Data Privacy & Protection Officer

About the role

The Data Privacy & Protection Officer leads and oversees the Enterprise Data Privacy & Protection programme across the organization, embedding privacy-by-design and privacy-by-default principles into business processes, applications, data platforms and enterprise initiatives. The role works closely with business stakeholders, Legal, Compliance, Information Security and technology teams, and covers the Middle East and Southeast Asia region.

Key responsibilities

• Lead the Enterprise Data Privacy & Protection framework, policies, guidelines and controls, ensuring compliance with applicable regulations across the Middle East and Southeast Asia.
• Monitor regulatory developments and advise on data protection laws, including UAE PDPL, Saudi Arabia PDPL, Bahrain PDPL, Qatar, Oman, Kuwait, Singapore PDPA, Malaysia PDPA, Hong Kong PDP and others.
• Oversee DPIAs, privacy risk assessments, privacy-by-design reviews, RoPA, personal data mapping, data lifecycle management, data minimization, consent management, privacy notices, retention and deletion.
• Manage data subject rights requests, privacy complaints, personal data breach assessments, incident response and regulatory notifications.
• Lead privacy assessments of vendors, processors, third-party integrations, data sharing and cross-border data transfers, including contractual safeguards.
• Advise senior management and business stakeholders, coordinate with Legal, Compliance and Information Security, and drive privacy awareness, training and compliance reporting.

Required profile

• 10-12 years of relevant experience in data privacy, privacy governance, regulatory compliance or data protection.
• Demonstrated experience leading or implementing enterprise-wide or regional privacy programmes across multiple jurisdictions.
• Experience with multinational organizations, diversified business groups or regulated industries with complex cross-border data processing.
• Bachelor's degree in law, information technology, information security, risk management, compliance, business administration or an allied field.

Required skills

• In-depth knowledge of Middle East and Southeast Asian privacy regulations (UAE PDPL, Singapore PDPA, Malaysia PDPA, Hong Kong PDP, etc.).
• Expertise in DPIAs, privacy risk assessments, RoPA, personal data mapping, privacy-by-design and data breach assessments.
• Knowledge of cross-border transfers, data processing agreements and third-party privacy risk assessments.
• Experience with enterprise privacy tools such as OneTrust, Securiti.ai or BigID is an advantage; ISO 27701, GDPR and CIPP/E, CIPP/A, CIPM, CIPT or CDPSE certifications are an added advantage.