Data Privacy Manager📣 Job Ad

About Derayah Financial and the Role

Derayah Financial, a prominent financial institution based in Riyadh, Saudi Arabia, is seeking a dedicated Data Privacy Manager. This full-time role is central to safeguarding personal data and ensuring the organization's adherence to evolving privacy regulations within the Kingdom and internationally.

Role Purpose and Context

The Data Privacy Manager will be responsible for leading Derayah Financial's data privacy program, ensuring full alignment with the Personal Data Protection Law (PDPL) of Saudi Arabia and other applicable regulations. This role serves as the operational owner of the privacy framework and data privacy platform, ensuring all personal data processing activities across the organization meet regulatory requirements, contractual obligations, and internal privacy standards.

Key Responsibilities: Privacy Program & Governance

• Operate and maintain the organization-wide data privacy program in line with PDPL, SDAIA regulations, and applicable cross-border data transfer requirements.
• Develop, maintain, and review privacy policies, procedures, standards, and notices.
• Maintain the Record of Processing Activities (ROPA) and ensure its accuracy across all business units.
• Manage data classification, retention, and minimization controls in coordination with data management and information security functions.
• Track regulatory developments (PDPL, SDAIA, NDMO, sector-specific guidance) and translate them into actionable internal requirements.

Key Responsibilities: Privacy Operations

• Conduct and oversee Data Protection Impact Assessments (DPIA) and Privacy Impact Assessments (PIA) for new and existing processing activities.
• Manage the data subject rights (DSR) request lifecycle, including intake, validation, fulfilment, and reporting within regulatory timeframes.
• Lead the privacy incident response process, including breach assessment, notification to SDAIA and affected individuals, and post-incident remediation.
• Manage and operationalize the Data Privacy technical platform.

Qualifications and Requirements

• Working knowledge of the Saudi PDPL, SDAIA regulations, NDMO data management policies, and applicable sector regulations.
• Familiarity with international privacy frameworks such as GDPR, CCPA, ISO 27701, and the NIST Privacy Framework.
• Strong understanding of personal data lifecycles, lawful processing bases, cross-border data transfer mechanisms, and privacy-by-design principles.
• Practical knowledge of privacy-enhancing technologies (PETs), pseudonymization, anonymization, and data masking.
• Understanding of how privacy controls integrate with information security, IAM, DLP, and data governance functions.
• Strong analytical, drafting, and stakeholder management skills.
• Strong understanding of market Data privacy tooling and solutions.
• Ability to translate regulatory requirements into operational controls and platform configurations.

Experience

Candidates for this position should possess 5-10 years of relevant experience in data privacy or a related field, demonstrating a proven track record in managing and implementing privacy programs.