DPO Associate

PURPOSE OF THE ROLE

The DPO Associate supports the Data Protection Officer (DPO) in implementing and operating the firm's privacy and data protection program. The role is responsible for privacy compliance, data protection governance, contract reviews, Data Principal Rights Request management, Records of Processing Activities (RoPA), vendor privacy oversight, and engagement-specific privacy and security compliance activities.

The position works closely with Legal, Procurement, HR, Business Units, Risk Management, and the Information & Cyber Security Office (ICSO) to ensure compliance with applicable privacy regulations, contractual obligations, and organizational security requirements.

KEY RESPONSIBILITIES

1. 1. Privacy & Data Protection Compliance

1. Support the implementation and operation of the firms privacy and data protection program.
2. Assist in ensuring compliance with DPDP Act, GDPR, PDPL, KSA PDPL, and other applicable privacy regulations.
3. Support privacy impact assessments, privacy reviews, and privacy risk assessments.
4. Maintain privacy policies, procedures, and supporting documentation.

2. Contract & Privacy Review

1. Review privacy, confidentiality, information security, and data protection clauses in client contracts, NDAs, MSAs, SOWs, vendor agreements, and third-party contracts.
2. Identify privacy and information security obligations applicable to engagements and vendors.
3. Coordinate with Legal, Procurement, Business Teams, and ICSO to address contractual privacy and security requirements.
4. Support execution and management of Data Processing Agreements (DPAs), NDAs, and privacy-related contractual commitments.
5. Maintain records of contractual privacy and security obligations.

3. Engagement Security & Compliance Coordination

1. Coordinate with ICSO teams to ensure implementation of client-mandated security, privacy, and compliance requirements.
2. Track engagement-specific information security and privacy obligations.
3. Monitor compliance with contractual and regulatory requirements throughout the engagement lifecycle.
4. Support business teams in understanding and implementing client security requirements.
5. Escalate identified compliance gaps, risks, and issues to the DPO and ICSO leadership.

4. Data Principal Rights Management

1. Coordinate and manage Data Principal Rights Requests, including access, correction, deletion, consent withdrawal, and grievance requests.
2. Maintain request records and supporting documentation.
3. Track request closure within regulatory timelines.
4. Support investigations relating to privacy complaints and inquiries.

5. Privacy Operations & Vendor Oversight

1. Support Business team to maintain Records of Processing Activities (RoPA).
2. Support privacy assessments of third-party vendors and service providers.
3. Maintain inventory of privacy agreements, vendor obligations, and compliance documentation.
4. Track remediation of privacy-related findings and obligations.
5. Support privacy awareness and training initiatives across the organization.

6. Reporting & Governance

1. Prepare privacy compliance reports, dashboards, and management updates.
2. Maintain privacy evidence and documentation required for audits and regulatory reviews.
3. Support internal and external audits relating to privacy and data protection.
4. Assist the DPO in managing privacy governance activities and compliance reporting.

QUALIFICATIONS & EXPERIENCE

• Bachelor’s degree in Cyber law, Information Security, Information Technology, Compliance, Governance, Risk Management, or related discipline.
• 4-7 years of experience in Privacy, Data Protection, Compliance, Legal Operations, Information Security Governance, Risk Management, or related functions.
• Understanding of DPDP Act, GDPR, and privacy governance principles.
• Experience reviewing contractual privacy, confidentiality, and information security clauses.
• Exposure to third-party risk management, privacy operations, or compliance programs.
• Strong documentation, analytical, and stakeholder management skills.
• Ability to work effectively with Legal, Procurement, Business Units, and Information Security teams.