Data Protection Officer

Sidian Bank Limited is a Kenyan financial institution founded in 1984, operating in the banking and financial services sector. It is located in Nairobi, Kenya, and focuses on providing banking and financial services.

This role supports Sidian Bank's Data Protection Office in developing, implementing, monitoring, and continuously improving the bank's data protection and privacy framework. The officer ensures adherence to the Data Protection Act, 2019, applicable regulations, ODPC guidance, and CBK requirements, while integrating privacy-by-design and responsible data management throughout the bank. The position involves providing second-line oversight and assurance for privacy risks arising from the processing of customer, employee, supplier, digital, technology, and third-party data.

1. Act as the appointed Data Protection Officer in accordance with the Kenya Data Protection Act 2019 and ODPC Guidance Notes, maintaining independence.
2. Support the implementation and continuous enhancement of the Bank’s Data Protection and Privacy Framework, including governance structure, policies, standards, procedures, and guidelines.
3. Maintain a regulatory obligations register covering the Data Protection Act, Regulations, ODPC guidance, and applicable banking requirements.
4. Coordinate periodic reviews of data protection policies and procedures.
5. Provide data protection input for Board, Board Risk Committee, and Management reporting, maintaining evidence of compliance.
6. Design and maintain data protection policies, governance frameworks, operational controls, reporting mechanisms, and annual compliance plans.
7. Collaborate with Legal, Compliance, Risk, IT Security, ICT, Product Development, and Internal Audit functions while ensuring DPO independence.
8. Serve as the operational secretariat and primary execution officer, working with Data Protection Committee risk champions.
9. Maintain the Bank’s Data Protection Risk Register and monitor emerging privacy risks.
10. Coordinate data protection risk assessments across business units and integrate privacy risks into the Bank’s RCSA, operational risk, technology risk, third-party risk, and enterprise risk frameworks.
11. Define and monitor data protection Key Risk Indicators (KRIs) and thresholds.
12. Escalate material privacy risks, breaches, and control weaknesses to the DPO and relevant governance committees, tracking remediation actions.
13. Coordinate and review Data Protection Impact Assessments (DPIAs) for high-risk processing activities.
14. Provide privacy input into new products, digital channels, systems, AI/analytics initiatives, outsourcing, and major projects.
15. Embed Privacy by Design and Default within product and technology development processes.
16. Review proposed changes to processing purposes, data fields, retention periods, and data-sharing arrangements.
17. Establish and monitor processes for handling data subject requests, overseeing requests related to access, rectification, objection, restriction, and erasure.
18. Monitor response timelines and maintain appropriate records, coordinating with relevant business units.
19. Provide expert privacy guidance on AI systems, predictive analytics, automated decision-making, biometric data, cloud migrations, and other emerging banking technologies.
20. Embed Privacy by Design and Privacy by Default throughout product development life cycles, system implementation, and third-party API integrations.
21. Review and advise on records of processing activities (RoPA), data retention schedules, privacy notices, consent management, and legal bases for processing.
22. Support the Bank’s personal data breach management and notification framework.
23. Coordinate investigation and assessment of privacy incidents with Information Security, Cybersecurity, Legal, Compliance, and business units.
24. Assess regulatory notification requirements and escalation thresholds, maintaining a central register of incidents and lessons learned.
25. Ensure corrective actions from privacy incidents are tracked to closure.
26. Review data protection aspects of third-party arrangements, outsourcing, cloud services, and technology partnerships.
27. Support due diligence and ongoing monitoring of data processors, reviewing data processing agreements and privacy clauses.
28. Monitor cross-border transfers and related safeguards, overseeing processor compliance.
29. Direct data protection incident response protocols, overseeing breach triage, root-cause assessments, containment strategies, and statutory notifications.
30. Provide independent oversight and challenge regarding third-party privacy risk assessments and joint data controller/processor arrangements.
31. Oversee the management and escalation of personal data breaches, ensuring technical risk evaluation, investigation, documentation, and timely regulatory notifications.
32. Maintain oversight of the Bank’s Records of Processing Activities (ROPA).
33. Support data inventory and data-flow mapping across critical business processes.
34. Monitor data retention and disposal requirements, coordinating periodic review of data classification.
35. Support implementation of appropriate controls over sensitive and confidential information.
36. Monitor compliance against the Data Protection Act, Regulations, and ODPC guidance.
37. Coordinate responses to ODPC information requests, inspections, complaints, and regulatory reviews.
38. Support regulatory examinations and remediation programs, conducting periodic thematic reviews of data protection controls.
39. Maintain regulatory evidence and compliance attestations.
40. Develop and coordinate annual data protection awareness programmes, delivering targeted training for high-privacy risk functions.
41. Promote a privacy-conscious culture across the Bank, maintaining training records.
42. Serve as the primary point of contact for Data Protection Authorities (ODPC), managing inquiries, registration renewals, audits, and notifications.
43. Serve as the primary escalation point for data subjects, overseeing Data Subject Access Requests (DSARs).
44. Prepare periodic reports covering data protection compliance status, open privacy risks, DPIAs, data subject requests, data breaches, third-party privacy risks, regulatory matters, policy exceptions, RCSA/control testing results, remediation status, and key privacy KRIs.

1. Bachelor’s degree in Law, Information Technology, Data Science, Risk Management, Compliance, Business, Finance, or a related discipline.
2. Professional qualification in data protection/privacy, risk, compliance, audit, or information security.
3. 5–8 years of experience, preferably within banking, financial services, fintech, or another highly regulated environment.
4. Practical knowledge of the Kenyan Data Protection Act and Regulations.
5. Professional certifications such as CIPM, CIPP, CDPO, CDPSE, CAMS, CISA, CISM, ISO 27001, or ISO
6. Desirable experience with ODPC regulatory engagements.
7. Desirable experience in data governance, privacy risk assessments, DPIAs, and third-party risk.
8. Active membership or affiliation with professional privacy and security organizations (e.g., IAPP, ISACA, ISC2).
9. Strong technical/functional skillset in data protection & privacy regulatory knowledge (DPA, ODPC Regulations & Guidelines).
10. Expertise in privacy risk management, DPIAs, and Privacy-by-Design.
11. Proficiency in data governance, ROPA, data mapping, and retention.
12. Experience with data breach/incident management and regulatory reporting.
13. Knowledge of third-party/data processor risk management.
14. Familiarity with RCSA, control testing, KRIs, and compliance monitoring.
15. Skills in policy development, regulatory interpretation, and assurance.
16. Strong understanding of banking, digital, technology, and customer-data environments.
17. Ability to conduct data protection awareness and training.
18. High integrity, confidentiality, and ethical judgment.
19. Strong attention to detail, analytical, and risk-based thinking.
20. Independent challenge and professional skepticism.
21. Strong stakeholder engagement and influencing skills.
22. Clear written and verbal communication.
23. Ability to manage sensitive/confidential matters.
24. Proactive, solution-oriented, organized, disciplined, and delivery-focused.
25. Ability to translate regulatory requirements into practical business controls.