M-Pesa Africa - Senior Officer Data Protection at Safaricom Kenya

About the Role

The Senior Officer, Data Protection will take ownership of driving M-PESA Africa’s data protection and privacy initiatives. This role is responsible for leading the execution of the Compliance Programmes with a specific focus on embedding privacy by design within the Safe Agile product implementation. The Senior Officer will coordinate compliance monitoring activities, ensuring robust data protection practices are in place and aligned with regulatory requirements. With a high level of accountability, and working closely with the Manager, Risk & Compliance, you will proactively identify and mitigate privacy risks using a risk-based approach, ensuring the organization maintains the highest standards of data protection and privacy throughout its operations.

Responsibilities

• Review and offer advice on data governance, processing activities and/or data breaches for M-pesa Africa;
• Monitor compliance with applicable national and international laws and regulations pertaining to data protection and privacy across the markets we operate in;
• Provide advice on the implementation of appropriate policies and guidelines to establish and maintain data protection compliance;
• Contribute towards establishing a strong culture of data protection across stakeholders through carrying out appropriate training and awareness;
• Identify, evaluate and maintain records of M-PESA Africa’s data processing activities;
• Provide advice and conduct Data Protection Impact Assessments (DPIAs), and Risk and Compliance reviews as required;
• Monitor data management procedures and ensure privacy compliance within M-PESA Africa;
• Share advice and guidelines for implementing privacy by design and privacy by default in all products and systems;
• Ensure that compliance and privacy by design is embedded within the SAFE Agile product implementation framework;
• Implementation of the data protection and Compliance Policies and Procedures across the organization;
• Coordinate data protection and compliance awareness trainings across the organization, and participate in those organized by the group privacy team;
• Carry out monitoring and assurance activities on data protection and compliance programs on a regular basis;
• Report on the state of M-PESA Africa privacy program & compliance with the control management and other policies and regulations governing the organization on a quarterly basis;
• Support to Co-ordinate the data protection and Compliance Champions to ensure a controls and compliance culture is inculcated throughout the organization;
• Driving behavioral change by inculcating a culture of compliance within the organization through engaging and influencing stakeholders.

Qualifications

• A Bachelor’s degree or its equivalent in Law, Business, Engineering, IT, or a related field is required.
• Professional certification in privacy, risk management, or information systems is highly preferred (e.g., CIPP/E, CIPM, CRISC, or ISO 27701).
• A minimum of 4 years of experience in data protection, privacy, risk management, or a related field, with a strong understanding of the relevant regulatory landscape.
• Proven expertise in auditing, compliance, or data protection, with a demonstrated ability to manage complex data privacy projects and initiatives.
• Strong working knowledge and experience with data protection regulations across various markets, including but not limited to GDPR, POPIA, and other regional data protection laws.
• Experience in providing expert advice on data protection matters and conducting Data Protection Impact Assessments (DPIAs) to ensure privacy risks are mitigated effectively.
• Ability to conduct comprehensive Risk and Compliance reviews as needed, identifying potential areas for improvement and ensuring regulatory compliance.
• A results-oriented approach, with the ability to work independently and take ownership of key tasks and projects.
• In-depth understanding of fintech and the specific data privacy challenges faced within the sector.
• Excellent oral and written communication skills, with the ability to effectively articulate complex privacy and data protection concepts.
• A collaborative team player who thrives in a dynamic environment and works effectively with others to resolve issues and ensure compliance.