Data Privacy Expert

➢ Develop and operationalize Data Privacy Policies, Processes/Procedures, Standards, Principles, Guidelines, and Templates to comply with KSA PDPL and NDMO regulations (including but not limited to Personal Data Breach procedures, DPIA, PIA, RoPA, etc.)

➢ Advise the Bank and employees on data processing requirements under the KSA PDPL and ensure compliance.

➢ Provide guidance on data protection impact assessments (DPIA) for data collection and processing.

➢ Ensure all bank records and systems containing personal data align with PDPL.

➢ Develop a comprehensive risk register that encompasses all identified risks along with corresponding treatment plans, closure dates, and responsible stakeholders.

➢ Define Personal Data Protection Standards to be followed by the Information Security Team.

➢ Conduct due diligence on vendors and monitor their adherence to privacy obligations.

➢ Regularly review and update personal data privacy and protection practices.

➢ Review and advise on controls implemented by the business to ensure compliance with data protection requirements and internal policies.

➢ Collaborate with SAMA, Saudi Data and Artificial Intelligence Authority (SDAIA), and other relevant authorities on data protection matters.

➢ Act as the point of contact for data subjects (e.g., customers) and regulatory authorities.

➢ Collaborate with procurement and legal teams to evaluate privacy risks associated with third-party vendors and service providers.

➢ Review and negotiate privacy terms in vendor contracts to ensure compliance with data protection requirements.

➢ Provide regular reports to senior management and relevant stakeholders on privacy program effectiveness, compliance status, and emerging privacy risks.

➢ Collaborate with legal to address privacy-related legal requirements, inquiries, and regulatory investigations.

➢ Serve as a liaison between Business and Functional areas and technology to ensure data-related business requirements for protecting personal and sensitive data are clearly defined, communicated, and well understood.

➢ Manage and advise the relevant stakeholders on data transfers across borders, including approvals and monitoring.

➢ Establish processes to manage personal data transfers and data sharing agreements with external parties while maintaining privacy compliance.

➢ Support the bank in prioritizing processing activities.

➢ Conduct data flow mapping exercises to identify the journey of personal data from collection to destruction, covering data collection points, systems used for processing, storage, etc.

➢ Conduct the RoPA exercise and maintain its repository for all personal data processing activities.

➢ Conduct PIAs for all processing activities identified in the RoPAs to determine which require DPIAs.

➢ Perform DPIAs based on the results of the PIAs.

➢ Offer consultation in the event of a data breach or incident, report to senior management promptly, and take necessary actions.

➢ Provide clear and transparent privacy notices to data subjects across all channels.

➢ Respond to Data Subject Rights Requests (DSRs) and establish policies and procedures for handling DSRs.

➢ Define performance metrics and ensure compliance with data protection and privacy policies, standards, roles, and responsibilities.

• Bachelor’s degree in engineering, Information Technology, Cybersecurity, or a related field.
• Fluent in spoken and written Arabic and English.
• A minimum of 5+ years of experience in a dedicated data privacy or data protection role.
• Fair Experience in Data Management, CDMP is additional.
• Demonstrable expertise in the Saudi Personal Data Protection Law (PDPL) and its Implementing Regulations.
• Proven experience working with data governance, privacy, and cybersecurity frameworks specific to the Saudi financial sector (e.g., SAMA’s Cyber Security Framework, IT Governance Framework).
• Strong understanding of privacy principles such as data minimization, purpose limitation, and accountability.
• Excellent communication, interpersonal, and leadership skills, with the ability to influence stakeholders at all levels.
• High level of integrity and professional ethics, with the ability to handle confidential information with discretion.

SKILLS

• Excellent IT skills: Full Microsoft Office suite.
• In-depth knowledge of PDPL and other relevant data protection laws and regulations.
• Sufficient knowledge of information technology and data management systems required.
• Well-developed and professional interpersonal skills; ability to interact effectively with people at all organizational levels of the firm.
• Experience of working in a large organization.

Detail-oriented approach needed to recommend and implement strategic improvements on a range of data privacy and data protection issues