Data Privacy & Protection Director

• Governance Framework: Implement a data privacy governance framework (including Binding Corporate Rules) to manage data use in compliance with the Nigeria Data Privacy Act (NDPA) 2023.
• Policy Development: Set standards, formulate policies, and establish procedures for the organization to meet NDPA 2023 and other relevant regulations and requirements.
• Stakeholder Awareness: Ensure that employees, third-party processors (TPPs), vendors, and data subjects are fully informed about their data protection rights, obligations, and responsibilities.
• Regulatory Liaison: Serve as the primary point of contact and liaison for the Nigeria Data Privacy Commission (NDPC), other regulators, financial institutions, and customers on data privacy and protection-related matters.
• Query & Incident Resolution: Handle queries, complaints, claims, and notifications from regulators, law enforcement agencies, and data subjects, ensuring prompt feedback and resolutions.
• Impact Assessments: Work with product managers, project managers, and other internal stakeholders to conduct data privacy impact assessments (DPIAs) to ensure compliance with NDPA 2023 and extant regulations.
• Cross-Functional Alignment: Collaborate with IT teams to ensure that IT systems and procedures comply with NDPA and other relevant regulations.
• Security Coordination: Collaborate with the information security team to maintain records of customer data and data processing activities, while sustaining a data security management plan, a data breach response plan, and data retention structures.
• Training Strategy: Develop strategies to ensure continuous engagement with key internal and external stakeholders, and deliver targeted data privacy training to various business functions, TPPs, and vendors.
• Privacy Audits: Coordinate and conduct routine privacy audits, including a comprehensive review of the active privacy governance framework.
• External Auditing: Work closely with the Data Privacy Compliance Organization (DPCO) to conduct external regulatory audits and provide guidance and advice on privacy-related regulatory issues.
• Regulatory Monitoring: Monitor updates to local data privacy laws and regulations and make proactive recommendations to executive leadership when appropriate.

Experience & Background

• Educational Background: A Bachelor’s degree in Law, Information Technology, Computer Science, Business Administration, or a related field. A Master’s degree in information security or law is highly preferred.
• Required Experience: Minimum of 10 years of hands-on experience in data protection, compliance, or a related field, with a deep operational understanding of the NDPA and other relevant data protection laws.
• Proven Track Record: Demonstrated experience managing data privacy in complex organizational settings, including executing data protection audits, leading DPIAs, and managing data breach responses.
• Professional Certifications: Relevant certifications in data protection/privacy (such as CISSP, CIPM, CIPP, CPT, CDPSE, or CDPO) are highly preferred.

Skills & Competencies

• Regulatory Insight: Mastery of data privacy legislations, framework applications, and financial sector compliance structures.
• Analytical Skills: Strong capability to break down complex system flows, audit technical processing records, and discover potential vulnerabilities in data privacy management.
• Ethical Integrity: Uncompromising commitment to confidentiality, objectiveness, and ethical compliance standards.
• Effective Communication: Excellent verbal and written communication skills to successfully collaborate with regulators, external bodies, and internal cross-functional stakeholders.
• Leadership: Strong capability to direct compliance sub-functions, spearhead company-wide training initiatives, and influence technical or product decisions.