Data Privacy Expert

➢ Develop and operationalize Data Privacy Policies, Processes/Procedures, Standards, Principles, Guidelines, and Templates to comply with KSA PDPL and NDMO regulations (including but not limited to Personal Data Breach procedures, DPIA, PIA, RoPA, etc.) ➢ Advise the Bank and employees on data processing requirements under the KSA PDPL and ensure compliance. ➢ Provide guidance on data protection impact assessments (DPIA) for data collection and processing. ➢ Ensure all bank records and systems containing personal data align with PDPL. ➢ Develop a comprehensive risk register that encompasses all identified risks along with corresponding treatment plans, closure dates, and responsible stakeholders. ➢ Define Personal Data Protection Standards to be followed by the Information Security Team. ➢ Conduct due diligence on vendors and monitor their adherence to privacy obligations. ➢ Regularly review and update personal data privacy and protection practices. ➢ Review and advise on controls implemented by the business to ensure compliance with data protection requirements and internal policies. ➢ Collaborate with SAMA, Saudi Data and Artificial Intelligence Authority (SDAIA), and other relevant authorities on data protection matters. ➢ Act as the point of contact for data subjects (e.g., customers) and regulatory authorities. ➢ Collaborate with procurement and legal teams to evaluate privacy risks associated with third-party vendors and service providers. ➢ Review and negotiate privacy terms in vendor contracts to ensure compliance with data protection requirements. ➢ Provide regular reports to senior management and relevant stakeholders on privacy program effectiveness, compliance status, and emerging privacy risks. ➢ Collaborate with legal to address privacy-related legal requirements, inquiries, and regulatory investigations. ➢ Serve as a liaison between Business and Functional areas and technology to ensure data-related business requirements for protecting personal and sensitive data are clearly defined, communicated, and well understood. ➢ Manage and advise the relevant stakeholders on data transfers across borders, including approvals and monitoring. ➢ Establish processes to manage personal data transfers and data sharing agreements with external parties while maintaining privacy compliance. ➢ Support the bank in prioritizing processing activities. ➢ Conduct data flow mapping exercises to identify the journey of personal data from collection to destruction, covering data collection points, systems used for processing, storage, etc. ➢ Conduct the RoPA exercise and maintain its repository for all personal data processing activities. ➢ Conduct PIAs for all processing activities identified in the RoPAs to determine which require DPIAs. ➢ Perform DPIAs based on the results of the PIAs. ➢ Offer consultation in the event of a data breach or incident, report to senior management promptly, and take necessary actions. ➢ Provide clear and transparent privacy notices to data subjects across all channels. ➢ Respond to Data Subject Rights Requests (DSRs) and establish policies and procedures for handling DSRs. ➢ Define performance metrics and ensure compliance with data protection and privacy policies, standards, roles, and responsibilities.

Develop and operationalize Data Privacy Policies, Processes/Procedures, Standards, Principles, Guidelines, and Templates to comply with KSA PDPL and NDMO regulations (including but not limited to Personal Data Breach procedures, DPIA, PIA, RoPA, etc.). Advise the Bank and employees on data processing requirements under the KSA PDPL and ensure compliance. Provide guidance on data protection impact assessments (DPIA) for data collection and processing. Ensure all bank records and systems containing personal data align with PDPL. Develop a comprehensive risk register that encompasses all identified risks along with corresponding treatment plans, closure dates, and responsible stakeholders. Define Personal Data Protection Standards to be followed by the Information Security Team. Conduct due diligence on vendors and monitor their adherence to privacy obligations. Regularly review and update personal data privacy and protection practices. Review and advise on controls implemented by the business to ensure compliance with data protection requirements and internal policies. Collaborate with SAMA, SDAIA, and other relevant authorities on data protection matters. Act as the point of contact for data subjects and regulatory authorities. Collaborate with procurement and legal teams to evaluate privacy risks associated with third-party vendors and service providers. Review and negotiate privacy terms in vendor contracts to ensure compliance with data protection requirements. Provide regular reports to senior management and relevant stakeholders on privacy program effectiveness, compliance status, and emerging privacy risks. Collaborate with legal to address privacy-related legal requirements, inquiries, and regulatory investigations. Serve as a liaison between Business and Functional areas and technology to ensure data-related business requirements for protecting personal and sensitive data are clearly defined, communicated, and well understood. Manage and advise the relevant stakeholders on data transfers across borders, including approvals and monitoring. Establish processes to manage personal data transfers and data sharing agreements with external parties while maintaining privacy compliance. Support the bank in prioritizing processing activities. Conduct data flow mapping exercises to identify the journey of personal data from collection to destruction, covering data collection points, systems used for processing, storage, etc. Conduct the RoPA exercise and maintain its repository for all personal data processing activities. Conduct PIAs for all processing activities identified in the RoPAs to determine which require DPIAs. Perform DPIAs based on the results of the PIAs. Offer consultation in the event of a data breach or incident, report to senior management promptly, and take necessary actions. Provide clear and transparent privacy notices to data subjects across all channels. Respond to Data Subject Rights Requests (DSRs) and establish policies and procedures for handling DSRs. Define performance metrics and ensure compliance with data protection and privacy policies, standards, roles, and responsibilities.