Personal Data Protection Officer

Department: Governance, Risk & Compliance (GRC)

We are seeking an experienced Personal Data Protection Officer (DPO) to oversee personal data protection compliance and ensure alignment with Saudi Arabia's Personal Data Protection Law (PDPL), its Implementing Regulations, and applicable SDAIA requirements.

The ideal candidate will have strong expertise in privacy governance, regulatory compliance, risk assessments, and personal data protection practices, with the ability to advise senior management and collaborate with cross-functional teams.

• Monitor organizational compliance with the Saudi Personal Data Protection Law (PDPL), its Implementing Regulations, and applicable SDAIA requirements.
• Oversee personal data protection policies, procedures, compliance monitoring activities, and privacy controls.
• Act as the designated point of contact with SDAIA regarding personal data protection matters.
• Supervise Data Protection Impact Assessments (DPIAs), identify privacy risks, and recommend appropriate mitigation measures.
• Oversee Records of Personal Data Processing Activities (RoPA), ensuring accurate and updated documentation.
• Monitor the handling of Data Subject Requests (DSRs) and complaints, ensuring timely responses in accordance with applicable requirements.
• Assess personal data breaches and coordinate regulatory notifications and corrective actions when required.
• Advise on Privacy by Design and Privacy by Default principles for digital systems, applications, AI initiatives, and business projects.
• Review third-party data processing arrangements, vendor privacy compliance, and cross-border personal data transfers.
• Monitor privacy risks associated with digital marketing, customer analytics, CCTV, and other personal data processing activities.
• Identify compliance gaps, monitor remediation plans, and elevate significant privacy risks when necessary.
• Prepare privacy compliance reports, risk assessments, and recommendations for senior management.
• Support employee awareness and training initiatives related to personal data protection.
• Maintain professional independence when providing privacy oversight and recommendations.

• Bachelor's degree in law, Information Systems, Information Security, Compliance, Risk Management, Data Governance, or a related field.
• Minimum 7 years of relevant professional experience
  , including at least 5 years focused on personal data protection, privacy, compliance, or information governance
  .
• Proven hands-on experience with Saudi PDPL and SDAIA requirements
  .
• Strong knowledge of DPIAs, RoPA, Data Subject Rights, personal data breach assessment, and regulatory reporting.
• Experience in third-party data protection assessments, cross-border transfers, and privacy risk management.
• Familiarity with Privacy by Design, privacy controls, and data protection governance frameworks.
• Strong analytical, communication, stakeholder management, and problem‑solving skills.
• Ability to exercise independent professional judgment and advise senior management.

• Professional certifications such as CIPP/E, CIPM, CDPSE, ISO/IEC 27701
  , or equivalent privacy‑related certifications.
• Professional training or certification in Saudi PDPL and SDAIA requirements.
• Previous experience in large consumer‑facing, digital, multi‑site, or data‑intensive organizations.