Data Protection Officer (GMG/SEG 2)

Job Purpose

Under the direction of the Executive Director, the Data Protection Officer (DPO) will primarily be responsible for assessing the Institute’s data compliance readiness and advising the Executive Director on any noticeable gaps or areas that could be strengthened, make recommendations for mitigation, provide a Gantt schedule, provide advice regarding Data Protection Impact Assessments (DPIAs) and acting as a contact point for data subjects and the Office of the Information Commissioner (OIC). The DPO is also required to draft and finalize a ready-to implement Privacy Governance Framework and review the Data Privacy Notice for adequacy. 

Key Responsibilities

Professional/Technical: 

• Ensures the Institute maintains compliance with the Data Protection Act, 2020; 
• Assesses the Institute’s current processing of personal data and develop SOPs for improvement. To do this, the Data Protection Officer will be required to: 
  • Conduct a mapping exercise of the Institute; 
  • Develop process flow diagrams with attending descriptions and procedures of existing processes; 
  • Propose recommended changes to the processing of personal data, including but not limited to
    • modifying forms used
    • restriction of access/authorizations where necessary, etc. 
• Prepares the Institute for registration and lead on the registration of the Institute as a Data Controller; 
• Assists the Institute with the development of internal policies and procedures related to processing personal data; 
• Prepares and submits routine and special reports, as required; 
• Ensures that data controllers and data subjects are informed about their data protection rights, obligations and responsibilities and raises awareness about them; 
• Provides strategic legal and regulatory guidance to the Executive Director and Senior Management on privacy and data protection issues, laws and trends; 
• Supports a programme of awareness-raising and training to deliver compliance and to foster a data privacy culture; 
• Trains and sensitizes staff and other users; 
• Determines internal processes and fees for dealing with access requests from data subjects and procedures for reporting and remedying breaches; 
• Assists the Institute in the development of appropriate evaluation instruments which will be used to shortlist applicants, and screen successful applicants during the interview process; 
• Participates in the recruitment and selection process; 
• Researches, designs, and implements Data Protection Governance Frameworks and strategies to manage the use of personal data in compliance with the requisite standards and guidelines; 
• Completes the assessment by mapping data processing activities within the Institute, recording the purposes of the processing and a description of the data protection measures employed for each activity as well as the territories with which data is shared; 
• Participates in quarterly reviews with the Executive Director to assess progress and address any concerns; 
• Provides a ready-to-implement Privacy Governance Framework. 

Management/Administrative 

• Contributes to the development of the Unit’s operational plan and budget;
• Develops and implements operating systems and processes including tools and other resources to guide research activities and ensure validity and accuracy of the data collected and generated; 
• Develops and maintains an appropriate system of record keeping for all aspects of data protection. 

Human Resource 

• Promotes the building of institutional knowledge for the Unit by ensuring that established systems and procedures are documented and disseminated; 
• Participates in the recruitment and selection of staff; 
• Performs any other related functions assigned from time to time by the Executive Director. 

Required Knowledge, Skills and Competencies

Core: 

• Excellent problem solving and analytical skills and good judgement exercised;
• Excellent planning and organizing skills; 
• Excellent oral and written communication skills; 
• Strong coaching, leadership and management skills; 
• Strong interpersonal skills; 
• Excellent Teamwork/ cooperation skills; 
• Strong presentation skills; 
• Demonstrated ability to develop new concepts and/or to conduct independent research;
• Ability to work effectively in stressful and time sensitive scenarios; 
• Ability to demonstrate a high level of professionalism; 
• Detail oriented. 

Technical: 

• Sound knowledge of proposal and report writing; 
• Knowledge of cybersecurity risks and information security standards; 
• Understanding of research methods and techniques; 
• Good knowledge of records and information management systems; 
• Knowledge and understanding of the Data Protection Act; 
• Experience in managing data incidences and breaches; 
• Proficiency in the use of relevant computer applications including spreadsheet and statistical software. 

Minimum Required Qualification and Experience

• A Bachelor's Degree or higher qualification in a relevant field, such as Law, Information Technology, Data Protection, Computer Science or a similar field; 
• In-depth knowledge and understanding of data protection laws and regulations, particularly the Data Protection Act, 2020; 
• Demonstrated experience in data protection and privacy, including policy development, compliance, and incident response; 
• Professional certifications in data protection and privacy (e.g., Certified Information Privacy Professional (CIPP) is desirable; 
• Exposure to legal training; 
• Three (3) years related working experience.

Please note that only shortlisted applicants will be contacted.