Executive Head Of Privacy

Reporting to the Group Chief Risk Officer, the Executive Head of Privacy is accountable for shaping, governing, and advancing Safaricom’s enterprise wide Privacy, Data Protection, and Responsible Data Use strategy, frameworks, controls, and capabilities. The role provides strategic leadership in anticipating, identifying, and mitigating privacy risks, ensuring lawful and ethical data handling, safeguarding customer information, and embedding trust by design across Safaricom’s converged Telco–FinTech ecosystem, including M PESA, digital services, platforms, applications, networks, customer analytics, APIs, and partner ecosystems.

The role leads Safaricom’s Customer Privacy and Data Protection agenda across data governance, data minimisation, privacy by design, consent management, customer rights enablement, data lifecycle management, cross border data transfers, breach management, regulatory engagement, data ethics, and privacy assurance reviews. It ensures deployment of a unified Privacy Management System anchored in global standards and frameworks such as the Kenya Data Protection Act (DPA 2019), GDPR equivalent practices, ISO/IEC 27701, OECD Privacy Guidelines, GSMA Mobile Privacy Principles, and global digital trust benchmarks.

The Executive Head of Privacy partners extensively with M PESA/Financial Services, Technology, Digital, Enterprise, Consumer, Data Engineering, Networks, Legal, Risk, Compliance, Procurement, Supply Chain, Corporate Affairs, HR, Internal Audit, and external regulators (ODPC, CBK, CAK) to embed privacy resilience, strengthen data handling controls by design, and ensure robust privacy assurance across Safaricom’s rapidly evolving digital environment.

The role champions customer trust, ethical data stewardship, transparency, and responsible innovation, enabling a culture where engineers, product teams, analysts, data scientists, marketers, and ecosystem partners design and operate privacy compliant products, respect customer choices, and proactively identify and mitigate privacy risks. Through advanced privacy risk analytics, data flow mapping, consent and preference governance, third party privacy due diligence, privacy impact assessments (PIAs/DPIAs), and continuous assurance, the Executive Head of Privacy ensures Safaricom operates as one of Africa’s most trusted, privacy conscious, and ethically grounded digital enterprises.

The Executive Head Of Privacy Is Strategically Accountable For

• Privacy Strategy & Governance: Defining and governing Safaricom’s enterprise wide Privacy, Data Protection, and Data Governance strategy, policies, standards, and operating frameworks, ensuring alignment with DPA 2019, global privacy principles, and evolving regulatory expectations in digital, financial, and telecom sectors.
• Data Protection Risk Intelligence, Monitoring & Response: Driving privacy risk assessments, data flow visibility, metadata governance, monitoring of high risk processing activities, incident detection, breach response, and regulatory notifications to prevent, detect, and mitigate privacy and data misuse risks across Safaricom’s digital ecosystem.
• Privacy-by-Design, Secure Data Use & Ethical Engineering: Embedding privacy by design into technology, product development, analytics, AI/ML models, customer interfaces, APIs, and ecosystem integrations through PIAs/DPIAs, data minimisation, pseudonymisation, access governance, purpose limitation, and ethical design frameworks.
• Responsible AI Governance: Define and enforce enterprise-wide AI governance frameworks to ensure safe, ethical, and compliant use of AI across Safaricom’s digital and data ecosystem.
• Data Minimisation, Consent, Rights Management & Lifecycle Controls: Strengthening customer consent governance, transparency mechanisms, rights management (access, erasure, portability, objection), data retention and deletion controls, and lawful bases for processing, ensuring compliant, accurate, and accountable use of customer information.
• Sensitive Data & Digital Trust Safeguards: Ensuring protection of sensitive and financial data, including M PESA processing data, behavioural data, identity attributes, and metadata, applying strong privacy controls, confidentiality safeguards, and aligned practices with AML, cybersecurity, and fraud prevention teams.
• Ecosystem Privacy Assurance (M PESA, Digital, Partners, APIs): Strengthening privacy assurance for M PESA services, merchant/agent ecosystems, API partners, fintech integrations, cloud environments, cross border data flows, and digital service providers, ensuring robust contractual privacy obligations, oversight, and compliance testing.
• Privacy Compliance Reporting, Assurance & Regulatory Readiness: Delivering privacy dashboards, KRIs, heatmaps, DPIA outcomes, breach metrics, and Board/ELT reporting; ensuring readiness for ODPC audits, CBK reviews (for financial data), Internal Audit assurance, and alignment with Enterprise Risk & Compliance frameworks.
• Privacy Culture, Capability & Technology Transformation: Building enterprise wide privacy awareness, responsible data use behaviours, leadership engagement, and capability uplift across squads and functions; scaling privacy technology, automation, data classification tools, consent systems, discovery platforms, and AI driven privacy analytics.
• Privacy Advocacy & Ecosystem Engagement: Champion privacy and data ethics through proactive stakeholder engagement, regulatory collaboration, and enterprise-wide awareness.
• Group Subsidiary Oversight, Enablement & Governance: Provide Group-level oversight and strategic enablement to subsidiaries by defining minimum risk standards, frameworks, and reporting requirements while supporting local market execution through advisory partnership, capability uplift, and risk-by-design embedding. Ensure consistent application of Group policies, effective aggregation of risk exposures and emerging themes across markets, and timely escalation of material issues to the CRO and Board. Balance strong governance with commercial enablement by partnering with subsidiary leadership to proactively identify, assess, and mitigate risks in a way that supports sustainable growth and regulatory compliance across the Safaricom Group.
• Risk, Governance & Control Ownership: Embed and maintain effective risk, governance, compliance, and control practices within the function by proactively identifying and mitigating operational, regulatory, financial, people, technology, and reputational risks. Ensure adherence to internal policies, regulatory requirements, audit actions, and enterprise governance frameworks while driving accountability, ethical practices, and a strong controls environment across all areas of responsibility.
  
  

Anchored in Safaricom’s purpose of Transforming Lives, the Executive Head of Privacy ensures Safaricom operates with uncompromising data protection standards, customer trust, and responsible innovation. By safeguarding customer information, enabling ethical data use, and reinforcing transparency at every touchpoint, the role strengthens Safaricom’s position as Africa’s most trusted and future ready digital enterprise.