Job Purpose
Under the general supervision of the Permanent Secretary, the Data Protection Officer (DPO) (GMG/SEG 3) is to advise and provide guidance to the Ministry on a range of privacy, data protection and technology-related regulatory and compliance matters.
The Data Protection Officer is responsible for overseeing the enforcement, implementation and monitoring (in an independent manner) of Data Protection and privacy Compliance in the Ministry with the provisions of the Data Protection Act. The incumbent will also be responsible for:
- Informing and advising the Ministry on data protection obligations, including processes, policies and standards;
- Maintaining the security of and managing the Ministry’s data, educating employees on data compliance and performing regular Data Security Audits;
- Providing advice regarding Data Protection Impact Assessments (DPIAs), leading investigations into potential or actual data breaches; and
- Acting as a key contact point for data subjects and the Office of the Information Commissioner.
The incumbent will support the success of the Ministry by assisting with the introduction and implementation of its Privacy and Data Protection Programme. Both legal knowledge and technical fluency are highly desired as this role will work closely with staff across all areas of the portfolio.
Key Responsibilities
Administrative
- Aligns the Section’s Corporate/Operational Plans and Budget with the Ministry’s Strategic Objectives and priority programmes;
- Maintains mechanisms to effectively coordinate the alignment of plans, programmes and projects of the Section, to ensure a cohesive and complimentary execution of policy and programme initiatives;
- Develops Individual Work Plans based on alignment with the overall plan for the Section;
- Participates in and coordinates the development of the strategic direction of the Ministry;
- Prepares and submits performance and other Reports relating to the achievement of targets for the Ministry and its Agencies as required and ensures timely submission of all documents/information requested from the Section;
- Participates in meetings, seminars, workshops, and conferences as required;
- Maintains customer service principles, standards, and measurements;
- Identifies and incorporates the interests and needs of customers in business process design.
Technical
- Ensures that the Ministry and its entities process personal data in compliance with the Data Protection Standards, Act and good practice;
- Identifies opportunities to enhance the Ministry’s Data Protection/Privacy Programme;
- Identifies all laws, regulations, standards, and contracts that impose compliance obligations on the Ministry or its Entities related to Data privacy or Data Protection;
- Consults with the Office of the Information Commissioner (OIC) to resolve any doubt about how the provisions of the Act and any Regulations made under it are to be applied;
- Ensures that any contravention of the Data Protection standards or any provisions of the Act by the Ministry, is dealt with in accordance with said Act;
- Provides advice on the research, development and implementation of Data Protection Policies and Procedures for the Ministry;
- Evaluates the effectiveness of the Ministry’s Data Protection framework and ensures that areas of non-conformance with applicable legislation are escalated to the appropriate officers, for corrective action;
- Co-ordinates the efforts of the Ministry in the implementation of essential elements of the applicable Data Protection regulation, such as the principles of data processing, data subjects’ rights, data protection by design and by default, records of processing activities, security of processing and notification and communication of data breaches;
- Prepares and implements staff sensitization plans on Data Privacy/Data Protection;
- Conducts regular audits to ensure Data Protection and Privacy Compliance and addresses potential Data Protection issues;
- Oversees Data Protection Governance for both new and existing initiatives/projects;
- Coordinates with portfolio entities to ensure their compliance with the provisions of the Data Protection Act and Regulations;
- Develops and reports on KPIs to measure the Ministry’s compliance with data privacy/data protection obligations;
- Manages systems that ensures appropriate assignment of responsibilities in relation to the management of data and information and the processing and protection of personal data;
- Provides strategic legal and regulatory guidance to senior management and other Divisions, on privacy and data protection issues, laws, and trends;
- Performs/Oversees the initial and periodic privacy impact assessment, risk analyses, mitigation and remediation;
- Assists data subjects in the exercise of their rights under applicable legislation concerning personal data collected or processed by the Ministry;
- Ensures that the Ministry and data subjects are informed about their Data Protection rights, obligations, and responsibilities and raises awareness about them;
- Ensures awareness of and adherence to the Human Resource Policy, circulars, Staff Orders and other policies and management procedures within the Ministry, that are relevant to the Data Protection Act;
- Develops and leads a programme that raises awareness of policies, standards and guidelines related to data privacy and data protection and training to deliver compliance and to foster a culture of data privacy and protection across the Ministry;
- Gives advice and recommendations to the Ministry about the interpretation or application of the Data Protection Regulations;
- Handles queries or complaints on request by the Ministry, the data controller, other person(s), or on their own initiative;
- Cooperates with the OIC regarding requests concerning investigations or any such action or activities required by the Office;
- Notifies the Ministry and its Entities of any non-compliance with the applicable Data Protection Regulations and Act; and recommends corrective measures necessary to address areas of non-compliance with the Ministry’s Data Privacy and Data Protection obligations and applicable sanctions/penalties;
- Supports the data incident response and data breach notification procedures;
- Prepares and submits routine and special reports, as required;
- Provides expert advice and educates employees on important Data compliance requirements;
- Provides inputs to the Ministry’s training programme;
- Makes recommendations for the appropriate organisational and technical measures to ensure the security of personal data;
- Acts as the primary contact point for data subjects and the Office of the Information Commissioner on issues relating to the processing of data and to consults, where appropriate, regarding any other matter;
- Monitors changes to local privacy laws and makes recommendations, where necessary;
- Performs other related functions assigned from time to time, by the Permanent Secretary.
Required Knowledge, Skills and Competencies
Core:
- Excellent oral and written communication skills
- Ability to work collaboratively with diverse teams and stakeholders
- Good planning and organising skills
- Excellent analytical thinking skills with meticulous attention to detail
- Good problem-solving and decision-making skills
- Good customer and quality focus skills
- Excellent leadership skills
- Excellent interpersonal skills
- Sound integrity
- Ability to demonstrate initiative.
- Compliance
Technical:
- In-depth knowledge and understanding of the Data Protection Act and related legislation
- Knowledge of managing data incidences and breaches
- Knowledge of cybersecurity risks and information security standards
- Ability to manage internal and external partners and relationships
- Excellent priority-setting skills
- Good report-writing skills
- Good understanding of research methods and techniques
- Knowledge of modern business practices and office procedures
- Proficiency in the use of computer applications
Minimum Required Qualification and Experience
- Bachelor’s Degree in Law, Compliance, IT Security, Audit or similar background, from an accredited Tertiary Institution;
- Data Protection and/or Privacy Training;
- Three (3) years’ experience in Law, Audit and/or Risk Management, Compliance, or equivalent experience;
- Demonstrable experience, knowledge and/or in-depth understanding of Data Privacy Legislation;
- Experience in conducting Data Protection Impact Assessments (DPIAs);
- Experience with Data Management or Legal Compliance would be an asset.
- Experience or specialized training in Records and Information Management Systems is an asset;
Special Condition Associated with the Job
- Work will be conducted in an Office outfitted with standard office equipment and specialized software;
- Will be required to travel in the execution of official duties;
- Job entails working in the field;
- The environment is fast-paced with ongoing interactions with critical stakeholders and meeting tight deadlines, which will result in high degrees of pressure, on occasions.
Please note that only shortlisted applicants will be contacted.
