Data Protection Officer - Nairobi - TheTalentory

Description

About Us:
FinSprint is revolutionizing financial services across Africa by delivering innovative, technology-driven embedded finance solutions. Our mission is to empower businesses to simplify operations and enhance customer experiences through enterprise automation.

By streamlining financial transactions, we help our clients stay ahead in the fast-evolving fintech landscape while driving financial inclusion and economic growth.

At FinSprint, we prioritize the privacy and security of our clients' data.

We are fully committed to adhering to all relevant data protection regulations, including Kenya's Data Protection Act, 2019, and global standards such as GDPR.

Our culture of compliance and transparency ensures that we uphold the highest standards in data privacy and security, providing our clients with confidence and peace of mind.

Position Overview:

We are seeking a highly skilled and experienced Data Protection Officer (DPO) to oversee our data protection strategy and ensure compliance with the Data Protection Act, 2019 and other applicable laws.

The DPO will be responsible for implementing policies, conducting assessments, and serving as the primary point of contact for data protection matters within the organization.

The role will play a key part in ensuring compliance with Kenyan and international privacy standards.


Key Responsibilities:

Policy Development and Implementation:

• Develop and oversee the company's data protection policies, procedures, and practices to ensure full compliance with the Data Protection Act, 2019, and other applicable laws.
• Ensure that IT systems and procedures comply with all relevant data privacy and protection laws, regulations, and policies, in line with global standards like GDPR.

Compliance Monitoring:

• Conduct regular assessments to ensure the company's compliance with data protection laws.
• Monitor data management procedures and processes within the company, ensuring compliance with regulatory requirements and company policies.
• Maintain comprehensive records of all data processing activities conducted by the company, including the purposes of all processing activities.
• Support the implementation of a compliance management framework that integrates industry regulations and internal policies across all departments.
• Monitor regulatory developments in Kenya and internationally to ensure alignment with emerging best practices and evolving data privacy laws.

Training and Awareness:

• Design and deliver comprehensive data protection and privacy training programs to all staff members, fostering a data-conscious culture within the company.
• Facilitate capacity building of staff involved in data processing operations.

Regulatory Liaison:

• Act as the primary point of contact within the company for members of staff, regulators, and relevant data protection authorities.
• Cooperate with the Office of the Data Protection Commissioner (ODPC) and any other relevant authority on matters relating to data protection.

Data Subject Requests and Incident Response:

• Ensure efficient and lawful handling of all data subject requests, including access, rectification, deletion, and data portability requests.
• Lead the company's response to data protection incidents, including data breaches, ensuring timely notification to regulatory authorities and affected individuals when necessary

.

Risk Assessment and Management:

• Conduct comprehensive Data Protection Impact Assessments (DPIAs) and risk analyses to identify vulnerabilities and enforce risk mitigation strategies.
• Identify and evaluate the company's data processing activities and keep the data processing inventory updated at all times.

Reporting:

• Prepare and share regular compliance status reports with leadership to highlight risks and areas of concern, driving corrective actions.
• Submit periodic reports on data protection compliance to the Office of the Data Protection Commissioner (ODPC).

Stakeholder Management:

• Act as the main liaison for internal and external stakeholders, including regulators, to ensure effective communication on compliance matters.
• Collaborate with risk champions and internal audit teams to address compliance gaps and ensure continuous improvement.

Qualifications:

Education:

• Bachelor's degree in Information Technology, Law, Risk Management, or a related field.

Professional Certifications:

• Data Protection and/or Privacy certification (e.g., Certified Information Privacy Professional (CIPP), Certified Information Privacy Professional/Information Technology (CIPP/IT)).
• Certified Information Systems Security Professional (CISSP), Certified Information Systems Auditor (CISA), or Certified Information Security Manager (CISM) certification is an added advantage.

Experience:

• Minimum of 3 years' experience in a Risk, Compliance, or Legal function, with specific experience in Privacy Compliance.
• Experience in Data Privacy laws within Kenya and/or the region, as well as familiarity with GDPR and international data protection frameworks.

Skills and Competencies:

• Excellent communication skills with the ability to establish and maintain trust and credibility at all levels.
• Strong analytical skills with the ability to interpret complex data protection information and communicate this effectively to non-specialists.
• Ability to lead, influence, and drive change initiatives in alignment with business strategies.
• Professionalism and integrity aligned with the company's values.
• Strong risk awareness and focus on ensuring compliance with legal standards and regulatory requirements.
• Emotional intelligence, strong stakeholder management skills, and report writing abilities.