Data Protection Officer

About the Role
Tabby is seeking a Data Protection Officer to report directly to the Head of Information Security. This full-time role involves developing and implementing robust data protection frameworks to ensure compliance with relevant regulations and international standards.
Key Responsibilities

Develop and implement data protection policies, procedures, and guidelines aligned with Saudi PDPL and international standards.
Ensure data processing complies with PDPL, integrating data protection principles across all processes.
Establish a data governance framework for retention, deletion, and archiving in line with PDPL requirements.
Review and audit data activities to ensure PDPL compliance, addressing any identified gaps with corrective actions.
Maintain comprehensive documentation to demonstrate compliance, including risk assessments and data protection decisions.
Guide Data Protection Impact Assessments (DPIAs) and ensure identified risks are effectively mitigated.
Manage data subject requests (DSARs) and complaints, ensuring timely responses and resolution.
Develop and maintain a data breach response plan, leading investigations and notifying SDAIA when required.
Act as the liaison with regulators, coordinating audits, inquiries, and maintaining strong relationships.
Provide employee training on data protection responsibilities, fostering a culture of compliance.
Advise senior management on data protection strategy, collaborating with departments to embed best practices.
Ensure compliance with data localization and minimization principles, regularly reviewing processing activities.
Create and maintain clear, accessible privacy notices, updating them to reflect changes in data or regulations.

Qualifications and Experience

5-10 years of demonstrated experience in a similar position, ideally within regulated sectors such as finance, healthcare, or telecommunications.
In-depth knowledge of the Saudi Personal Data Protection Law (PDPL) and other applicable data protection regulations.
Strong grasp of data protection principles, security protocols, and privacy risk management.
Experience in handling data breaches, managing incident responses, and engaging with regulatory bodies.
Relevant certifications such as CIPP/E, CIPM, CIPT, or other recognized data protection qualifications are preferred.

Required Skills

Exceptional skills in communication, negotiation, and stakeholder management.
Proficiency in both Arabic and English is highly advantageous for effective communication with local authorities and stakeholders.