Data Privacy Expert

Role Overview

Data Privacy Expert at TAWANTECH. This role is based in Saudi Arabia and reports to senior management on all matters of data privacy compliance and governance.

Role Purpose

Develop, implement, and operationalize a comprehensive data privacy compliance program aligned with KSA Personal Data Protection Law (PDPL) and National Data Management Office (NDMO) regulations. Serve as the organization's subject matter expert and primary point of contact for all data protection matters, including regulatory engagement, internal governance, and data subject rights.

Key Responsibilities

Policy & Standards Development

• Develop and operationalize Data Privacy Policies, Processes, Procedures, Standards, Principles, Guidelines, and Templates to comply with KSA PDPL and NDMO regulations.
• Define Personal Data Protection Standards for use by the Information Security Team.
• Provide clear and transparent privacy notices to data subjects across all channels.
• Establish processes to manage personal data transfers and data sharing agreements with external parties while maintaining privacy compliance.

Compliance & Governance

• Advise the Bank and employees on data processing requirements under the KSA PDPL and ensure compliance.
• Ensure all bank records and systems containing personal data align with PDPL.
• Review and advise on controls implemented by the business to ensure compliance with data protection requirements and internal policies.
• Define performance metrics and ensure compliance with data protection and privacy policies, standards, roles, and responsibilities.
• Support the bank in prioritizing processing activities.

Risk & Assessment Management

• Develop a comprehensive risk register that encompasses all identified risks along with corresponding treatment plans, closure dates, and responsible stakeholders.
• Conduct data flow mapping exercises to identify the journey of personal data from collection to destruction, covering data collection points, systems used for processing, storage, and related details.
• Conduct the Register of Processing Activities (RoPA) exercise and maintain its repository for all personal data processing activities.
• Conduct Privacy Impact Assessments (PIAs) for all processing activities identified in the RoPAs to determine which require Data Protection Impact Assessments (DPIAs).
• Perform DPIAs based on the results of the PIAs.
• Provide guidance on data protection impact assessments (DPIA) for data collection and processing.

Vendor & Third-Party Management

• Conduct due diligence on vendors and monitor their adherence to privacy obligations.
• Collaborate with procurement and legal teams to evaluate privacy risks associated with third-party vendors and service providers.
• Review and negotiate privacy terms in vendor contracts to ensure compliance with data protection requirements.

Incident & Breach Response

• Offer consultation in the event of a data breach or incident, report to senior management promptly, and take necessary actions.
• Develop Personal Data Breach procedures compliant with PDPL and NDMO requirements.

Data Subject Rights & Communications

• Act as the point of contact for data subjects (e.g., customers) and regulatory authorities.
• Respond to Data Subject Rights Requests (DSRs) and establish policies and procedures for handling DSRs.

Cross-Functional & Regulatory Collaboration

• Serve as a liaison between Business and Functional areas and technology to ensure data-related business requirements for protecting personal and sensitive data are clearly defined, communicated, and well understood.
• Collaborate with legal to address privacy-related legal requirements, inquiries, and regulatory investigations.
• Manage and advise relevant stakeholders on data transfers across borders, including approvals and monitoring.
• Collaborate with SAMA, Saudi Data and Artificial Intelligence Authority (SDAIA), and other relevant authorities on data protection matters.

Reporting & Strategic Oversight

• Provide regular reports to senior management and relevant stakeholders on privacy program effectiveness, compliance status, and emerging privacy risks.
• Regularly review and update personal data privacy and protection practices.

Qualifications & Experience

• Bachelor's degree in Engineering, Information Technology, Cybersecurity, or a related field.
• Minimum 5+ years of experience in a dedicated data privacy or data protection role.
• Demonstrable expertise in the Saudi Personal Data Protection Law (PDPL) and its Implementing Regulations.
• Proven experience working with data governance, privacy, and cybersecurity frameworks specific to the Saudi financial sector (e.g., SAMA's Cyber Security Framework, IT Governance Framework).
• Fair experience in Data Management; Certified Data Management Professional (CDMP) is additional.

Skills & Competencies

• In-depth knowledge of PDPL and other relevant data protection laws and regulations.
• Strong understanding of privacy principles such as data minimization, purpose limitation, and accountability.
• Sufficient knowledge of information technology and data management systems.
• Excellent IT skills, including full Microsoft Office suite.
• Fluent in spoken and written Arabic and English.
• Excellent communication, interpersonal, and leadership skills, with the ability to influence stakeholders at all levels.
• Well-developed and professional interpersonal skills; ability to interact effectively with people at all organizational levels.
• Detail-oriented approach to recommend and implement strategic improvements on a range of data privacy and data protection issues.
• High level of integrity and professional ethics, with the ability to handle confidential information with discretion.
• Experience working in large organizations.