Data Privacy Officer

Job Title: Data Privacy Officer (DPO)

Job Summary
We are seeking a certified and highly structured Data Privacy Officer (DPO) to oversee our data protection strategy and ensure compliance with the Philippine Data Privacy Act of 2012 (RA 10173), its Implementing Rules and Regulations (IRR), and all issuance of the National Privacy Commission (NPC).

The ideal candidate will serve as our independent internal expert, the primary liaison to the NPC, and the guardian of our customers' and employees' privacy rights. In accordance with NPC guidelines, this role is structured to remain free from conflicts of interest regarding data processing decisions.

Key Responsibilities

1. Regulatory Compliance & Governance

• Ensure organization-wide alignment with RA 10173 and all relevant NPC circulars.
• Serve as the official, registered Point of Contact for the National Privacy Commission (NPC).
• Manage the company's annual registration updates within the NPC Registration System (NPCRS).
• Draft, update, and enforce the company's internal Data Privacy Manual and external Privacy Notices.
• Review and approve Data Sharing Agreements (DSAs) and Outsourcing Agreements with third-party vendors.

2. Risk Management & Assessments

• Lead and document regular Privacy Impact Assessments (PIAs) for all existing and new organizational processes, systems, and programs.
• Maintain and continuously update the company's Record of Processing Activities (ROPA).
• Monitor data processing operations, identifying vulnerabilities in data storage, transmission, and disposal.

3. Incident Management & Breach Response

• Formulate and regularly test the company's Data Breach Response Plan.
• Lead the Data Breach Response Team in investigating security incidents or potential data leaks.
• Manage the mandatory 72-hour notification process to the NPC and affected data subjects in the event of a reportable data breach.

4. Advocacy and Training

• Conduct mandatory, company-wide data privacy awareness training for all new hires and regular employees.
• Cultivate a privacy-centric culture across business units (Marketing, Sales, IT, HR, Operations).
• Efficiently process and resolve inquiries, complaints, and Data Subject Rights requests (access, correction, erasure) from customers or employees.

Minimum Qualifications

Education:
Bachelor’s degree in Law, Information Technology, Computer Science, Cybersecurity, Risk Management, or Business Administration.

Experience:
Minimum of 3–5 years of dedicated experience in data privacy, corporate compliance, or legal risk management in the Philippines.

Legal Expertise:
Deep operational understanding of the Philippine Data Privacy Act of 2012 (RA 10173).

Certification:
Certified Data Privacy Officer (CDPO) credential or equivalent. International privacy certifications (e.g., CIPP/E, CIPM) is highly preferred.

Skills:
Excellent communication, editing, risk analysis, and stakeholder management skills. Must possess high ethical standards and the ability to maintain management skills.

Work Location: In person, Hybrid