Data Protection Officer

Data Protection Officer – MNU As a member of Munich Re, the MedNet Group is a leading Third-Party Administrator (TPA) serving the healthcare and insurance sectors across the MEA region. We are looking for an experienced Data Protection Officer (DPO) who will be responsible for overseeing and promoting compliance with applicable data protection and privacy laws, regulations and Munich Re Group requirements across the MedNet Group. The DPO acts as the independent subject matter expert for data protection matters and provides advice, guidance and oversight to management, employees and business functions on the lawful, fair and secure processing of personal data. The role reports directly to the Chief Compliance Officer and maintains a functional reporting line to the Munich Re Data Protection Team and will from time-to-time report to the Munich Re Regional Head of Legal and Compliance for DP related issues. The DPO supports the development, implementation and continuous improvement of the MedNet Group data protection framework and serves as the central point of contact for data protection regulators, data subjects and Munich Re Group stakeholders on privacy-related matters. Your Role: • Maintain and enhance the Data Protection Framework, policies and procedures, ensuring compliance with applicable data protection laws and regulatory requirements across all MedNet jurisdictions, with timely reporting to management and relevant governance committees. • Deliver the annual Data Protection Monitoring Plan, conduct monitoring reviews, identify and report key privacy risks, issue recommendations, and track agreed remediation actions through to closure. • Review and advise on Data Protection Impact Assessments (DPIAs) for high-risk processing activities, ensuring assessments are completed prior to implementation and resulting management actions are effectively monitored. • Oversee personal data breach and privacy incident management, including timely assessment and documentation, regulatory notifications where required, root cause analysis for significant incidents, and monitoring of corrective actions. • Monitor data subject rights requests across relevant entities, ensuring statutory response requirements are met while identifying and escalating significant trends, recurring issues, complaints or regulatory enquiries. • Drive data protection training and awareness, including annual mandatory training, targeted awareness sessions for high-risk business functions, and initiatives designed to strengthen employees’ privacy awareness. • Provide privacy oversight for third-party risk assessments, outsourcing, data-sharing arrangements and cross-border transfers, ensuring compliance with applicable local laws and Munich Re Group transfer requirements and escalating non-compliant arrangements. • Support regulatory inspections, audits reporting and requests, engage effectively with Munich Re Data Protection and Regional Legal & Compliance teams, monitor legislative developments maintain privacy metrics and management reporting, and drive continuous improvement and maturity of the privacy programmed. Your profile: Minimum Qualifications: • Bachelor's degree in either Law, Compliance, Information Governance, Information Security, Risk Management, or a related discipline. • Recognized certification in Data Protection or Privacy is preferred (e.g. CIPP/E, CIPM, CIPT, CDPO or equivalent). • Additional compliance, governance or risk qualifications would be advantageous. Minimum Experience: • Minimum 4 years' experience in data protection, privacy, compliance, legal, governance or risk management functions. • Experience advising on data protection requirements within regulated industries such as healthcare, insurance or financial services. • Experience conducting or overseeing privacy impact assessments, privacy compliance reviews and breach management activities. • Experience engaging with regulators, auditors and senior stakeholders. • Experience operating within a multinational or matrix reporting environment would be advantageous. *Munich Re not only stands for fairness with regard to its clients; it is also an equal opportunities employer.

Minimum Qualifications: Bachelor's degree in either Law, Compliance, Information Governance, Information Security, Risk Management, or a related discipline. Recognized certification in Data Protection or Privacy is preferred (e.g. CIPP/E, CIPM, CIPT, CDPO or equivalent). Additional compliance, governance or risk qualifications would be advantageous. Minimum Experience: Minimum 4 years' experience in data protection, privacy, compliance, legal, governance or risk management functions. Experience advising on data protection requirements within regulated industries such as healthcare, insurance or financial services. Experience conducting or overseeing privacy impact assessments, privacy compliance reviews and breach management activities. Experience engaging with regulators, auditors and senior stakeholders. Experience operating within a multinational or matrix reporting environment would be advantageous.

Maintain and enhance the Data Protection Framework, policies and procedures, ensuring compliance with applicable data protection laws and regulatory requirements across all MedNet jurisdictions, with timely reporting to management and relevant governance committees. Deliver the annual Data Protection Monitoring Plan, conduct monitoring reviews, identify and report key privacy risks, issue recommendations, and track agreed remediation actions through to closure. Review and advise on Data Protection Impact Assessments (DPIAs) for high-risk processing activities, ensuring assessments are completed prior to implementation and resulting management actions are effectively monitored. Oversee personal data breach and privacy incident management, including timely assessment and documentation, regulatory notifications where required, root cause analysis for significant incidents, and monitoring of corrective actions. Monitor data subject rights requests across relevant entities, ensuring statutory response requirements are met while identifying and escalating significant trends, recurring issues, complaints or regulatory enquiries. Drive data protection training and awareness, including annual mandatory training, targeted awareness sessions for high-risk business functions, and initiatives designed to strengthen employees’ privacy awareness. Provide privacy oversight for third-party risk assessments, outsourcing, data-sharing arrangements and cross-border transfers, ensuring compliance with applicable local laws and Munich Re Group transfer requirements and escalating non-compliant arrangements. Support regulatory inspections, audits reporting and requests, engage effectively with Munich Re Data Protection and Regional Legal & Compliance teams, monitor legislative developments maintain privacy metrics and management reporting, and drive continuous improvement and maturity of the privacy programmed.