Data Protection Officer (DPO)

To provide independent oversight, guidance and assurance on the Bank’s compliance with data protection and privacy requirements, while leading the development and continuous improvement of the Bank’s data protection framework. The role ensures lawful, transparent and secure management of personal data, promotes a strong culture of privacy and accountability, and supports the Bank’s strategic, digital transformation and regulatory objectives.

Responsibilities and Accountability;

Data Protection Governance and Framework

Establish, implement, maintain and continuously improve the Bank’s Data Protection and Privacy Framework, policies, standards, procedures and guidelines.

Provide oversight of the Bank’s implementation of data protection and privacy requirements across business and support functions.

Establish appropriate governance structures, accountability mechanisms and reporting arrangements to support effective data protection compliance within the Bank.

Monitor regulatory developments and advise the Bank on changes required to maintain compliance with applicable data protection laws and regulations.

Data Inventory and Mapping

Oversee the maintenance of an accurate inventory of the Bank’s personal data processing activities.

Coordinate periodic data inventory and mapping exercises across business and support functions.

Ensure appropriate records are maintained on personal data categories, data subjects, processing purposes, systems, recipients, retention periods and safeguards.

Data Protection Impact Assessments (DPIAs)

Establish and maintain the Bank’s DPIA process and methodology.

Advise business and project teams on processing activities requiring DPIAs.

Review and provide independent oversight of DPIAs for new products, projects, systems, processes and other high-risk processing activities.

Monitor implementation of agreed privacy risk mitigation measures and escalate material residual risks where appropriate.

Contracts, Data Sharing and Third-Party Processing

Review and provide data protection Advise on contracts, outsourcing arrangements, data-sharing agreements and third-party processing arrangements involving personal data.

Advise on appropriate data protection clauses, processor obligations, confidentiality requirements and security safeguards.

Provide guidance on third-party due diligence and monitor compliance with applicable data protection requirements in material processing and data-sharing arrangements.

Cross-Border Data Transfers

Provide guidance and oversight on the transfer of personal data outside Kenya.

Assess the data protection implications of cross-border processing and transfers involving Group, technology providers, cloud service providers and other third parties.

Advise on appropriate safeguards and regulatory requirements applicable to cross-border data transfers.

Maintain appropriate records of material cross-border data transfer arrangements.

Privacy by Design and Privacy by Default

Promote the integration of Privacy by Design and Privacy by Default principles into the Bank’s products, services, systems, processes and projects.

Provide privacy Advise during the design, development, procurement, implementation and significant modification of initiatives involving personal data.

Identify and advise on privacy risks arising from digital transformation, emerging technologies, analytics, automation and other data-driven initiatives.

Privacy Notices, Transparency and Lawful Processing

Review and advise on privacy notices, consent forms and customer/employee communications to ensure transparency and compliance with applicable data protection requirements.

Monitor compliance with lawful processing, consent, data minimization, purpose limitation, data accuracy and retention requirements.

Advise business and support functions on appropriate legal bases and transparency requirements throughout the personal data lifecycle.

Data Subject Rights Management

Coordinate and monitor responses to data subject requests, including requests for access, correction, objection, restriction, deletion/erasure, portability and other applicable rights.

Ensure requests are handled accurately and within applicable statutory and internal timelines.

Maintain the data subject rights register and monitor recurring issues and trends for appropriate remediation.

Monitoring and Assurance

Conduct periodic reviews and assessments to evaluate the effectiveness of the Bank’s data protection framework, policies, procedures and controls.

Identify and assess data protection control gaps, compliance exceptions and areas of heightened privacy risk.

Track remediation actions arising from monitoring reviews, DPIAs, incidents, audits and regulatory assessments, and follow up on timely closure.

Provide independent assurance and recommendations to management on the effectiveness of data protection controls and the Bank’s overall privacy compliance position.

Prepare periodic monitoring and assurance reports for Senior Management and relevant governance committees.

Training and Awareness

Develop and implement an annual data protection training and awareness Programme aligned to the Bank’s risk profile and regulatory requirements.

Develop targeted training for employees and functions involved in high-risk or sensitive personal data processing.

Promote awareness of employees’ responsibilities relating to the collection, use, storage, sharing, retention and disposal of personal data.

Monitor training completion and assess the effectiveness of data protection awareness initiatives.

Promote a strong culture of privacy, accountability and responsible handling of personal data across the Bank.

Incident Management

Establish and maintain the Bank’s personal data breach and privacy incident management framework.

Coordinate the investigation, assessment, documentation and monitoring of personal data breaches and privacy incidents.

Advise relevant stakeholders on regulatory notification and data subject communication requirements arising from qualifying breaches.

Coordinate, where applicable, regulatory notifications to the ODPC and communications to affected data subjects within prescribed timelines.

Maintain the personal data breach and privacy incident register and monitor corrective and preventive actions.

Identify systemic privacy weaknesses and recommend measures to prevent recurrence.

Regulatory and ODPC Engagement

Serve as the Bank’s primary contact and liaison with the Office of the Data Protection Commissioner (ODPC) and other relevant regulatory authorities on data protection matters.

Coordinate regulatory correspondence, information requests, consultations, inspections and other engagements relating to data protection.

advise management on regulatory findings, directives and required remediation actions.

Monitor the Bank’s fulfilment of data protection-related regulatory obligations and commitments.

Minimum Requirements;

Education

Bachelor’s degree in information technology, Risk Management, Business Administration, Law, or a related discipline.

Professional qualification

A recognized professional qualification or certification in Data Protection/Privacy, Information Security, Risk or Compliance.

Experience

Minimum 2 years’ professional experience in data protection, privacy, compliance, risk, information security or a related discipline in banking, financial services or another regulated industry.