Data Privacy Manager

Overview

This position involves overseeing and executing the organization's comprehensive Data Privacy program to guarantee compliance with the Personal Data Protection Law (PDPL), Saudi Arabian Monetary Authority (SAMA) regulations, National Data Management Office (NDMO) directives, and other relevant international privacy standards.

Core Responsibilities

• Implement and enforce approved data privacy policies, standards, procedures, and guidelines throughout the bank.
• Ensure privacy controls are consistently applied by business units and technology teams.
• Track compliance with privacy obligations and escalate any breaches or non-adherence.
• Align privacy practices with information security, data classification, and governance frameworks.
• Conduct compliance operations in accordance with PDPL, SAMA, and NDMO mandates.
• Stay updated on regulatory changes and assist with impact assessments and implementation strategies.
• Support data privacy audits, internal reviews, and regulatory examinations.
• Maintain Records of Processing Activities (ROPA) and comprehensive data inventories.
• Handle and coordinate Data Subject Access Requests (DSARs) regarding data access, correction, deletion, and portability within mandated timelines.
• Liaise with internal stakeholders to ensure accurate and timely fulfillment of DSARs.
• Maintain detailed logs and reports of DSARs and privacy incidents.
• Conduct Privacy Impact Assessments (DPIAs) for new products, vendors, systems, and initiatives.
• Identify privacy risks and recommend mitigating measures.
• Support integration of privacy-by-design principles in digital transformation, analytics, and AI projects.
• Maintain a privacy incident register and assist with required notifications to regulators and affected parties.
• Manage data lifecycle and retention policies (details unspecified).

Qualifications and Skills

• Possession of a Bachelor’s degree or equivalent with substantial experience in banking.
• Relevant certifications in privacy, security, risk management, or compliance are considered advantageous.
• 5 to 8 years of professional experience in data privacy or a related discipline.
• Previous experience implementing privacy controls within regulated or financial services sectors is preferred.
• Comprehensive understanding of PDPL, SAMA regulations, and operational privacy controls.
• Practical experience managing DSARs, ROPA, DPIAs, and privacy incident responses.
• Knowledge of data classification and data lifecycle management.
• Strong skills in coordination, documentation, and stakeholder engagement.
• Ability to translate complex regulatory requirements into actionable business controls.