Data Protection Officer (DPO)

Job description

Lead and oversee PayLink's data privacy and protection framework in line with Saudi PDPL, its Implementing Regulations, and SAMA requirements. Monitor regulatory developments to ensure ongoing compliance. Serve as primary contact for regulatory authorities. Advise senior management on privacy risks, obligations, and improvements. Develop policies, procedures, and data retention schedules. Conduct privacy impact assessments for new products, systems, and processes. Identify, assess, and mitigate privacy risks related to data processing, third‑party vendors, and cross‑border transfers. Embed Privacy by Design and Default principles. Establish processes for handling Data Subject Access Requests and other rights under PDPL in coordination with security, legal, and IT teams. Monitor compliance and maintain documentation and audit evidence. Develop and deliver employee privacy awareness and training programs. Collaborate with legal, compliance, cybersecurity, IT, product, and business teams to ensure effective privacy controls.

Requirements

• Bachelor's degree in Law, Information Security, Cybersecurity, Compliance, Information Technology or related field
• professional privacy certifications such as CIPP/E, CIPM, CIPP/A preferred
• hands‑on experience in Data Protection, Data Privacy, Privacy Compliance or Regulatory Compliance
• strong knowledge of Saudi PDPL and its Implementing Regulations
• understanding of SAMA regulatory requirements and their application to financial institutions, payment service providers, or FinTech companies
• proven experience developing and implementing privacy policies, data protection frameworks, and compliance procedures
• practical experience conducting Privacy Impact Assessments (PIAs/DPIAs), privacy risk assessments, and maintaining Records of Processing Activities (RoPA)
• experience managing Data Subject Rights Requests (DSARs), personal data breaches, and privacy incident response
• ability to collaborate with cross‑functional teams and communicate regulatory requirements to technical and non‑technical stakeholders
• strong analytical, documentation, communication, and stakeholder management skills
• professional proficiency in English
• Arabic proficiency highly preferred

Skills