Data Privacy & Protection Director

Responsibilities

• Implement a data privacy governance framework (including Binding Corporate Rules) to manage data use in compliance with the Nigeria Data Privacy Act (NDPA) 2023.
• Set standards, formulate policies, and establish procedures for the organization to meet NDPA 2023 and other relevant regulations and requirements.
• Ensure that employees, third-party processors (TPPs), vendors, and data subjects are fully informed about their data protection rights, obligations, and responsibilities.
• Serve as the primary point of contact and liaison for the Nigeria Data Privacy Commission (NDPC), other regulators, financial institutions, and customers on data privacy and protection-related matters.
• Handle queries, complaints, claims, and notifications from regulators, law enforcement agencies, and data subjects, ensuring prompt feedback and resolutions.
• Work with product managers, project managers, and other internal stakeholders to conduct data privacy impact assessments (DPIAs) to ensure compliance with NDPA 2023 and extant regulations.
• Collaborate with IT teams to ensure that IT systems and procedures comply with NDPA and other relevant regulations.
• Collaborate with the information security team to maintain records of customer data and data processing activities, while sustaining a data security management plan, a data breach response plan, and data retention structures.
• Develop strategies to ensure continuous engagement with key internal and external stakeholders, and deliver targeted data privacy training to various business functions, TPPs, and vendors.
• Coordinate and conduct routine privacy audits, including a comprehensive review of the active privacy governance framework.
• Work closely with the Data Privacy Compliance Organization (DPCO) to conduct external regulatory audits and provide guidance and advice on privacy-related regulatory issues.
• Monitor updates to local data privacy laws and regulations and make proactive recommendations to executive leadership when appropriate.

Requirements

• A Bachelor's degree in Law, Information Technology, Computer Science, Business Administration, or a related field. A Master's degree in information security or law is highly preferred.
• Minimum of 5 years of hands-on experience in data protection, compliance, or a related field, with a deep operational understanding of the NDPA and other relevant data protection laws.
• Demonstrated experience managing data privacy in complex organizational settings, including executing data protection audits, leading DPIAs, and managing data breach responses.
• Relevant certifications in data protection/privacy (such as CISSP, CIPM, CIPP, CPT, CDPSE, or CDPO) are highly preferred.
• Mastery of data privacy legislations, framework applications, and financial sector compliance structures.
• Strong capability to break down complex system flows, audit technical processing records, and discover potential vulnerabilities in data privacy management.
• Uncompromising commitment to confidentiality, objectiveness, and ethical compliance standards.
• Excellent verbal and written communication skills to successfully collaborate with regulators, external bodies, and internal cross-functional stakeholders.
• Strong capability to direct compliance sub-functions, spearhead company-wide training initiatives, and influence technical or product decisions.

Benefits

• Competitive compensation, benefits, and career growth opportunities.
• A collaborative and supportive work culture dedicated to professional development and continuous learning.