Data Protection Officer at SBM Bank

Job Purpose

To establish and maintain the Bank’s Data governance framework and ensure the personal data of Bank staff, customers, service providers or any other individuals (also referred to as data subjects) is handled in compliance with Data Protection Act, 2019 and any other applicable data protection rules.

KEY RESPONSIBILITIES

 LEADERSHIP AND STAKEHOLDER MANAGEMENT (30%)

• To seek, develop and maintain relationships with the Office of the Data Protection Commissioner, relevant Regulators, and other key stakeholders.
• To assist and guide staff & Management in responding to enquiries or requests from Regulators (ODPC), data subjects and other stakeholders as appropriate.
• To organize and participate in the training and awareness programs for Staff on the relevant Data Protection & Privacy requirements and obligations.
• To promote a culture of Data Protection & Privacy by design and by default in the Bank.

OVERSIGHT COMPLIANCE WITH ALL DATA PROTECTION & PRIVACY AND RELATED REQUIREMENTS (50%)

• To develop, review and maintain data protection policies and procedures.
• Act as the primary point of contact within the Bank for members of staff, regulators, and any relevant public bodies on issues related to data protection.
• Act as the public-facing function representing the interests of Data Subjects as well as supervise and advise the Bank on the response to such request.
• To develop and maintain a mapping of Data processing points in all Bank’s operating areas.
• To ensure Data Protection & Privacy policy availability by publishing on the Intranet for employees and independent contractors to access and providing it to all contracted third parties (processors) who process personal information on the Bank’s behalf or in terms of a contractual agreement with SBM Bank (Kenya) Limited.
• To manage third party data protection risks.
• To monitor and ensure compliance with the Data Protection laws and policies of the Bank as outlined by the regulator.
• Overseeing the maintenance of records required to demonstrate data protection compliance.
• To research and keep abreast of any changes to relevant laws and regulations and prepare regular updates to management and the Board.

REPORTING (20%)

• To prepare regular update reports on the Data Protection compliance program to Chief Risk Officer and Management Committee and/or those of relevant stakeholders.
• Support Chief Risk Officer in preparation of Board Update reports on Data Protection & Privacy compliance program.
• Supporting data incident response and data breach notification procedures.
• providing updates on matters related to compliance with statutory and regulatory requirements. 5. To facilitate the provision of ad-hoc reports and or information to the regulators as and when required.

KEY RELATIONSHIPS

Direct Reports to this Position

• Data Protection & Privacy Compliance Champions - Indirect reports

Key Internal Stakeholders

• Board Risk Committee (BRC)
• Executive Management Committee (EXCO)
• Operational Risk Committee (ORCO)
• Chief Risk Officer
• Project Management Office
• ICT
• Legal
• HR
• Branch Managers
• Heads of Department

Knowledge: Skills and Experience required for this Role

• Minimum three (3) years’ experience within ICT, legal, audit and/or risk function.
• Sound working knowledge of the Data Protection Act, 2019 and other relevant and applicable laws, regulations.
• Minimum of a Bachelors’ Degree.
• Experience in developing policies and compliance training.
• Experience working in a financial and/or regulated industry, handling privacy company data.
• Experience in reviewing financial institutions’ contracts with third parties.
• Good understanding of data processing operations, including information systems, data security and data protection needs of an institution.
• Experience in managing data incidents and breaches.
• Professional Data Protection and/or Privacy certification will be an added advantage.

Competencies required for this Role

• Ability to work unsupervised, exercise leadership, and influence change.
• Excellent writing and presentation skills.
• Strong change and project management skills, including the ability to manage time well, prioritize effectively, and handle multiple deadlines.
• Demonstrated ability to undertake large, long-term projects, develop alternative methods to complete them, and implement solutions.
• Ability to use independent judgment and discretion when making majority of decisions.
• Detail-oriented approach needed to recommend and implement strategic improvements on a range of data privacy and data protection issues.
• Ability to handle confidential and sensitive information with the appropriate discretion and ethics.
• Leadership-Ability to lead a team and engage with Management.
• Ability to prepare and facilitate training as a Subject Matters Expert (SME)
• Planning and Organizing.
• Learning and Researching
• Critical thinker with good analytical capabilities