Data Privacy Expert - 4-5-Month Engagement

Job description

Years of Experience: 3–5+ years of relevant experience. Project Duration: 4-5 months. Working Arrangement: on-site. Language Requirements: Fluency in Arabic & English (written and spoken). The Data Privacy Expert contributes to developing, implementing, and overseeing the organization's personal data protection program to ensure compliance with Saudi PDPL and its Implementing Regulations, while aligning with SDAIA and NDMO controls and international best practices. Under the direction of the Data Management Senior Director/Data Privacy Officer, the role protects personal and sensitive information, integrates privacy-by-design into data processing activities, and strengthens data protection awareness across the organization. Compliance, Assessment & Audit: • Perform regular privacy compliance assessments and internal audits against the PDPL, its Implementing Regulations, NDMO/SDAIA standards, and internal policies, recording findings and monitoring corrective actions. • Review data processing activities to identify non-compliance or data handling risks and escalate significant issues to the Data Privacy Officer. • Assist with investigations into potential personal data protection violations and maintain the register of compliance records relating to personal data protection. Risk, DPIA & RoPA: • Conduct regular privacy risk assessments to identify, evaluate, and mitigate potential privacy risks, maintaining the privacy risk register with clearly assigned owners and mitigation plans. • Undertake and document Data Protection Impact Assessments (DPIAs) for new or modified processing activities, ensuring findings are recorded and incorporated into the organization’s risk management and data protection strategies. • Keep the Record of Processing Activities (RoPA), personal data inventories, and data flow maps up to date as processing activities evolve, including data monetization initiatives. Privacy Operations (Notices, Consent & Data Subject Rights): • Assist in developing and maintaining privacy notices, transparency statements, and consent mechanisms that reflect actual processing purposes and legal bases, ensuring changes are communicated to data subjects. • Support the implementation of processes for handling Data Subject Rights (DSR) requests —including access, correction, deletion, portability, and objection—within regulatory timelines. • Assist with data breach detection, recording, and timely notification in accordance with the established breach management process and PDPL notification requirements, documenting evidence and lessons learned. Third-Party & Cross-Border Processing: • Support privacy reviews of third-party/vendor engagements and Data Processing Agreements (DPAs), including sub-processor and cross-border transfer controls aligned with PDPL statutory requirements. • Participate in privacy risk assessments of prospective suppliers and assist with ongoing monitoring of processor and vendor compliance. Awareness, Advisory & Regulatory Alignment: • Provide guidance and training to relevant employees on their personal data protection responsibilities and support Privacy Champions across business units. • Stay informed of developments in PDPL, NDMO, and SDAIA requirements to keep policies, procedures, and standards current, while assisting the Data Privacy Officer with SDAIA/NDMO coordination. • Integrate privacy-by-design and data minimization principles into projects and system changes from the initial stages.

Requirements

• 3–5+ years of relevant experience in data protection or data privacy.
• Solid knowledge of fundamental data privacy principles, including data minimization, purpose limitation, lawful basis, and accountability.
• Proven experience implementing and maintaining data protection policies, procedures, and standards, including conducting DPIAs and embedding privacy-by-design.
• Comprehensive understanding of PDPL, NDMO, and SDAIA standards.
• Experience performing privacy risk assessments, DPIAs, and audits.
• Familiarity with data classification and controls for protecting personal data.
• Familiarity with data privacy management tools.
• Privacy certifications such as CIPM, CIPP/E, or equivalent
• CDMP/DAMA.
• Other Qualifications
• Bachelor’s degree in Law, Business, Computer Science, Information Management, Cybersecurity, or a related field.
• Strong analytical reasoning and problem-solving abilities.
• Excellent communication and consulting skills.
• Effective collaboration across functions and engagement with stakeholders.
• Project management skills, attention to detail, and thorough documentation.

Skills