Personal Data Protection Officer

Position Overview

The Personal Data Protection Officer (PDPO) is entrusted with overseeing and steering the personal data protection agenda within Gulf International Bank. This role ensures adherence to the Personal Data Protection Law (PDPL) and pertinent regulations, guaranteeing that all personal data handling aligns with legal standards, internal policies, and best practices. The PDPO serves as the primary liaison with regulators, data subjects, and internal teams on all matters linked to personal data security and privacy.

Core Responsibilities

• Advise Gulf International Bank, acting as Data Controller or Processor, and its staff on compliance obligations under the KSA Personal Data Protection Law and other data protection statutes.
• Serve as the initial contact point for authorities and individuals concerning personal data processing and ensure implementation of provisions under Saudi Arabia’s PDPL, its implementation regulations, and regulations on cross-border data transfers.
• Maintain and regularly update the Record of Processing Activities (RoPA) in compliance with regulatory mandates, including identifying and managing risks related to data processing.
• Lead data protection impact assessments, suggest remedial actions, and oversee execution of risk mitigation strategies within the bank’s privacy framework.
• Collaborate with Compliance and other relevant departments to detect, report, and manage data incidents or breaches, ensuring conformity with regulatory requirements.
• Provide periodic reports to senior management on privacy compliance status and organizational risks.
• Manage resolution of non-compliance incidents, ensuring implementation of corrective actions across data privacy functions.
• Coordinate responses to data subject rights requests, cooperating with Business Units to meet regulatory deadlines and maintain thorough records of such requests.
• Work alongside legal and HR teams to devise sanctions for privacy policy violations.
• Review and advise on third-party data processing agreements, especially pertaining to local and international data transfers, and counsel Business Units on compliance monitoring.
• Assess and approve personal data cross-border transfer requests ensuring regulatory compliance and safeguards.
• Oversee development, implementation, maintenance, and continuous compliance of bank-wide privacy policies and procedures.
• Conduct periodic revisions and updates to the bank’s Privacy Policy as necessary.
• Assign privacy responsibilities, raise employee awareness on compliance needs, and conduct staff training on personal data handling. Develop and implement data privacy mitigation plans and establish an internal privacy audit program in collaboration with internal audit functions.
• Support Business Units responsible for new technological deployments to guarantee regulatory adherence.

Qualifications & Experience

• Bachelor’s degree in Law
• Certified Data Protection Officer (CDPO) qualification
• 2 to 4 years of experience within a legal environment

Skills

• Strong proficiency in legal research
• Governance, risk management, and control expertise