Operations

Data Protection Officer

Sidian Bank·Nairobi, kenya·Full Time·Contract
OperationsFull TimeContract
-Closes Oct 22, 2026

JOB PURPOSE

The job holder will support the Bank's Data Protection Office in establishing, implementing, monitoring and continuously improving the Bank's data protection and privacy framework, ensuring compliance with the Data Protection Act, 2019, applicable Data Protection Regulations, ODPC guidance and relevant CBK requirements, while embedding privacy-by-design and responsible data management across the Bank. The role will provide second-line oversight and assurance over privacy risks arising from customer, employee, supplier, digital, technology and third-party data processing activities.

The ODPC's mandate includes regulating processing of personal data, protecting data subjects' privacy and overseeing compliance with the Data Protection Act.

KEY RESPONSIBILITIES AND ACTIVITIES

Data Protection Governance

  • Act as the Bank's appointed Data Protection Officer in accordance with Section 24 of the Kenya Data Protection Act 2019, ODPC Guidance Notes on DPOs, and relevant Section 25 Principles of Data Protection, performing the role independently and without conflict of interest.
  • Support implementation and continuous enhancement of the Bank's Data Protection and Privacy Framework. Maintain the Bank's data protection governance structure, policies, standards, procedures and guidelines. Maintain a regulatory obligations register covering the Data Protection Act, Regulations, ODPC guidance and applicable banking requirements with specific ODPC guidance on DPIAs, DPO responsibilities, consent, cross-border transfers and data-sharing,
  • Coordinate periodic review of data protection policies and procedures.
  • Provide data protection input into Board, Board Risk Committee and Management reporting. Maintain appropriate evidence of compliance and regulatory readiness.
  • Design and maintain data protection policies, governance frameworks, operational controls, reporting mechanisms, and annual data protection compliance plans.
  • Work closely with Legal, Compliance, Risk, IT Security, ICT, Product Development, and Internal Audit functions including other business functions while maintaining the functional independence of the DPO role.
  • Serve as the operational secretariat and primary execution officer working alongside Data Protection Committee risk champions across business units to drive consistent compliance.

Data Protection Risk Management

  • Maintain the Bank's Data Protection Risk Register and monitor emerging privacy risks.
  • Coordinate data protection risk assessments across business units.
  • Support integration of privacy risks into the Bank's RCSA, operational risk, technology risk, third-party risk and enterprise risk frameworks.
  • Define and monitor data protection KRIs and thresholds.
  • Escalate material privacy risks, breaches and control weaknesses to the DPO and relevant governance committees.
  • Track remediation actions and ensure closure within approved timelines.

Data Protection Impact Assessments

  • Coordinate and review Data Protection Impact Assessments (DPIAs) for high-risk processing activities.
  • Provide privacy input into new products, digital channels, systems, AI/analytics initiatives, outsourcing and major projects.
  • Embed Privacy by Design and Default within product and technology development processes.
  • Review proposed changes to processing purposes, data fields, retention periods and data-sharing arrangements.

Data Subject Rights

  • Establish and monitor processes for handling data subject requests.
  • Oversee requests relating to access, rectification, objection, restriction, erasure and other applicable data subject rights.
  • Monitor response timelines and maintain appropriate records.
  • Coordinate with key business units such as, Legal, Compliance, Operations, IT and business units where requests require cross-functional intervention.

Emerging Tech & Privacy by Design

  • Provide expert privacy guidance on AI systems, predictive analytics, automated decision-making, behavioural profiling, fraud prevention engines, biometric data, cloud migrations, and other emerging banking technologies.
  • Embed Privacy by Design and Privacy by Default throughout product development life cycles, system implementation, process engineering, and third-party API integrations.
  • Review and advise on records of processing activities (RoPA), DFM's Data Retention & Disposal schedule privacy notices across digital/branch channels, consent management, and legal bases for processing under Section 25 principles.

Data Breach & Incident Management

  • Support the Bank's personal data breach management and notification framework.
  • Coordinate investigation and assessment of privacy incidents with Information Security, Cybersecurity, Legal, Compliance and relevant business units.
  • Assess regulatory notification requirements and escalation thresholds.
  • Maintain a central register of data protection incidents and lessons learned.
  • Ensure corrective actions arising from privacy incidents are tracked to closure.

Third-Party & Outsourcing Privacy Risk

  • Review data protection aspects of third-party arrangements, outsourcing, cloud services and technology partnerships.
  • Support due diligence and ongoing monitoring of data processors.
  • Review data processing agreements and privacy clauses in conjunction with Legal and Procurement.
  • Monitor cross-border transfers and related safeguards.
  • Maintain oversight of processor compliance and contractual obligations.
  • Privacy Incident & Breach Management - Direct data protection incident response protocols, overseeing breach triage, root-cause assessments, containment strategies, and statutory notifications to the ODPC and affected data subjects within regulatory timelines.
  • Provide independent oversight and challenge regarding third-party privacy risk assessments, vendor due diligence, and joint data controller/processor arrangements.
  • Oversee the management and escalation of personal data breaches, ensuring technical risk evaluation, root-cause investigation, statutory documentation, and timely regulatory notifications

Data Governance & Records

  • Maintain oversight of the Bank's Records of Processing Activities (ROPA).
  • Support data inventory and data-flow mapping across critical business processes.
  • Monitor data retention and disposal requirements.
  • Coordinate periodic review of data classification and handling requirements.
  • Support implementation of appropriate controls over sensitive and confidential information.

Regulatory Compliance & Assurance

  • Monitor compliance against the Data Protection Act, Regulations and applicable ODPC guidance.
  • Coordinate responses to ODPC information requests, inspections, complaints and regulatory reviews.
  • Support regulatory examinations and remediation programs.
  • Conduct periodic thematic reviews of data protection controls.
  • Maintain regulatory evidence and compliance attestations.

Awareness & Capacity Building

  • Develop and coordinate annual data protection awareness programmes.
  • Deliver targeted training for high-privacy risk functions including:
  • Digital Banking
  • Credit
  • Operations
  • Marketing
  • HR
  • IT
  • Procurement
  • Customer Service
  • Fraud
  • AML/KYC
  • Promote a privacy-conscious culture across the Bank.
  • Maintain training completion and certification records.

Regulatory Liaison & External Representation

  • Serve as the primary point of contact for Data Protection Authorities (ODPC), managing regulatory inquiries, statutory registration renewals, compliance audits, inspections, and mandatory notifications.
  • Serve as the primary escalation point for data subjects, overseeing the handling of Data Subject Access Requests (DSARs) and ensuring they are resolved accurately within statutory timelines.

Reporting & Governance

  • Prepare periodic reports covering for example:
  • Data protection compliance status
  • Open privacy risks
  • DPIAs completed/outstanding
  • Data subject requests
  • Data breaches/incidents
  • Third-party privacy risks
  • Regulatory matters
  • Policy exceptions
  • RCSA/control testing results
  • Remediation status
  • Key privacy KRIs

KNOWLEDGE, SKILLS & EXPERIENCE

  • Bachelor's degree in Law, Information Technology, Data Science, Risk Management, Compliance, Business, Finance or related discipline.
  • Professional qualification in data protection/privacy, risk, compliance, audit, information security or related field.
  • 5 - 8 years' experience, preferably within banking, financial services, fintech or another highly regulated environment.
  • Practical knowledge of the Kenyan Data Protection Act and Regulations.

Professional Certificates

  • CIPM / CIPP / CDPO / equivalent privacy qualification (e.g. Certified Data Privacy Solutions Engineer (CDPSE), Certified Information Privacy Profession(CIPP)
  • CAMS, CISA, CISM, ISO 27001, ISO 31000 or related qualification.

Desirable

  • Experience with ODPC regulatory engagements.
  • Experience in data governance, privacy risk assessments, DPIAs and third-party risk.
  • Active membership or affiliation with professional privacy and security organizations (e.g., IAPP, ISACA, ISC2).

Technical / Functional Skillset

  • Data protection & privacy regulatory knowledge - DPA, ODPC Regulations & Guidelines
  • Privacy risk management, DPIAs and Privacy-by-Design
  • Data governance, ROPA, data mapping and retention
  • Data breach/incident management and regulatory reporting
  • Third-party/data processor risk management
  • RCSA, control testing, KRIs and compliance monitoring
  • Policy development, regulatory interpretation and assurance
  • Strong understanding of banking, digital, technology and customer-data environments
  • Data protection awareness and training

Behavioral Competencies

  • Behavioral Competencies
  • High integrity, confidentiality and ethical judgment
  • Strong attention to detail
  • Analytical and risk-based thinking
  • Independent challenge and professional skepticism
  • Strong stakeholder engagement and influencing skills
  • Clear written and verbal communication
  • Ability to manage sensitive/confidential matters
  • Proactive and solution-oriented
  • Organized, disciplined and delivery-focused
  • Ability to translate regulatory requirements into practical business controls

Key skills

BA/BSc/HNDProfessional Certificate
Apply Now

At a glance

Company

Sidian Bank

Location

Nairobi, kenya

Employment

Full Time

Experience

Valid until

October 22, 2026

Created

October 12, 2026

More opportunities

Similar roles you might like

Monitoring, Evaluation & Learning Manager

inABLE

Nairobi, kenya

full-time

Job Description Department/Programme: Inclusive Africa Program (IAP) Duty Station: Nairobi, Kenya with regional travel and virtual engagement across Africa Contract Allocation: Full-Time Level: Middle Level Recommended Reporting Line: Programs Director Direct Reports: None initially; may supervise officers, interns, consultants and service providers as assigned Experience required: 8 - 10 years of progressively responsible relevant experience Position Purpose The Monitoring, Evaluation & Learning Manager will lead the operationalization of IAP's results, measurement and learning system. The role will translate the Theory of Change and results framework into practical indicators, tools, baselines, targets, data flows, dashboards, evaluations and learning processes that combine quantitative performance with qualitative evidence and lived experience. The postholder will promote data quality, ethical and accessible data collection, accountability and adaptive management across the programme. Key Responsibilities MEL System Design and Operationalization Refine and maintain the MEL plan, results framework, indicator reference sheets, learning agenda, data-flow maps and reporting calendar in collaboration with programme teams and the Foundation. Align programme indicators, disaggregation and evidence requirements with IAP outcomes, donor requirements and management decision needs. Develop accessible quantitative and qualitative tools for training, employment, policy influence, working groups, convenings, narrative change, AT innovation and institutional adoption. Establish clear responsibilities, standard operating procedures, version control and evidence standards for data collection, review, storage and reporting. Baseline, Monitoring and Evaluation Coordinate baseline, midline, annual and endline assessments, outcome reviews and other programme studies, including terms of reference, sampling, tools, quality assurance and management response. Ensure all studies obtain the required research permits and ethics approvals before data collection (including NACOSTI licensing, accredited ethics committee review, and county or national authorisations in other countries where applicable), and that approved protocols are followed throughout. Monitor progress against targets and milestones, identify variance and support workstream leads to define corrective action. Coordinate participant tracking from outreach and training through certification, internship, employment, advocacy and leadership pathways. Apply mixed methods to assess skills, agency, voice, gender barriers, employment pathways, institutional practice and policy contribution. Data Management, Quality and Protection Configure and administer approved programme information systems, dashboards and secure evidence repositories, including ActivityInfo or equivalent platforms where authorised. Conduct routine data-quality assessments covering validity, reliability, completeness, timeliness, integrity and precision. Ensure data are disaggregated appropriately, including by sex, age, disability and geography, while applying data-minimisation and confidentiality principles. Implement informed-consent, access-control, retention, anonymisation and secure-transfer practices consistent with data-protection and safeguarding requirements. Serve as inABLE's designated Data Protection Officer / focal point for programme, MEL and research data, in line with the Kenya Data Protection Act, 2019 and its Regulations, and applicable data-protection laws in other countries of operation. This includes but not limited to maintaining inABLE's registration with the Office of the Data Protection Commissioner (ODPC) as a data controller/processor and keeping records of processing activities up to date. Analysis, Reporting and Visualisation Analyse programme data and produce accurate dashboards, performance briefs, quarterly and annual result narratives, donor annexes and management presentations. Triangulate monitoring data, participant feedback, stories, research and partner evidence, distinguishing outputs, outcomes, contribution and attribution. Flag underperformance, anomalies and emerging risks promptly and provide practical recommendations for management action. Ensure all data products and visualisations are accessible, clearly labelled and suitable for decision-making. Learning, Adaptation and Evidence Use Facilitate regular reflection, pause-and-learn and outcome-harvesting sessions with staff, partners and youth representatives. Establish and maintain an accessible feedback and complaints mechanism that participants (especially youth with disabilities), partners and community members can use, through multiple channels suited to different disabilities and literacy levels (for example SMS, WhatsApp, voice, Kenya Sign Language, easy-read and in-person options). Maintain a decision and adaptation log showing what changed, why, based on which evidence, and with what follow-up. Coordinate the programme learning agenda, including questions on youth advocacy, digital service use, institutional adoption and AT peer learning. Work with Policy and Communications colleagues to package validated evidence for policy products, knowledge resources and external learning. Partner Capacity and Team Leadership Assess and strengthen partner capacity in indicator interpretation, accessible data collection, data quality, safeguarding, consent and evidence documentation. Provide coaching, templates, helpdesk support and feedback to programme staff, OPDs, training partners, consultants and evaluators. Coordinate external evaluators or enumerators and verify deliverables before acceptance. Contribute to programme planning, budgeting, risk management and governance meetings, and promote a culture of learning rather than compliance-only reporting. Education and Professional Qualifications Master's degree in Monitoring and Evaluation, Statistics, Economics, Development Studies, Social Sciences, Public Policy, Data Science or a related field. Professional training in results-based management, evaluation, research methods, data Visualisation, project management or learning is desirable. Training in research ethics, safeguarding, data protection, disability-inclusive data collection or Washington Group questions is an advantage. Required Experience 8 - 10 years of progressively responsible MEL, research, evaluation or programme-quality experience in complex development programmes Demonstrated experience designing and managing results frameworks, Theory of Change, baselines, targets, indicator protocols and mixed-method evaluations. Experience with youth skills, policy, systems change, disability inclusion, employment, education or multi-country programmes. Strong record in data-quality assurance, partner capacity strengthening, donor reporting, dashboards and evidence use for adaptive management. Experience administering ActivityInfo or comparable MIS platforms and analysing data using advanced spreadsheet, statistical, BI or qualitative-analysis tools. Experience managing consultants, evaluations, research ethics and secure participant data is strongly preferred. Technical Knowledge and Skills Results-based management and Theory of Change Indicator design, sampling and mixed-method research Quantitative and qualitative analysis Data-quality assessment and audit-ready evidence management Data visualisation and dashboard design Information-system administration and data governance Contribution analysis, outcome harvesting and policy-influence measurement Accessible and disability-inclusive data collection Donor reporting, learning facilitation and evidence translation Strong spreadsheet capability; competence with statistical, BI or qualitative software Behavioural Competencies Analytical rigour and attention to detail Curiosity and constructive challenge Integrity and independence of evidence Pragmatism and service orientation Ability to explain technical information clearly Collaborative coaching style Commitment to participant dignity and data rights Organisation, deadline discipline and calm problem solving

11 days ago

Manager It Security

HF Group

Nairobi, kenya

full-time

About the Role The Manager - IT Security supports the Head of ICT Security / CISO in strengthening the Group's information security posture by coordinating IT security governance, cyber risk management, SOC operations oversight, security assurance, audit remediation, regulatory compliance and proactive cyber resilience across the Group. The role ensures that security policies, standards, controls, monitoring processes and assurance activities are embedded into technology operations, digital channels, projects, third-party engagements, and business processes. The role holder provides security support to the substantive Data Protection Officer by ensuring that technical and organisational security controls for personal data are defined, implemented, tested, monitored, and evidenced. This role supports privacy governance through technology control implementation, security assurance, access control, monitoring, incident coordination, third-party reviews, and remediation tracking. Key Accountabilities Data Protection and Privacy Security Support - Support the substantive Data Protection Officer by providing information security input into privacy governance, DPIAs, data classification, access controls, encryption, logging and monitoring, data loss prevention, third-party risk reviews, breach investigation, audit evidence and remediation tracking. IT Security Governance and Strategy Execution - Support the CISO in implementing the Group information security strategy, governance framework, policies, standards, procedures, operating model and control assurance programme. Regulatory Compliance and Security Reporting - Coordinate compliance reviews, evidence packs, management attestations, regulatory responses, control self-assessments and reporting to ICT, Risk, Compliance, Audit and management governance forums. Cyber Risk, Audit and Remediation Management - Coordinate identification, assessment, monitoring, reporting and remediation of ICT and cyber risks across the Group, including audit and regulatory findings to closure. SOC Operations Oversight and Incident Coordination - Provide management oversight of security monitoring, incident triage, escalation, response coordination, threat intelligence, SOC use cases, alert handling, incident reporting and post-incident remediation. ICT Resilience, Disaster Recovery and Cyber Recovery Support - Coordinate security input into ICT business continuity, disaster recovery, cyber recovery planning, backup assurance, recovery testing and remediation of resilience gaps. Identity and Access Governance - Maintain access governance covering privileged access, periodic user access reviews, role-based access control, joiner-mover-leaver controls, access certification, segregation of duties, exceptions, remediation tracking and evidence management. Security Assurance for Projects, Platforms and Third Parties - Provide security assurance over systems, infrastructure, digital channels, cloud services, APIs, integrations, third parties and technology changes. Qualifications Bachelor's degree in information security, Computer Science, Information Systems, Information Technology, Cybersecurity, Risk Management, or related fields. Relevant certifications such as CISM, CISSP, CRISC, CISA, ISO 27001 Lead Implementer/Lead Auditor, CompTIA Security+, CBCP or equivalent will be an added advantage. At least 5 years' experience in information security, IT governance, cyber risk, security operations, security assurance, or technology risk management. Understanding of implementation of technical security controls, identity and access management and designing security solutions in a dynamic environment At least 2 years in a supervisory or managerial role within a highly regulated or digitized environment. Demonstrable experience in security governance, SOC oversight, audit remediation, regulatory compliance, access governance, third-party assurance, project security assurance, incident coordination, cyber resilience and executive reporting. Understanding of IT Audit processes, technical security testing (Red Team, Blue Team, Penetration Testing) and Cyber Incident Response including data protection guidelines.

2 months ago

Information Risk & Business Resilience Manager

Standard Bank Group

Nairobi, kenya

full-time

Job Description To provide independent second-line oversight, advisory, challenge and monitoring across the overlapping risk domains of Information Risk, Data Privacy, Business Resilience, Technology Risk and Cyber Risk. The role will support the Head of Non-Financial Risk by localising Group frameworks and standards, embedding risk appetite, facilitating risk assessments and scenario analysis, coordinating assurance and remediation, and producing integrated risk insights for management and governance committees. The role is not the first-line owner of risk execution; it enables, challenges and monitors business and technology risk owners to ensure risks are identified, assessed, treated, reported and escalated within appetite This is a strategic second-line risk position for an experienced professional with the ability to translate complex and interconnected risk themes into actionable insights and governance outcomes. The role requires a strong balance of technical credibility, business pragmatism, and stakeholder influence to support growth ambitions while maintaining robust protection of clients, information assets, technology infrastructure, critical services, and regulatory confidence. Qualifications Type of Qualification: First Degree Field of Study: Information Technology, Computer Science, Information Risk Management, Information Security, Business, Commerce, Law, Finance, Audit or related discipline. Professional / Technical Certifications: At least one relevant certification is preferred Certified Information Systems Auditor (CISA), Certified Information Security Manager (CISM), Certified in Risk and Information Systems Control (CRISC), Certified Information Systems Security Professional (CISSP), ITIL, ISO 22301, ISO 27001, Certified Data Protection Officer or equivalent Experience Required 7-8 years Strong understanding of Non-Financial Risk as a second-line function and clear appreciation that business and technology remain accountable for first-line execution and control remediation. Demonstrable experience in at least three of the following domains: Information Risk, Data Privacy, Business Resilience, Technology Risk, Cyber Risk, Operational Risk, IT Audit, Technology Governance or Business Continuity. Ability to interpret Group standards and regulatory expectations and translate them into practical country implementation actions. Strong governance writing capability: must be able to prepare committee-ready risk commentary, issue escalation notes and executive summaries. Strong analytical capability and attention to detail, including comfort working with dashboards, risk registers, incident data, audit findings and action trackers. Ability to influence senior stakeholders and provide constructive challenge without compromising relationship management. High integrity, confidentiality, independence, professional scepticism and sound judgement when handling sensitive incidents, breaches, regulatory matters and risk acceptance decisions. Working knowledge of risk systems and collaboration tools, including Risk Market Place or equivalent governance, risk and compliance platforms, Microsoft Excel, PowerPoint, Word and Teams. Additional Information Behavioural Competencies: Articulating Information Developing Expertise Documenting Facts Examining Information Following Procedures Interacting with People Managing Tasks Technical Competencies: Evaluating Risk Management Effectiveness Information Security Information Security Management Cyber and Technology Risk Oversight Analytical Skills Risk Response Strategy

3 months ago

Legal Associate

Moringa School

Nairobi, kenya

full-time

Moringa School is seeking a commercially grounded and detail-oriented Legal Associate to provide broad legal support across the organization This is a hands-on role suited to a legal professional who thrives in a fast-paced environment and is comfortable managing diverse legal matters simultaneously. The Legal Associate will be responsible for ensuring company-wide legal compliance, managing contracts, supporting fundraising due diligence and serving as the organization's Data Protection Officer. The role operates across all business functions and requires someone who can work with minimal supervision while delivering high-quality legal counsel and documentation. This role will initially be engaged as a 3-month consultancy, with a transition to a full-time position subject to satisfactory performance and business needs.

5 months ago

Legal Associate

Moringa School

Nairobi, kenya

full-time

Moringa School is seeking a commercially grounded and detail-oriented Legal Associate to provide broad legal support across the organization This is a hands-on role suited to a legal professional who thrives in a fast-paced environment and is comfortable managing diverse legal matters simultaneously. The Legal Associate will be responsible for ensuring company-wide legal compliance, managing contracts, supporting fundraising due diligence and serving as the organization's Data Protection Officer. The role operates across all business functions and requires someone who can work with minimal supervision while delivering high-quality legal counsel and documentation. This role will initially be engaged as a 3-month consultancy, with a transition to a full-time position subject to satisfactory performance and business needs.

5 months ago

Legal Associate

Moringa School

Nairobi, kenya

full-time

Moringa School is seeking a commercially grounded and detail-oriented Legal Associate to provide broad legal support across the organization This is a hands-on role suited to a legal professional who thrives in a fast-paced environment and is comfortable managing diverse legal matters simultaneously. The Legal Associate will be responsible for ensuring company-wide legal compliance, managing contracts, supporting fundraising due diligence and serving as the organization's Data Protection Officer. The role operates across all business functions and requires someone who can work with minimal supervision while delivering high-quality legal counsel and documentation. This role will initially be engaged as a 3-month consultancy, with a transition to a full-time position subject to satisfactory performance and business needs.

5 months ago