Data Protection Officer

Role Overview

This role provides independent, second-line oversight of how the Bank collects, uses, stores, shares and protects personal data. As the Bank’s appointed Data Protection Officer, the role holder will maintain the privacy governance framework, advise teams on new and existing processing activities, and help ensure compliance with Kenya’s Data Protection Act, related regulations, ODPC guidance and relevant CBK requirements.

The role works across customer, employee, supplier, digital and technology environments, partnering with business and control functions while preserving the DPO’s independence. Its work helps the Bank identify privacy risks early, respond effectively to data incidents and demonstrate responsible handling of personal information.

Key Responsibilities

• Serve independently as the Bank’s appointed DPO in line with the Kenya Data Protection Act and applicable ODPC guidance; maintain privacy policies, procedures, standards, governance arrangements and regulatory obligations records.
• Maintain the privacy risk register, coordinate assessments across business units, define and monitor key risk indicators, integrate privacy into operational and technology risk processes, and follow remediation actions through to closure.
• Coordinate and review DPIAs for high-risk processing, and advise on products, digital services, systems, analytics, AI, outsourcing and other significant changes to data use.
• Help embed privacy by design and default in product and technology lifecycles; review processing purposes, data fields, legal bases, retention periods, data-sharing proposals and records of processing activities.
• Oversee processes for data subject rights requests, including access, correction, objection, restriction and erasure; coordinate responses across relevant teams and monitor statutory timelines and records.
• Coordinate privacy incident response with Information Security, Cybersecurity, Legal, Compliance and business teams, including triage, investigation, notification assessments, incident records and corrective actions.
• Assess privacy risks in supplier, outsourcing, cloud and technology arrangements; contribute to processor due diligence and contractual reviews, and monitor cross-border transfers and agreed safeguards.
• Monitor regulatory compliance, coordinate ODPC inquiries, inspections and reviews, maintain evidence of compliance, and prepare governance reporting on risks, DPIAs, requests, incidents, vendors, controls and remediation.
• Coordinate privacy training and awareness, with focused support for higher-risk functions such as digital banking, credit, operations, marketing, HR, IT, procurement, customer service, fraud and AML/KYC.

Requirements & Qualifications

• Bachelor’s degree in Law, Information Technology, Data Science, Risk Management, Compliance, Business, Finance or a related discipline.
• Five to eight years of relevant experience, preferably in banking, financial services, fintech or another regulated environment.
• Practical knowledge of Kenya’s Data Protection Act and Regulations, ODPC guidance, privacy obligations and the application of data protection principles in a business setting.
• Relevant professional qualification in privacy, data protection, risk, compliance, audit or information security. Privacy credentials such as CIPM, CIPP, CDPO or CDPSE are relevant; CAMS, CISA, CISM, ISO 27001 or ISO 31000 qualifications are also applicable.
• Experience with privacy risk assessments, DPIAs, data governance, records of processing, data mapping, retention, incident management, third-party risk and compliance monitoring.
• Ability to interpret regulatory requirements and turn them into practical policies, controls, testing plans, reporting and staff guidance; familiarity with RCSA, control testing and risk indicators is an advantage.
• Strong understanding of customer-data, digital, technology and banking processes, with the judgment to provide constructive challenge while working effectively with Legal, Compliance, Risk, IT, Security, Product and operational teams.
• High integrity and discretion, sound analytical judgment, attention to detail, clear communication, strong stakeholder skills and the ability to manage sensitive matters independently. Experience with ODPC engagement and membership of a privacy or security professional body are advantageous.