Data Privacy & Protection Officer

About the role

techcarrot FZ LLC is looking for a Data Privacy & Protection Officer in Dubai to lead and oversee the Enterprise Data Privacy & Protection programme across the organisation. The role ensures compliance with data protection regulations and works with Legal, Compliance, Information Security and technology teams to embed privacy-by-design and privacy-by-default principles. It covers privacy governance, DPIAs, compliance assessments, risk management and reporting.

Key responsibilities

• Lead the Enterprise Data Privacy & Protection framework, policies, guidelines and controls, ensuring compliance across the Middle East and Southeast Asia
• Monitor regulatory developments and advise on data protection laws including UAE PDPL, Saudi Arabia PDPL, Bahrain PDPL, Qatar, Oman, Kuwait, Singapore PDPA, Malaysia PDPA, Hong Kong PDP and others
• Oversee DPIAs, privacy risk assessments and privacy-by-design reviews for business initiatives, applications, AI solutions and data platforms
• Manage personal data mapping, records of processing activities (RoPA), data lifecycle, data minimisation, consent management, privacy notices, retention and deletion
• Set up processes for data subject rights requests, privacy complaints, breach assessments, incident response and regulatory notifications
• Lead privacy assessments of vendors, processors, third-party integrations and international data transfers, including contractual safeguards
• Advise senior management, coordinate with Legal, Compliance and Information Security, and drive privacy awareness, training and compliance reporting

Required profile

• 10-12 years of relevant experience in data privacy, privacy governance, regulatory compliance or data protection
• Demonstrated experience leading or implementing enterprise-wide or regional privacy programmes across multiple jurisdictions
• Experience with DPIAs, RoPA, third-party privacy assessments, breach response, data subject rights and compliance reporting
• Experience in multinational organisations, diversified business groups or regulated industries with complex cross-border data processing
• Bachelor's degree in law, IT, information security, risk management, compliance, business administration or an allied field

Required skills

• In-depth knowledge of Middle East and Southeast Asian privacy regulations
• Expertise in DPIAs, RoPA, personal data mapping, privacy-by-design and cross-border data transfers
• Experience with enterprise privacy tools such as OneTrust, Securiti.ai or BigID (advantage)
• Knowledge of ISO 27701, GDPR and other international frameworks (advantage)
• Certifications such as CIPP/E, CIPP/A, CIPM, CIPT, CDPSE or ISO 27701 Lead Implementer/Auditor (advantage)
• Excellent English communication skills