head of data protection (public listed).

Job Title: Head of Data Protection

Job Purpose:

• Lead the development and implementation of robust data protection policies, processes, and tools to ensure the Group's full compliance with data protection laws, regulations, and operational standards.
• Act as the primary contact within the Group for employees, regulators, and public authorities on all data protection-related matters.
• Ensure the Group's data protection practices align with regulatory codes such as the Personal Data Protection Act (PDPA) and other relevant standards.
• Foster a culture of data protection and compliance across the organization, ensuring all units adhere to established protocols.

Job Responsibilities:

Data Protection:

• Data Policy: Develop, amend, and update the Group’s internal data policies, guidelines, and procedures, ensuring compliance with relevant laws, regulations, and standards. Engage with key internal stakeholders during policy development.
• Data Management Strategy & Plan: Create and drive the Group’s data management strategy and ensure alignment with data protection laws such as PDPA and other relevant regulations.
• Risk Management: Lead the identification and assessment of data risks, implementing appropriate controls and mitigation strategies. Collaborate with Business/Operations Units and Group Risk Management to ensure timely reporting and analysis for management committees.
• Data Protection Impact Assessments (DPIAs): Conduct DPIAs for new projects, systems, or processes involving personal data, assessing risks, and recommending mitigation measures.
• Privacy by Design: Work with cross-functional teams to embed privacy considerations into the design and implementation of new products, services, and processes.
• Monitoring Compliance: Oversee the implementation and monitoring of the Group’s data protection strategy, including conducting internal audits and assessments of data processing activities.
• Educating and Training Staff: Develop and implement training programs to educate data owners, employees, and relevant stakeholders on data protection best practices, legal requirements, and compliance obligations.
• Incident Response: Develop and implement incident response procedures for data breaches, including notification protocols for data protection authorities and affected individuals.
• Data Breach Management: Manage and report data breaches to relevant authorities and internal stakeholders, ensuring compliance with data protection regulations.
• Vendor Management: Evaluate third-party vendors’ data protection practices, ensuring compliance with contractual obligations through privacy impact assessments.
• Point of Contact: Serve as the primary contact for data protection authorities, internal stakeholders, and individuals on data protection matters, including inquiries, complaints, and investigations.
• Reporting and Documentation: Maintain thorough documentation related to data protection activities, including records of processing activities, data breach notifications, and regulatory correspondence.
• Business and Operations: Participate in relevant business, project, and strategy meetings, contributing to discussions on data protection.

External Compliance:

• Stay updated on emerging data protection laws, best practices, and industry trends.
• Advise management on data risks and industry trends, providing regular updates to relevant committees and boards.
• Continuously improve the Identity Access Management (IAM) and Risk Management Framework, where applicable.

Administration/Operations:

• Lead and manage the data protection team, ensuring they deliver on mandates and KPIs.
• Develop and drive the implementation of the annual data protection plan, reporting progress to the Chief Risk and Compliance Officer (CRICO).
• Oversee budget management for the data protection function and ensure alignment with approved budgets.
• Provide performance evaluations, developmental feedback, and succession planning to maintain and enhance team performance.
• Collaborate with Group Risk Management and Compliance Office to execute annual plans and programs.

Additional Responsibilities:

• Assist in establishing and maintaining data communication tools using appropriate methodologies and techniques.
• Provide advisory services to departments to improve their data management capabilities.
• Support the development and implementation of tools and systems to enhance the data management environment.
• Ensure clear working relationships with operational teams to avoid overlap in managing risks and controls.
• Perform other duties as assigned.

Impact and Accountability:

• Deliver the Group’s Data Strategy and Annual Plans.
• Achieve set targets and deliverables, maintaining data standards and methodologies.
• Uphold high ethical conduct, independence, and confidentiality in all duties.

Qualifications:

Education/Professional Qualifications:

• Bachelor’s degree in Law, Information Technology, or a related field.
• Advanced degree or professional certification in data protection (e.g., CIPP/E, CIPM, CIPT) preferred.

Professional Experience:

• At least 8 years in data protection compliance or a related field, with a minimum of 3 years in a senior role.
• Expertise in data protection laws and practices, particularly PDPA.
• Experience in developing policy and compliance training.
• Strong background in legal, audit, or risk management.

Skills:

• Proven experience in data protection compliance within a regulated industry.
• Strong analytical skills with the ability to assess complex legal and technical issues.
• Excellent communication and interpersonal skills for effective collaboration across all organizational levels.
• Detail-oriented with a commitment to data privacy and security standards.
• Strategic thinker with strong business acumen and analytical skills.
• Adaptable, with problem-solving abilities and leadership skills to manage various stakeholders.
• Ability to handle confidential information with discretion.
• IT knowledge/background is an added advantage.