Data Protection Officer

• Job Type Full Time
• Qualification BA/BSc/HND , Professional Certificate
• Experience 5 - 8 years
• Location Nairobi
• Job Field Data, Business Analysis and AI , ICT / Computer
• The job holder will support the Bank’s Data Protection Office in establishing, implementing, monitoring and continuously improving the Bank’s data protection and privacy framework, ensuring compliance with the Data Protection Act, 2019, applicable Data Protection Regulations, ODPC guidance and relevant CBK requirements, while embedding privacy-by-design and responsible data management across the Bank. The role will provide second-line oversight and assurance over privacy risks arising from customer, employee, supplier, digital, technology and third-party data processing activities.
• The ODPC’s mandate includes regulating processing of personal data, protecting data subjects’ privacy and overseeing compliance with the Data Protection Act.
• Act as the Bank’s appointed Data Protection Officer in accordance with Section 24 of the Kenya Data Protection Act 2019, ODPC Guidance Notes on DPOs, and relevant Section 25 Principles of Data Protection, performing the role independently and without conflict of interest.
• Support implementation and continuous enhancement of the Bank’s Data Protection and Privacy Framework. Maintain the Bank’s data protection governance structure, policies, standards, procedures and guidelines. Maintain a regulatory obligations register covering the Data Protection Act, Regulations, ODPC guidance and applicable banking requirements with specific ODPC guidance on DPIAs, DPO responsibilities, consent, cross-border transfers and data-sharing
• Coordinate periodic review of data protection policies and procedures.
• Provide data protection input into Board, Board Risk Committee and Management reporting. Maintain appropriate evidence of compliance and regulatory readiness.
• Design and maintain data protection policies, governance frameworks, operational controls, reporting mechanisms, and annual data protection compliance plans.
• Work closely with Legal, Compliance, Risk, IT Security, ICT, Product Development, and Internal Audit functions including other business functions while maintaining the functional independence of the DPO role.
• Serve as the operational secretariat and primary execution officer working alongside Data Protection Committee risk champions across business units to drive consistent compliance.
• Maintain the Bank’s Data Protection Risk Register and monitor emerging privacy risks.
• Coordinate data protection risk assessments across business units.
• Support integration of privacy risks into the Bank’s RCSA, operational risk, technology risk, third-party risk and enterprise risk frameworks.
• Define and monitor data protection KRIs and thresholds.
• Escalate material privacy risks, breaches and control weaknesses to the DPO and relevant governance committees.
• Track remediation actions and ensure closure within approved timelines.
• Coordinate and review Data Protection Impact Assessments (DPIAs) for high-risk processing activities.
• Provide privacy input into new products, digital channels, systems, AI/analytics initiatives, outsourcing and major projects.
• Embed Privacy by Design and Default within product and technology development processes.
• Review proposed changes to processing purposes, data fields, retention periods and data-sharing arrangements.
• Establish and monitor processes for handling data subject requests.
• Oversee requests relating to access, rectification, objection, restriction, erasure and other applicable data subject rights.
• Monitor response timelines and maintain appropriate records.
• Coordinate with key business units such as, Legal, Compliance, Operations, IT and business units where requests require cross-functional intervention.
• Provide expert privacy guidance on AI systems, predictive analytics, automated decision-making, behavioural profiling, fraud prevention engines, biometric data, cloud migrations, and other emerging banking technologies.
• Embed Privacy by Design and Privacy by Default throughout product development life cycles, system implementation, process engineering, and third-party API integrations.
• Review and advise on records of processing activities (RoPA), DFM’s Data Retention & Disposal schedule privacy notices across digital/branch channels, consent management, and legal bases for processing under Section 25 principles.
• Support the Bank’s personal data breach management and notification framework.
• Coordinate investigation and assessment of privacy incidents with Information Security, Cybersecurity, Legal, Compliance and relevant business units.
• Assess regulatory notification requirements and escalation thresholds.
• Maintain a central register of data protection incidents and lessons learned.
• Ensure corrective actions arising from privacy incidents are tracked to closure.
• Review data protection aspects of third-party arrangements, outsourcing, cloud services and technology partnerships.
• Support due diligence and ongoing monitoring of data processors.