Group Data Protection Officer

Overview

An established holding company in Jeddah is looking to recruit a Group Data Protection Officer (DPO) to spearhead its comprehensive data privacy and protection strategy across the entire enterprise. This pivotal leadership position ensures adherence to the Saudi Personal Data Protection Law (PDPL) and acts as the chief advisor on privacy matters, elevating governance standards, regulatory adherence, and fostering a robust data privacy culture throughout the group.

Key Responsibilities

• Oversee the development, execution, and ongoing supervision of the Group’s data privacy framework compliant with the KSA PDPL.
• Serve as the main liaison with the Saudi Data and Artificial Intelligence Authority (SDAIA), managing regulatory communications and ensuring compliance efforts.
• Manage and review Privacy Impact Assessments (PIAs), Data Protection Impact Assessments (DPIAs), Legitimate Interest Assessments (LIAs), and Transfer Impact Assessments (TIAs).
• Advise cross-functional business and IT teams on integrating Privacy by Design principles and addressing privacy risks effectively.
• Lead the response to personal data breaches, including coordination of regulatory notifications as necessary.
• Ensure harmonization and guidance for subsidiary company DPOs, reinforcing privacy governance enterprise-wide.
• Champion data privacy awareness by organizing training sessions and engagement programs for employees.
• Provide senior management with regular updates and strategic advice concerning privacy risks and compliance status.

Qualifications and Skills

• Minimum of eight years’ professional experience in data protection, privacy, legal compliance, or risk management domains.
• Practical and in-depth knowledge of the KSA PDPL, its implementation regulations, and SDAIA/NDMO protocols.
• Expertise in privacy management operations including Records of Processing Activities (RoPA), DPIAs, breach handling, Data Subject Rights, and managing cross-border data transfers.
• Familiarity with global privacy and security standards such as GDPR and ISO 27001.
• Prior experience in a multi-entity or holding company environment is strongly preferred.
• Academic degree in Law, Information Governance, Cybersecurity, IT, or related areas; possession of recognized privacy certifications is an advantage.
• Proficiency in Arabic and English with excellent communication and stakeholder engagement capabilities.