Data Protection Officer

Role Overview

The Data Protection Officer (DPO) leads the enterprise data privacy strategy, regulatory compliance, and risk management framework across all projects, cloud services, and internal operations. This role embeds privacy-by-design into technical architectures and software deployments while acting as the primary privacy authority for internal teams, enterprise clients, third-party vendors, and regulatory bodies.

Key Responsibilities

Data Privacy & Compliance Governance

• Draft, maintain, and enforce local privacy policies, guidelines, and frameworks aligned with regulatory requirements (e.g., Act 709 / PDPA, GDPR) and technology industry standards.
• Embed privacy-by-design and privacy-by-default principles across software development, cloud infrastructure, and custom system integration projects.
• Develop and maintain a centralized Record of Processing Activities (ROPA) covering enterprise operations, client data streams, and hosted infrastructure.
• Maintain a privacy risk register integrated directly with the Enterprise Risk Management (ERM) framework.
• Lead, review, and approve Data Privacy Impact Assessments (DPIAs) for internal platforms, software releases, and complex client implementation solutions.
• Conduct regular privacy audits, gap assessments, and control testing across business operations and technical environments.

Third-Party Governance & Client Solutions

• Conduct privacy due diligence on third-party software vendors, cloud providers, and technology partners.
• Collaborate with Legal, Procurement, and Solutions Architecture teams to draft and execute Data Processing Agreements (DPAs), enforcing disclosure limitations, breach notification timelines, and right-to-audit clauses.
• Provide pragmatic, solutions-focused privacy advice to technical delivery teams to help clients navigate cross-border data transfer, multi-tenant environments, and data residency requirements.

Incident Management & Data Subject Rights

• Oversee processes for handling Data Subject Access Requests (DSARs), consent revocations, and privacy complaints from employees, client contacts, and end-users.
• Establish, test, and maintain a robust data breach response plan; lead investigations, documentation, root-cause analyses, and regulatory reporting within mandatory timelines.

Regulatory Engagement & Culture

• Serve as the primary liaison with local Data Protection Commissioners, external auditors, and supervisory authorities.
• Track regulatory trends, enforcement actions, and international privacy developments impacting IT services and data management.
• Design and deliver targeted data privacy training for engineering, consulting, project management, and corporate staff to foster a privacy-conscious organizational culture.

Minimum Requirements

Education & Certifications

• Bachelor’s degree in Law, Information Security, Computer Science, Business Administration, or a related technical discipline.
• Preferred certifications: Certified Information Privacy Professional (CIPP/A or CIPP/E), Certified Information Privacy Manager (CIPM), Certified Data Protection Officer (CDPO), or relevant ISACA/IAPP accreditations.

Experience

• 7–10+ years of progressive experience in data protection, legal compliance, or information security governance.
• Minimum 5 years in a dedicated privacy leadership role, preferably within IT systems integration, cloud services, tech consulting, or managed services.
• Demonstrated experience managing privacy frameworks across multi-tenant environments, complex software systems, or multi-entity business structures.

Skills & Competencies

• Deep knowledge of Act 709 (PDPA), global data privacy laws (GDPR), and IT compliance standards (e.g., ISO/IEC 27701, ISO/IEC 27001, SOC 2).
• Strong technical literacy regarding software architecture, API integrations, cloud infrastructure (AWS/Azure/GCP), and cybersecurity principles.
• Exceptional cross-functional leadership, stakeholder management, and technical communication skills.