Data Protection Officer at Sidian Bank

Job Description

JOB PURPOSE

The job holder will support the Bank’s Data Protection Office in establishing, implementing, monitoring and continuously improving the Bank’s data protection and privacy framework, ensuring compliance with the Data Protection Act, 2019, applicable Data Protection Regulations, ODPC guidance and relevant CBK requirements, while embedding privacy-by-design and responsible data management across the Bank. The role will provide second-line oversight and assurance over privacy risks arising from customer, employee, supplier, digital, technology and third-party data processing activities.

The ODPC’s mandate includes regulating processing of personal data, protecting data subjects’ privacy and overseeing compliance with the Data Protection Act.

KEY RESPONSIBILITIES AND ACTIVITIES

Data Protection Governance

• Act as the Bank’s appointed Data Protection Officer in accordance with Section 24 of the Kenya Data Protection Act 2019, ODPC Guidance Notes on DPOs, and relevant Section 25 Principles of Data Protection, performing the role independently and without conflict of interest.   
• Support implementation and continuous enhancement of the Bank’s Data Protection and Privacy Framework. Maintain the Bank’s data protection governance structure, policies, standards, procedures and guidelines. Maintain a regulatory obligations register covering the Data Protection Act, Regulations, ODPC guidance and applicable banking requirements with specific ODPC guidance on DPIAs, DPO responsibilities, consent, cross-border transfers and data-sharing,
• Coordinate periodic review of data protection policies and procedures.
• Provide data protection input into Board, Board Risk Committee and Management reporting. Maintain appropriate evidence of compliance and regulatory readiness.
• Design and maintain data protection policies, governance frameworks, operational controls, reporting mechanisms, and annual data protection compliance plans.
• Work closely with Legal, Compliance, Risk, IT Security, ICT, Product Development, and Internal Audit functions including other business functions while maintaining the functional independence of the DPO role.
• Serve as the operational secretariat and primary execution officer working alongside Data Protection Committee risk champions across business units to drive consistent compliance.

Data Protection Risk Management

• Maintain the Bank’s Data Protection Risk Register and monitor emerging privacy risks.
• Coordinate data protection risk assessments across business units.
• Support integration of privacy risks into the Bank’s RCSA, operational risk, technology risk, third-party risk and enterprise risk frameworks.
• Define and monitor data protection KRIs and thresholds.
• Escalate material privacy risks, breaches and control weaknesses to the DPO and relevant governance committees.
• Track remediation actions and ensure closure within approved timelines.

Data Protection Impact Assessments

• Coordinate and review Data Protection Impact Assessments (DPIAs) for high-risk processing activities.
• Provide privacy input into new products, digital channels, systems, AI/analytics initiatives, outsourcing and major projects.
• Embed Privacy by Design and Default within product and technology development processes.
• Review proposed changes to processing purposes, data fields, retention periods and data-sharing arrangements.

Data Subject Rights

• Establish and monitor processes for handling data subject requests.
• Oversee requests relating to access, rectification, objection, restriction, erasure and other applicable data subject rights.
• Monitor response timelines and maintain appropriate records.
• Coordinate with key business units such as, Legal, Compliance, Operations, IT and business units where requests require cross-functional intervention.

Emerging Tech & Privacy by Design

• Provide expert privacy guidance on AI systems, predictive analytics, automated decision-making, behavioural profiling, fraud prevention engines, biometric data, cloud migrations, and other emerging banking technologies.
• Embed Privacy by Design and Privacy by Default throughout product development life cycles, system implementation, process engineering, and third-party API integrations.
• Review and advise on records of processing activities (RoPA), DFM’s Data Retention & Disposal schedule privacy notices across digital/branch channels, consent management, and legal bases for processing under Section 25 principles.  

Data Breach & Incident Management

• Support the Bank’s personal data breach management and notification framework.
• Coordinate investigation and assessment of privacy incidents with Information Security, Cybersecurity, Legal, Compliance and relevant business units.
• Assess regulatory notification requirements and escalation thresholds.
• Maintain a central register of data protection incidents and lessons learned.
• Ensure corrective actions arising from privacy incidents are tracked to closure.

Third-Party & Outsourcing Privacy Risk

• Review data protection aspects of third-party arrangements, outsourcing, cloud services and technology partnerships.
• Support due diligence and ongoing monitoring of data processors.
• Review data processing agreements and privacy clauses in conjunction with Legal and Procurement.
• Monitor cross-border transfers and related safeguards.
• Maintain oversight of processor compliance and contractual obligations.
• Privacy Incident & Breach Management – Direct data protection incident response protocols, overseeing breach triage, root-cause assessments, containment strategies, and statutory notifications to the ODPC and affected data subjects within regulatory timelines.
• Provide independent oversight and challenge regarding third-party privacy risk assessments, vendor due diligence, and joint data controller/processor arrangements.  
• Oversee the management and escalation of personal data breaches, ensuring technical risk evaluation, root-cause investigation, statutory documentation, and timely regulatory notifications 

Data Governance & Records

• Maintain oversight of the Bank’s Records of Processing Activities (ROPA).
• Support data inventory and data-flow mapping across critical business processes.
• Monitor data retention and disposal requirements.
• Coordinate periodic review of data classification and handling requirements.
• Support implementation of appropriate controls over sensitive and confidential information.

Regulatory Compliance & Assurance

• Monitor compliance against the Data Protection Act, Regulations and applicable ODPC guidance.
• Coordinate responses to ODPC information requests, inspections, complaints and regulatory reviews.
• Support regulatory examinations and remediation programs.
• Conduct periodic thematic reviews of data protection controls.
• Maintain regulatory evidence and compliance attestations.

Awareness & Capacity Building

• Develop and coordinate annual data protection awareness programmes.
• Deliver targeted training for high-privacy risk functions including:
  • Digital Banking
  • Credit
  • Operations
  • Marketing
  • HR
  • IT
  • Procurement
  • Customer Service
  • Fraud
  • AML/KYC
• Promote a privacy-conscious culture across the Bank.
• Maintain training completion and certification records.

Regulatory Liaison & External Representation

• Serve as the primary point of contact for Data Protection Authorities (ODPC), managing regulatory inquiries, statutory registration renewals, compliance audits, inspections, and mandatory notifications.
• Serve as the primary escalation point for data subjects, overseeing the handling of Data Subject Access Requests (DSARs) and ensuring they are resolved accurately within statutory timelines.

Reporting & Governance

• Prepare periodic reports covering for example:
  • Data protection compliance status
  • Open privacy risks
  • DPIAs completed/outstanding
  • Data subject requests
  • Data breaches/incidents
  • Third-party privacy risks
  • Regulatory matters
  • Policy exceptions
  • RCSA/control testing results
  • Remediation status
  • Key privacy KRIs

KNOWLEDGE, SKILLS & EXPERIENCE

• Bachelor’s degree in Law, Information Technology, Data Science, Risk Management, Compliance, Business, Finance or related discipline. 
• Professional qualification in data protection/privacy, risk, compliance, audit, information security or related field.
• 5–8 years’ experience, preferably within banking, financial services, fintech or another highly regulated environment. 
• Practical knowledge of the Kenyan Data Protection Act and Regulations.

Professional Certificates

• CIPM / CIPP / CDPO / equivalent privacy qualification (e.g. Certified Data Privacy Solutions Engineer (CDPSE), Certified Information Privacy Profession(CIPP)
• CAMS, CISA, CISM, ISO 27001, ISO 31000 or related qualification. 

Desirable

• Experience with ODPC regulatory engagements. 
• Experience in data governance, privacy risk assessments, DPIAs and third-party risk. 
• Active membership or affiliation with professional privacy and security organizations (e.g., IAPP, ISACA, ISC2).

Technical / Functional Skillset

• Data protection & privacy regulatory knowledge – DPA, ODPC Regulations & Guidelines 
• Privacy risk management, DPIAs and Privacy-by-Design 
• Data governance, ROPA, data mapping and retention 
• Data breach/incident management and regulatory reporting 
• Third-party/data processor risk management 
• RCSA, control testing, KRIs and compliance monitoring 
• Policy development, regulatory interpretation and assurance 
• Strong understanding of banking, digital, technology and customer-data environments 
• Data protection awareness and training

Behavioral Competencies

• Behavioral Competencies
• High integrity, confidentiality and ethical judgment 
• Strong attention to detail 
• Analytical and risk-based thinking 
• Independent challenge and professional skepticism 
• Strong stakeholder engagement and influencing skills 
• Clear written and verbal communication 
• Ability to manage sensitive/confidential matters 
• Proactive and solution-oriented 
• Organized, disciplined and delivery-focused 
• Ability to translate regulatory requirements into practical business controls