Data Protection Officer

About the Role

We are seeking a dedicated Data Protection Officer to join our Data Protection department based in Riyadh, Saudi Arabia. This full-time role reports directly to the Head of Information Security and focuses on ensuring strict compliance with the Saudi Personal Data Protection Law (PDPL) and relevant international standards.

Core Responsibilities

• Design and enforce policies, procedures, and guidelines to align with Saudi PDPL and global data protection benchmarks.
• Ensure all data processing activities adhere to PDPL requirements by embedding data protection principles into organizational processes.
• Develop and maintain a data governance framework addressing data retention, deletion, and archiving consistent with PDPL regulations.
• Conduct audits and reviews of data-related activities to confirm PDPL compliance, implementing corrective actions for any identified gaps.
• Keep comprehensive documentation including risk assessments and data protection decisions to demonstrate compliance.
• Oversee Data Protection Impact Assessments (DPIAs), ensuring that any identified risks are appropriately mitigated.
• Handle data subject access requests (DSARs) and complaints effectively, ensuring prompt attention and resolution.
• Develop and update a data breach response plan; lead investigations and notify the Saudi Data and Artificial Intelligence Authority (SDAIA) when necessary.
• Serve as the primary contact with regulatory bodies, coordinating audits, inquiries, and nurturing strong relationships.
• Conduct training sessions to educate employees on their responsibilities regarding data protection and foster a compliance-oriented culture.
• Offer strategic advice to senior management on data protection matters and work collaboratively with various departments to integrate data protection throughout the organization.
• Ensure adherence to data localization and data minimization principles by regularly reviewing data processing activities.
• Create, maintain, and regularly update clear and accessible privacy notices to reflect changes in data handling or legal requirements.

Qualifications and Expertise

• Comprehensive understanding of Saudi PDPL and other relevant data protection laws.
• Proven experience in a similar data protection role, preferably within regulated industries such as finance, healthcare, or telecommunications.
• Strong knowledge of data protection frameworks, security measures, and privacy risk management.
• Excellent communication, negotiation, and stakeholder engagement skills.
• Experience managing data breaches and incident responses, with established interactions with regulatory authorities.
• Preferred certifications include CIPP/E, CIPM, CIPT, or equivalent recognized data protection credentials.
• Fluency in both Arabic and English is highly desirable for effective communication with local entities and stakeholders.