Act as the bank's appointed DPO under Kenya's Data Protection Act 2019, working independently and without conflicts of interest
Build and improve the data protection and privacy framework, including policies, standards and procedures
Maintain a register of regulatory obligations covering the Act, regulations, ODPC guidance and banking rules
Provide data protection input to Board, Board Risk Committee and management reports, and keep compliance evidence
Design governance structures, controls, reporting and annual compliance plans
Serve as operational secretariat for the Data Protection Committee
Maintain the Data Protection Risk Register and coordinate privacy risk assessments across business units
Integrate privacy risk into RCSA, operational, technology, third-party and enterprise risk frameworks, and define and monitor privacy KRIs
Coordinate and review DPIAs for high-risk processing and advise on privacy for new products, digital channels, systems, AI/analytics, outsourcing and major projects
Embed privacy by design and by default in product and technology development
Set up and monitor processes for handling data subject requests
Review records of processing (RoPA), retention and disposal schedules, privacy notices, consent management and legal bases
Support the personal data breach management and notification framework, coordinate incident investigations and maintain an incident register
Review privacy aspects of third-party, outsourcing, cloud and technology partner arrangements and data processing agreements
Monitor cross-border transfers and related safeguards
Monitor compliance with the Act, regulations and ODPC guidance, and coordinate responses to ODPC requests, inspections and complaints
Run periodic thematic reviews of data protection controls
Develop annual awareness programs and deliver targeted training to high-risk functions
Act as the primary contact for the ODPC on inquiries, registration renewals, audits, inspections and mandatory notifications
Prepare periodic reports on compliance, risks, DPIAs, requests, incidents, third-party risks and KRIs
Requirements
Undergraduate degree in law, IT, data science, risk, compliance, business, finance or a related field
Professional qualification in privacy, data protection, risk, compliance, audit, information security or a related area
5–8 years of experience, ideally in banking, financial services, fintech or another highly regulated sector
Practical knowledge of Kenya's Data Protection Act and its regulations
Privacy certification such as CIPM, CIPP, CDPO or equivalent (e.g. CDPSE)
Alternative certifications such as CAMS, CISA, CISM, ISO 27001, ISO 31000 or related
Experience with ODPC regulatory engagements (desirable)
Experience in data governance, privacy risk assessments, DPIAs and third-party risk (desirable)
Active membership in privacy or security bodies such as IAPP, ISACA or ISC2 (desirable)
Integrity, confidentiality and sound ethical judgment
Attention to detail and analytical, risk-based thinking
Stakeholder engagement and clear written and verbal communication
Done for you
We'll apply to this for you
Denidel's HR team submits and tracks the application on your behalf.
