reviews, to escalation and periodic refresh, ensuring consistency across all the company's jurisdictions.
• Govern the privacy management platform (OneTrust) as the single source of truth for RoPA, assessments, consent, and incident records.

Privacy Risk, Assessments, and Assurance

• Govern the privacy risk management process, including risk identification, assessment, mitigation, and recording of residual risk in the Bank’s GRC tool (Archer) in line with the Operational Risk Management framework.
• Lead the governance of Data Protection Impact Assessments (DPIA) and International Data Transfer Assessments, including review, challenge, and sign-off of business submissions.
• Define, monitor and report privacy KPIs and KRIs, and prepare reporting packs for Senior Management, the CISO, Management Risk Committee, and Board-level committees.

Data Subject Rights, Consent, and Transparency

• Oversee governance of data subject rights handling, consent management, and privacy notices across customer, employee, candidate, and vendor channels (web, mobile app, branches, contact center, and forms).
• Ensure privacy notices and consent mechanisms are accurate, tailored by data subject type, and available in both English and Arabic.

Third Parties and Contracts

• Govern privacy due diligence over third parties in coordination with TPRM and Procurement, ensuring Data Processing Agreements and transfer safeguards are in place before onboarding.
• Assess controller/processor/joint controller roles and advise on the corresponding contractual obligations.

Incident Management and Regulatory Engagement

• Support the DPO in the governance of personal data breach management, including root cause review, lessons learned, and regulatory notification decisions.
• Act as a key point of contact for internal audit, external auditors, consultants, and regulators on privacy governance matters, coordinating management responses and remediation plans.

Awareness, Culture, and Team Leadership

• Design and deliver group-wide and role-specific privacy awareness and training programs.
• Provide guidance, coaching, and technical direction to privacy analysts and Business Unit privacy champions, and deputize for the DPO where required.

Specialist Skills / Technical Knowledge Required for this Role

• Expert knowledge of the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) and its Executive Regulations.
• Strong working knowledge of CBUAE requirements applicable to Licensed Financial Institutions, including the Consumer Protection Regulation and Standards (data protection, consent, and market conduct provisions).
• Knowledge of additional data protection frameworks is considered an advantage, particularly DIFC Data Protection Law No. 5 of 2020, ADGM Data Protection Regulations, EU GDPR, and UK GDPR.
• Proven ability to design and operationalize privacy governance artifacts: policies, SOPs, RoPA, DPIA, transfer assessments, RACI matrices, KPI/KRI frameworks, and control libraries.
• Practical experience with privacy management platforms (OneTrust) and GRC tools (Archer).
• Understanding of information security principles, data lifecycle management, and IT/banking systems landscape.
• Excellent English drafting skills, with the ability to translate regulatory requirements into clear operational procedures for business users; Arabic is an advantage.
• Professional certification preferred: CIPP/E, CIPM, CIPT, CDPO, CISA, CISM or equivalent.
• Strong stakeholder management, influencing, and presentation skills at the Senior Management level.
• Minimum of 8 years of relevant experience in data protection, privacy governance, regulatory compliance, or risk management, of which at least 3 years in a senior or managerial capacity.
• Experience gained within banking, financial services, or another highly regulated industry, preferably in the UAE or wider GCC market.
• Demonstrated track record of building or running an enterprise privacy program covering RoPA, DPIA, data subject rights, breach management, and third-party governance.
• Experience of direct engagement with regulators, internal audit, external auditors, and external consultants on privacy and data protection matters.
• Bachelor’s degree in Law, Information Security, Risk Management, Information Technology, or a related discipline; a postgraduate qualification is an advantage.