Data Protection Officer

Job Purpose:

Under the general supervision of the Managing Director, the Data Protection Officer (DPO) is to advise and provide guidance on a range of privacy, data protection and technology related regulatory and compliance matters.  The DPO is responsible for monitoring internal compliance, informing and advising the Corporation on data protection obligations, providing advice regarding Data Protection Impact Assessments (DPIAs) and acting as a contact point for data subjects and the Office of the Information Commissioner (OIC).

The DPO will support the success of the Corporation through assisting with the introduction and the implementation of its privacy programme.  Both legal knowledge and technical fluency are highly desired as this role will closely with staff across all areas of the portfolio.

Qualification:

• Bachelor of Law Degree Compliance, IT Security, Audit or similar background;
• Minimum three (3) years’ experience in law, audit, and/or risk management, compliance or equivalent experience.
• Demonstratable experience, knowledge and/ or in-depth understanding of data privacy legislation (in particular GDPR).
• Experience or specialized training in records and information management systems.
• At least on Data Protection and/ or Privacy certification such as CIPP, CIPT, ISEB, etc., (preferred).

Special conditions:

• May be required to travel.
• Twenty percent (20%) of the time spent travelling to conduct research, submit reports and file documents related to data compliance.

Required Competencies:

• Good oral and written communication skills.
• Planning and Organizing skills.
• Good judgement and decision-making skills.
• Customer and quality focus skills.
• Analytical and problem-solving skills.
• Compliance.
• Integrity.
• Adaptability

Duties and Responsibilities:

• Ensures that the Corporation processes personal data in compliance with the data protection standards and in compliance with the Act and good practice.
• Provides overall management for the research, development and implementation of Data Protection policies and procedures for the Corporation.
• Researches, designs and implements Data Protection Governance Frameworks and strategies to manage the use of personal data in compliance with the requisite standards and guidelines.
• Consults with the OIC to resolve any doubt about how the provisions of the Act and any regulations made under it are to be applied.
• Ensures that any contravention of the data protection standards or any provisions of the Act by the Corporation is dealt with.
• Co-ordinates the efforts of the Corporation in the implementation of essential elements of the applicable data protection regulation, such as the principles of data processing, data subjects’ rights, data protection by design and by default, records of processing activities, security of processing and notification and communication of data breaches.
• Provides strategic legal and regulatory guidance to senior management and other stakeholders on privacy and data protection issues, law and trends.
• Ensures that data controllers and data subjects are informed about their data protection rights, obligations and responsibilities and raises awareness about them.
• Oversees the maintenance of records required to demonstrate data protection compliance.
• Gives advice and recommendations to the Corporation about the interpretation or application of the data protection rules.
• Cooperates with the OIC (responding to requests about investigations, complaint handling, inspections conducted by the OIC, etc).
• Prepares and submits routine and special reports, as required.
• Drafts new and amends existing internal data protection policies, guidelines, and procedures, in consultation with key stakeholders.
• Participates in meetings, seminars, workshops, and conferences as required.
• Performs any other related duties that may be assigned from time to time.