Data Protection Officer (DPO)

The Data Protection Officer (DPO) is responsible for ensuring organization compliance with applicable data protection and privacy regulations, overseeing lawful processing of personal and sensitive data, and acting as the primary liaison with regulators on data privacy matters.

Key Responsibilities

• Ensure compliance with UAE Federal Decree-Law No. 45 of 2021 (Personal Data Protection Law – PDPL), UAE Data Office regulations, and applicable CBUAE requirements.
• Develop, implement, and maintain data protection policies, standards, and procedures.
• Advise senior management and business units on data protection obligations and risk exposure.
• Oversee processes for data subject access, correction, erasure, restriction, objection, and portability requests.
• Lead assessment and response to data breaches and privacy incidents.
• Conduct Data Protection Impact Assessments (DPIAs) and maintain Records of Processing Activities (RoPA).
• Review and approve Data Processing Agreements (DPAs) and ensure compliance with cross-border data transfers.
• Drive organization-wide data privacy awareness and training programs.

Requirements

• Bachelor’s degree in Law, Information Security, Risk, Compliance, or related discipline.
• 8–12 years of experience in data protection, privacy, or information governance.
• Prior experience in Insurance or BFSI sector preferred.
• Experience handling sensitive, financial, and health-related personal data.

Certifications (Preferred)

• ISO/IEC 27001 Lead Auditor / Implementer
• CIPP/E, CIPP/A, CIPM, or equivalent privacy certifications

Independence & Authority

• The DPO shall operate independently and without conflict of interest.
• Direct access to senior management and the Board is mandatory.