Data Protection Officer

Data Protection Officer

Data Protection Officer

Data Protection Officer

JOB PURPOSE The job holder will support the Bank’s Data Protection Office in establishing, implementing, monitoring and continuously improving the Bank’s data protection and privacy framework, ensuring compliance with the Data Protection Act, 2019, applicable Data Protection Regulations, ODPC guidance and relevant CBK requirements, while embedding privacy-by-design and responsible data management across the Bank. The role will provide second-line oversight and assurance over privacy risks arising from customer, employee, supplier, digital, technology and third-party data processing activities. The ODPC’s mandate includes regulating processing of personal data, protecting data subjects’ privacy and overseeing compliance with the Data Protection Act. KEY RESPONSIBILITIES AND ACTIVITIES Data Protection Governance

• Act as the Bank’s appointed Data Protection Officer in accordance with Section 24 of the Kenya Data Protection Act 2019, ODPC Guidance Notes on DPOs, and relevant Section 25 Principles of Data Protection, performing the role independently and without conflict of interest.
• Support implementation and continuous enhancement of the Bank’s Data Protection and Privacy Framework. Maintain the Bank’s data protection governance structure, policies, standards, procedures and guidelines. Maintain a regulatory obligations register covering the Data Protection Act, Regulations, ODPC guidance and applicable banking requirements with specific ODPC guidance on DPIAs, DPO responsibilities, consent, cross-border transfers and data-sharing,
• Coordinate periodic review of data protection policies and procedures.
• Provide data protection input into Board, Board Risk Committee and Management reporting. Maintain appropriate evidence of compliance and regulatory readiness.
• Design and maintain data protection policies, governance frameworks, operational controls, reporting mechanisms, and annual data protection compliance plans.
• Work closely with Legal, Compliance, Risk, IT Security, ICT, Product Development, and Internal Audit functions including other business functions while maintaining the functional independence of the DPO role.
• Serve as the operational secretariat and primary execution officer working alongside Data Protection Committee risk champions across business units to drive consistent compliance.

Data Protection Risk Management

• Maintain the Bank’s Data Protection Risk Register and monitor emerging privacy risks.
• Coordinate data protection risk assessments across business units.
• Support integration of privacy risks into the Bank’s RCSA, operational risk, technology risk, third-party risk and enterprise risk frameworks.
• Define and monitor data protection KRIs and thresholds.
• Escalate material privacy risks, breaches and control weaknesses to the DPO and relevant governance committees.
• Track remediation actions and ensure closure within approved timelines.

Data Protection Impact Assessments

• Coordinate and review Data Protection Impact Assessments (DPIAs) for high-risk processing activities.
• Provide privacy input into new products, digital channels, systems, AI/analytics initiatives, outsourcing and major projects.
• Embed Privacy by Design and Default within product and technology development processes.
• Review proposed changes to processing purposes, data fields, retention periods and data-sharing arrangements.

Data Governance & Records

• Maintain oversight of the Bank’s Records of Processing Activities (ROPA).
• Support data inventory and data-flow mapping across critical business processes.
• Monitor data retention and disposal requirements.
• Coordinate periodic review of data classification and handling requirements.
• Support implementation of appropriate controls over sensitive and confidential information.

Regulatory Compliance & Assurance

• Monitor compliance against the Data Protection Act, Regulations and applicable ODPC guidance.
• Coordinate responses to ODPC information requests, inspections, complaints and regulatory reviews.
• Support regulatory examinations and remediation programs.
• Conduct periodic thematic reviews of data protection controls.
• Maintain regulatory evidence and compliance attestations.

Awareness & Capacity Building

• Develop and coordinate annual data protection awareness programmes.
• Deliver targeted training for high-privacy risk functions including:
• Digital Banking
• Credit
• Operations
• Marketing
• HR
• IT
• Procurement
• Customer Service
• Fraud
• AML/KYC
• Promote a privacy-conscious culture across the Bank.
• Maintain training completion and certification records.

Regulatory Liaison & External Representation

• Serve as the primary point of contact for Data Protection Authorities (ODPC), managing regulatory inquiries, statutory registration renewals, compliance audits, inspections, and mandatory notifications.
• Serve as the primary escalation point for data subjects, overseeing the handling of Data Subject Access Requests (DSARs) and ensuring they are resolved accurately within statutory timelines.

Reporting & Governance

• Prepare periodic reports covering for example:
• Data protection compliance status
• Open privacy risks
• DPIAs completed/outstanding
• Data subject requests
• Data breaches/incidents
• Third-party privacy risks
• Regulatory matters
• Policy exceptions
• RCSA/control testing results
• Remediation status
• Key privacy KRIs

KNOWLEDGE, SKILLS & EXPERIENCE

• Bachelor’s degree in Law, Information Technology, Data Science, Risk Management, Compliance, Business, Finance or related discipline.
• Professional qualification in data protection/privacy, risk, compliance, audit, information security or related field.
• 5–8 years’ experience, preferably within banking, financial services, fintech or another highly regulated environment.
• Practical knowledge of the Kenyan Data Protection Act and Regulations.

Professional Certificates

• CIPM / CIPP / CDPO / equivalent privacy qualification (e.g. Certified Data Privacy Solutions Engineer (CDPSE), Certified Information Privacy Profession(CIPP)
• CAMS, CISA, CISM, ISO 27001, ISO 31000 or related qualification.

Desirable

• Experience with ODPC regulatory engagements.
• Experience in data governance, privacy risk assessments, DPIAs and third-party risk.
• Active membership or affiliation with professional privacy and security organizations (e.g., IAPP, ISACA, ISC2).

Technical / Functional Skillset

• Data protection & privacy regulatory knowledge – DPA, ODPC Regulations & Guidelines
• Privacy risk management, DPIAs and Privacy-by-Design
• Data governance, ROPA, data mapping and retention
• Data breach/incident management and regulatory reporting
• Third-party/data processor risk management
• RCSA, control testing, KRIs and compliance monitoring
• Policy development, regulatory interpretation and assurance
• Strong understanding of banking, digital, technology and customer-data environments
• Data protection awareness and training

Behavioral Competencies

• Behavioral Competencies
• High integrity, confidentiality and ethical judgment
• Strong attention to detail
• Analytical and risk-based thinking
• Independent challenge and professional skepticism
• Strong stakeholder engagement and influencing skills
• Clear written and verbal communication
• Ability to manage sensitive/confidential matters
• Proactive and solution-oriented
• Organized, disciplined and delivery-focused
• Ability to translate regulatory requirements into practical business controls

Application Form

Position Applying For: Data Protection Officer We use cookies to provide you with the best possible user experience. By continuing to use our site, you agree to their use.

Learn more