Data Protection Officer

Ready to grow together?

ERGO. Grow together.

ERGO Thailand is part of ERGO Group AG, the major insurance group in Germany and Europe, which operates over 20 countries worldwide.

We are committed to build a collaborative, inclusive, and dynamic work environment where everyone can thrive. You will have the opportunity to work in a culture of continuous learning and innovation, where your ideas and contributions will help shape the future of insurance.

Join us in our mission to make insurance easier for everyone. At ERGO Thailand, you are not only fulfilling your career but also play a crucial part of this mission. Apply now and GROW TOGETHER.

What you need to handle for this role

Advisory & Strategic Data Protection Management

• Provide day-to-day legal and operational advice on Data Protection (DP) topics, evaluating new projects, technologies, and data processing activities for management and business units.

• Develop and continuously refine the Data Protection Strategy and Data Protection Management System (DPMS) to align with business objectives while safeguarding the rights and freedoms of data subjects.

• Assist senior management in drafting and broadcasting "Tone-from-the-Top" DP communications to embed privacy into the corporate culture.

Policy Governance, Norms & Documentation

• Draft, revise, and maintain internal DP norms, guidelines, work instructions, forms, and templates in alignment with ERGO Group authoritative standards and policies.
• Regularly review and update Data Protection Information Notices (Privacy Notices) provided to data subjects.
• Supervise and monitor the continuous updating of the Records of Processing Activities (RoPA) to accurately reflect current and new business processing workflows.
• Maintain an up-to-date inventory of Data Processing Agreements (DPAs) and execute necessary DPA-related actions.
• Advise business units on the implementation, documentation, and operational enforcement of data retention and deletion schedules.

Compliance Monitoring, Auditing & Risk Assessment

• Investigate and monitor compliance performance across ERGO Thailand business units and third-party service providers regarding the collection, use, and disclosure of personal data.
• Track, analyze, and report on legal changes, emerging legislation, court jurisdictions, shifts in the threat landscape, and systemic errors to mitigate DP risks.
• Review, consider, and manage Data Protection Impact Assessment (DPIA) approvals within the Risk Evaluation System framework.

Data Breach Management & Data Subject Rights (Culture & Incident Response)

• Foster a strong risk-aware culture across business units regarding the prompt escalation of actual or potential personal data breaches to the Data Protection Office (DPO).
• Lead data breach incident assessments, containment strategies, and reporting workflows.
• Build organizational awareness to ensure Data Subject Rights (DSR) requests are handled appropriately and escalated to the DPO when necessary.

Employee Training & Awareness

• Design, deliver, and continuously evaluate data protection training programs for employees and management. As well as develop, update, and modernize training concepts and instructional materials to maintain high organizational compliance standards.

Cross-Functional Collaboration & Regulatory Liaison

• Serve as the official contact point and co-operate directly with the Data Protection Authority (e.g., PDPC) regarding inquiries, complaints, or compliance issues involving ERGO Thailand or its service providers.
• Act as the key DP liaison collaborating across internal departments, including Governance, IT Security, Operations, Legal, HR, and General Services.

Who we're looking for

• Bachelor’s degree in Law, Business Adinistation, Data Protection, Information Security, or a related field (Master’s degree preferred).
• Relevant professional experience in data protection in an insurance company or in financial services firm, e.g. bank, asset management etc.
• Knowledge and interest in PDPA as well as other statutory and regulatory data protection requirements
• Data Protection training as desirable, e.g. CDPO, CDPSE, CIPP etc.
• Strong conceptual and analytical thinking skills
• Professional level of English skills