Data Privacy Specialist

Support the Company’s data privacy program to safeguard personal data and maintain compliance with the Saudi Personal Data Protection Law (PDPL), its implementing regulations, and applicable Insurance Authority requirements across insurance operations.

Key Responsibilities

• Maintain privacy policies, procedures, notices, consent mechanisms, and records of personal data processing.
• Review personal data handling across underwriting, policy administration, claims, customer service, marketing, and HR.
• Maintain data inventories and flow maps, including sensitive health and claims information.
• Conduct privacy impact assessments for new products, systems, projects, and processing activities; monitor corrective actions.
• Coordinate data subject requests and privacy complaints within applicable timelines.
• Assess privacy risks relating to brokers, reinsurers, healthcare providers, third-party administrators, and other service providers.
• Review data processing agreements, data sharing arrangements, retention practices, and cross-border transfers with Legal and relevant departments.
• Support personal data breach investigations, documentation, escalation, and required notifications through authorized channels.
• Deliver privacy awareness training and prepare compliance reports and audit evidence.

Qualifications and Experience

• Bachelor’s degree in Law, Information Systems, Cybersecurity, or a related discipline.
• Minimum 3 years of relevant experience in data privacy, data protection, or compliance, preferably in insurance or financial services.
• Sound knowledge of the Saudi PDPL and its implementing regulations.
• Understanding of insurance operations and sensitive personal data handling.
• CIPP/E, CIPM, CIPT, or equivalent certification is preferred.

Core Competencies

Privacy risk assessment, regulatory interpretation, confidentiality, analytical thinking, attention to detail, stakeholder coordination, and effective Arabic and English communication.

Key Performance Indicators

Timely completion of privacy assessments and data subject requests; accuracy of processing records; closure of privacy findings; training completion; and timely incident escalation.