Executive Head of Privacy

Safaricom PLC is a leading telecommunications company founded in 1997 and based in Nairobi, Kenya, operating in the IT & Telecoms industry.

Reporting to the Group Chief Risk Officer, the Executive Head of Privacy is tasked with shaping, governing, and advancing Safaricom’s comprehensive strategy for privacy, data protection, and responsible data use across the entire organization. This position involves providing strategic leadership to proactively identify and mitigate privacy risks, ensure lawful and ethical data handling practices, protect customer information, and embed trust by design throughout Safaricom’s integrated Telco–FinTech ecosystem, which includes M-PESA, various digital services, platforms, applications, networks, customer analytics, APIs, and partner ecosystems.

The role spearheads Safaricom’s customer privacy and data protection agenda, covering areas such as data governance, data minimization, privacy by design, consent management, enablement of customer rights, data lifecycle management, cross-border data transfers, breach management, regulatory engagement, data ethics, and privacy assurance reviews. It ensures the deployment of a unified Privacy Management System that is anchored in global standards and frameworks, including the Kenya Data Protection Act (DPA 2019), GDPR-equivalent practices, ISO/IEC 27701, OECD Privacy Guidelines, and GSMA Mobile Privacy Principles.

The Executive Head of Privacy collaborates extensively with key internal departments such as M-PESA/Financial Services, Technology, Digital, Enterprise, Consumer, Data Engineering, Networks, Legal, Risk, Compliance, Procurement, Supply Chain, Corporate Affairs, HR, and Internal Audit. The role also engages with external regulators like the Office of the Data Protection Commissioner (ODPC), Central Bank of Kenya (CBK), and Communications Authority of Kenya (CAK) to embed privacy resilience, strengthen data handling controls by design, and ensure robust privacy assurance within Safaricom’s rapidly evolving digital environment.

This position champions customer trust, ethical data stewardship, transparency, and responsible innovation, fostering a culture where engineers, product teams, analysts, data scientists, marketers, and ecosystem partners design and operate privacy-compliant products, respect customer choices, and proactively identify and mitigate privacy risks. Through advanced privacy risk analytics, data flow mapping, consent and preference governance, third-party privacy due diligence, privacy impact assessments (PIAs/DPIAs), and continuous assurance, the Executive Head of Privacy ensures Safaricom operates as one of Africa’s most trusted, privacy-conscious, and ethically grounded digital enterprises.

1. Define and maintain the enterprise privacy strategy, policy suite, standards, and baselines, aligned to Kenya’s DPA 2019 and global privacy principles.
2. Operate a privacy governance model with clear DPO/DPIA ownership and Board/ExCo reporting.
3. Implement and continuously improve a Privacy Information Management System (PIMS) under ISO/IEC 27701:
4. Drive privacy risk assessments, data flow visibility, incident detection, breach response, and regulatory notifications to mitigate privacy and data misuse risks.
5. Embed privacy by design into technology, product development, analytics, AI/ML models, and customer interfaces through PIAs/DPIAs and ethical design frameworks.
6. Define and enforce enterprise-wide AI governance frameworks to ensure safe, ethical, and compliant AI use across Safaricom’s digital and data ecosystem.
7. Strengthen customer consent governance, transparency mechanisms, data subject rights management (access, erasure, portability, objection), and data retention/deletion controls.
8. Ensure the protection of sensitive and financial data, including M-PESA processing data, applying strong privacy controls and confidentiality safeguards.
9. Strengthen privacy assurance for M-PESA services, merchant/agent ecosystems, API partners, cloud environments, and cross-border data flows.
10. Deliver privacy dashboards, KRIs, heatmaps, and Board/ELT reporting; ensure readiness for ODPC audits, CBK reviews, and Internal Audit assurance.
11. Build enterprise-wide privacy awareness, responsible data use behaviors, and capability uplift across squads and functions.
12. Lead engagement with regulators (ODPC, CBK) on data protection, privacy, and AI-related topics, and represent Safaricom in industry forums.
13. Provide Group-level oversight and strategic enablement to subsidiaries by defining minimum risk standards, frameworks, and reporting requirements.
14. Embed and maintain effective risk, governance, compliance, and control practices within the function, proactively identifying and mitigating operational, regulatory, financial, people, technology, and reputational risks.

1. Hold a Bachelor’s degree in Law, Information Technology, Data Science, Cybersecurity, Risk, Business, or a related field.
2. A postgraduate qualification (e.g., LLM, MSc Data Protection, MBA, Cybersecurity, Digital Governance, or Risk Management) is strongly preferred.
3. Possess at least one advanced privacy credential such as CIPP/E, CIPP/US, CIPP/A, CIPM, CIPT, CDPSE, ISO 27701 / ISO 27001 Lead Implementer or Lead Auditor, or CISM / CISSP.
4. Demonstrate deep expertise in the Kenya Data Protection Act (DPA 2019), ODPC regulatory framework, GDPR-equivalent global privacy standards, cross-border data transfer compliance, Privacy by Design & Default frameworks, data governance & lifecycle management, consent management & preference governance, data minimization & purpose limitation controls, Privacy Impact Assessments (PIAs/DPIAs), third-party privacy risk management, data subject rights (DSARs) operationalization, and breach management & regulatory notification processes.
5. Possess a strong understanding of AI & analytics governance (Responsible AI, data ethics), API ecosystems & embedded finance risks, cloud data architecture & digital platforms, customer analytics & marketing data risk, and Telco data, mobile money data, and digital identity risks.
6. Have 12–15+ years of experience in Privacy, Data Protection, Information Governance, or Digital Risk, with a minimum of 5+ years in a senior leadership role.
7. Possess experience within telecommunications, fintech, banking, digital platforms, or tech-driven environments.
8. Demonstrate proven experience engaging directly with regulators (ODPC exposure strongly preferred).
9. Have proven experience leading privacy transformation or enterprise privacy uplift programs and embedding privacy in product lifecycle environments.
10. Be a member in good standing of a recognized professional body.
11. Exhibit high ethical standards, integrity, confidentiality, and independence.
12. Possess exceptional influencing, communication, and relationship-building skills, capable of simplifying complex privacy, regulatory, and technical concepts.
13. Be a strong strategic systems thinker, able to connect privacy risks to customer trust, market reputation, and operational resilience.
14. Demonstrate resilience, courage, and sound judgment under pressure, especially during regulatory reviews or data breach events.
15. Show commitment to capability building, privacy culture uplift, and continuous improvement.