S
Data Protection Officer at Sidian Bank
Sidian Bank
October 12, 2026
Full-time
On-site
JOB PURPOSE
The job holder will support the Bank's Data Protection Office in establishing, implementing, monitoring and continuously improving the Bank's data protection and privacy framework, ensuring compliance with the Data Protection Act, 2019, applicable Data Protection Regulations, ODPC guidance and relevant CBK requirements, while embedding privacy-by-design and responsible data management across the Bank. The role will provide second-line oversight and assurance over privacy risks arising from customer, employee, supplier, digital, technology and third-party data processing activities.
The ODPC's mandate includes regulating processing of personal data, protecting data subjects' privacy and overseeing compliance with the Data Protection Act.
KEY RESPONSIBILITIES AND ACTIVITIES
Data Protection Governance
Act as the Bank's appointed Data Protection Officer in accordance with Section 24 of the Kenya Data Protection Act 2019, ODPC Guidance Notes on DPOs, and relevant Section 25 Principles of Data Protection, performing the role independently and without conflict of interest.
Support implementation and continuous enhancement of the Bank's Data Protection and Privacy Framework. Maintain the Bank's data protection governance structure, policies, standards, procedures and guidelines. Maintain a regulatory obligations register covering the Data Protection Act, Regulations, ODPC guidance and applicable banking requirements with specific ODPC guidance on DPIAs, DPO responsibilities, consent, cross-border transfers and data-sharing,
Coordinate periodic review of data protection policies and procedures.
Provide data protection input into Board, Board Risk Committee and Management reporting. Maintain appropriate evidence of compliance and regulatory readiness.
Design and maintain data protection policies, governance frameworks, operational controls, reporting mechanisms, and annual data protection compliance plans.
Work closely with Legal, Compliance, Risk, IT Security, ICT, Product Development, and Internal Audit functions including other business functions while maintaining the functional independence of the DPO role.
Serve as the operational secretariat and primary execution officer working alongside Data Protection Committee risk champions across business units to drive consistent compliance.
Data Protection Risk Management
Maintain the Bank's Data Protection Risk Register and monitor emerging privacy risks.
Coordinate data protection risk assessments across business units.
Support integration of privacy risks into the Bank's RCSA, operational risk, technology risk, third-party risk and enterprise risk frameworks.
Define and monitor data protection KRIs and thresholds.
Escalate material privacy risks, breaches and control weaknesses to the DPO and relevant governance committees.
Track remediation actions and ensure closure within approved timelines.
Data Protection Impact Assessments
Coordinate and review Data Protection Impact Assessments (DPIAs) for high-risk processing activities.
Provide privacy input into new products, digital channels, systems, AI/analytics initiatives, outsourcing and major projects.
Embed Privacy by Design and Default within product and technology development processes.
Review proposed changes to processing purposes, data fields, retention periods and data-sharing arrangements.
Data Subject Rights
Establish and monitor processes for handling data subject requests.
Oversee requests relating to access, rectification, objection, restriction, erasure and other applicable data subject rights.
Monitor response timelines and maintain appropriate records.
Coordinate with key business units such as, Legal, Compliance, Operations, IT and business units where requests require cross-functional intervention.
Emerging Tech & Privacy by Design
Provide expert privacy guidance on AI systems, predictive analytics, automated decision-making, behavioural profiling, fraud prevention engines, biometric data, cloud migrations, and other emerging banking technologies.
Embed Privacy by Design and Privacy by Default throughout product development life cycles, system implementation, process engineering, and third-party API integrations.
Review and advise on records of processing activities (RoPA), DFM's Data Retention & Disposal schedule privacy notices across digital/branch channels, consent management, and legal bases for processing under Section 25 principles.
Data Breach & Incident Management
Support the Bank's personal data breach management and notification framework.
Coordinate investigation and assessment of privacy incidents with Information Security, Cybersecurity, Legal, Compliance and relevant business units.
Assess regulatory notification requirements and escalation thresholds.
Maintain a central register of data protection incidents and lessons learned.
Ensure corrective actions arising from privacy incidents are tracked to closure.
Third-Party & Outsourcing Privacy Risk
Review data protection aspects of third-party arrangements, outsourcing, cloud services and technology partnerships.
Support due diligence and ongoing monitoring of data processors.
Review data processing agreements and privacy clauses in conjunction with Legal and Procurement.
Monitor cross-border transfers and related safeguards.
Maintain oversight of processor compliance and contractual obligations.
Privacy Incident & Breach Management - Direct data protection incident response protocols, overseeing breach triage, root-cause assessments, containment strategies, and statutory notifications to the ODPC and affected data subjects within regulatory timelines.
Provide independent oversight and challenge regarding third-party privacy risk assessments, vendor due diligence, and joint data controller/processor arrangements.
Oversee the management and escalation of personal data breaches, ensuring technical risk evaluation, root-cause investigation, statutory documentation, and timely regulatory notifications
Data Governance & Records
Maintain oversight of the Bank's Records of Processing Activities (ROPA).
Support data inventory and data-flow mapping across critical business processes.
Monitor data retention and disposal requirements.
Coordinate periodic review of data classification and handling requirements.
Support implementation of appropriate controls over sensitive and confidential information.
Regulatory Compliance & Assurance
Monitor compliance against the Data Protection Act, Regulations and applicable ODPC guidance.
Coordinate responses to ODPC information requests, inspections, complaints and regulatory reviews.
Support regulatory examinations and remediation programs.
Conduct periodic thematic reviews of data protection controls.
Maintain regulatory evidence and compliance attestations.
Awareness & Capacity Building
Develop and coordinate annual data protection awareness programmes.
Deliver targeted training for high-privacy risk functions including:
Digital Banking
Credit
Operations
Marketing
HR
IT
Procurement
Customer Service
Fraud
AML/KYC
Promote a privacy-conscious culture across the Bank.
Maintain training completion and certification records.
Regulatory Liaison & External Representation
Serve as the primary point of contact for Data Protection Authorities (ODPC), managing regulatory inquiries, statutory registration renewals, compliance audits, inspections, and mandatory notifications.
Serve as the primary escalation point for data subjects, overseeing the handling of Data Subject Access Requests (DSARs) and ensuring they are resolved accurately within statutory timelines.
Reporting & Governance
Prepare periodic reports covering for example:
Data protection compliance status
Open privacy risks
DPIAs completed/outstanding
Data subject requests
Data breaches/incidents
Third-party privacy risks
Regulatory matters
Policy exceptions
RCSA/control testing results
Remediation status
Key privacy KRIs
KNOWLEDGE, SKILLS & EXPERIENCE
Bachelor's degree in Law, Information Technology, Data Science, Risk Management, Compliance, Business, Finance or related discipline.
Professional qualification in data protection/privacy, risk, compliance, audit, information security or related field.
5 - 8 years' experience, preferably within banking, financial services, fintech or another highly regulated environment.
Practical knowledge of the Kenyan Data Protection Act and Regulations.
Professional Certificates
CIPM / CIPP / CDPO / equivalent privacy qualification (e.g. Certified Data Privacy Solutions Engineer (CDPSE), Certified Information Privacy Profession(CIPP)
CAMS, CISA, CISM, ISO 27001, ISO 31000 or related qualification.
Desirable
Experience with ODPC regulatory engagements.
Experience in data governance, privacy risk assessments, DPIAs and third-party risk.
Active membership or affiliation with professional privacy and security organizations (e.g., IAPP, ISACA, ISC2).
Technical / Functional Skillset
Data protection & privacy regulatory knowledge - DPA, ODPC Regulations & Guidelines
Privacy risk management, DPIAs and Privacy-by-Design
Data governance, ROPA, data mapping and retention
Data breach/incident management and regulatory reporting
Third-party/data processor risk management
RCSA, control testing, KRIs and compliance monitoring
Policy development, regulatory interpretation and assurance
Strong understanding of banking, digital, technology and customer-data environments
Data protection awareness and training
Behavioral Competencies
Behavioral Competencies
High integrity, confidentiality and ethical judgment
Strong attention to detail
Analytical and risk-based thinking
Independent challenge and professional skepticism
Strong stakeholder engagement and influencing skills
Clear written and verbal communication
Ability to manage sensitive/confidential matters
Proactive and solution-oriented
Organized, disciplined and delivery-focused
Ability to translate regulatory requirements into practical business controls
The job holder will support the Bank's Data Protection Office in establishing, implementing, monitoring and continuously improving the Bank's data protection and privacy framework, ensuring compliance with the Data Protection Act, 2019, applicable Data Protection Regulations, ODPC guidance and relevant CBK requirements, while embedding privacy-by-design and responsible data management across the Bank. The role will provide second-line oversight and assurance over privacy risks arising from customer, employee, supplier, digital, technology and third-party data processing activities.
The ODPC's mandate includes regulating processing of personal data, protecting data subjects' privacy and overseeing compliance with the Data Protection Act.
KEY RESPONSIBILITIES AND ACTIVITIES
Data Protection Governance
Act as the Bank's appointed Data Protection Officer in accordance with Section 24 of the Kenya Data Protection Act 2019, ODPC Guidance Notes on DPOs, and relevant Section 25 Principles of Data Protection, performing the role independently and without conflict of interest.
Support implementation and continuous enhancement of the Bank's Data Protection and Privacy Framework. Maintain the Bank's data protection governance structure, policies, standards, procedures and guidelines. Maintain a regulatory obligations register covering the Data Protection Act, Regulations, ODPC guidance and applicable banking requirements with specific ODPC guidance on DPIAs, DPO responsibilities, consent, cross-border transfers and data-sharing,
Coordinate periodic review of data protection policies and procedures.
Provide data protection input into Board, Board Risk Committee and Management reporting. Maintain appropriate evidence of compliance and regulatory readiness.
Design and maintain data protection policies, governance frameworks, operational controls, reporting mechanisms, and annual data protection compliance plans.
Work closely with Legal, Compliance, Risk, IT Security, ICT, Product Development, and Internal Audit functions including other business functions while maintaining the functional independence of the DPO role.
Serve as the operational secretariat and primary execution officer working alongside Data Protection Committee risk champions across business units to drive consistent compliance.
Data Protection Risk Management
Maintain the Bank's Data Protection Risk Register and monitor emerging privacy risks.
Coordinate data protection risk assessments across business units.
Support integration of privacy risks into the Bank's RCSA, operational risk, technology risk, third-party risk and enterprise risk frameworks.
Define and monitor data protection KRIs and thresholds.
Escalate material privacy risks, breaches and control weaknesses to the DPO and relevant governance committees.
Track remediation actions and ensure closure within approved timelines.
Data Protection Impact Assessments
Coordinate and review Data Protection Impact Assessments (DPIAs) for high-risk processing activities.
Provide privacy input into new products, digital channels, systems, AI/analytics initiatives, outsourcing and major projects.
Embed Privacy by Design and Default within product and technology development processes.
Review proposed changes to processing purposes, data fields, retention periods and data-sharing arrangements.
Data Subject Rights
Establish and monitor processes for handling data subject requests.
Oversee requests relating to access, rectification, objection, restriction, erasure and other applicable data subject rights.
Monitor response timelines and maintain appropriate records.
Coordinate with key business units such as, Legal, Compliance, Operations, IT and business units where requests require cross-functional intervention.
Emerging Tech & Privacy by Design
Provide expert privacy guidance on AI systems, predictive analytics, automated decision-making, behavioural profiling, fraud prevention engines, biometric data, cloud migrations, and other emerging banking technologies.
Embed Privacy by Design and Privacy by Default throughout product development life cycles, system implementation, process engineering, and third-party API integrations.
Review and advise on records of processing activities (RoPA), DFM's Data Retention & Disposal schedule privacy notices across digital/branch channels, consent management, and legal bases for processing under Section 25 principles.
Data Breach & Incident Management
Support the Bank's personal data breach management and notification framework.
Coordinate investigation and assessment of privacy incidents with Information Security, Cybersecurity, Legal, Compliance and relevant business units.
Assess regulatory notification requirements and escalation thresholds.
Maintain a central register of data protection incidents and lessons learned.
Ensure corrective actions arising from privacy incidents are tracked to closure.
Third-Party & Outsourcing Privacy Risk
Review data protection aspects of third-party arrangements, outsourcing, cloud services and technology partnerships.
Support due diligence and ongoing monitoring of data processors.
Review data processing agreements and privacy clauses in conjunction with Legal and Procurement.
Monitor cross-border transfers and related safeguards.
Maintain oversight of processor compliance and contractual obligations.
Privacy Incident & Breach Management - Direct data protection incident response protocols, overseeing breach triage, root-cause assessments, containment strategies, and statutory notifications to the ODPC and affected data subjects within regulatory timelines.
Provide independent oversight and challenge regarding third-party privacy risk assessments, vendor due diligence, and joint data controller/processor arrangements.
Oversee the management and escalation of personal data breaches, ensuring technical risk evaluation, root-cause investigation, statutory documentation, and timely regulatory notifications
Data Governance & Records
Maintain oversight of the Bank's Records of Processing Activities (ROPA).
Support data inventory and data-flow mapping across critical business processes.
Monitor data retention and disposal requirements.
Coordinate periodic review of data classification and handling requirements.
Support implementation of appropriate controls over sensitive and confidential information.
Regulatory Compliance & Assurance
Monitor compliance against the Data Protection Act, Regulations and applicable ODPC guidance.
Coordinate responses to ODPC information requests, inspections, complaints and regulatory reviews.
Support regulatory examinations and remediation programs.
Conduct periodic thematic reviews of data protection controls.
Maintain regulatory evidence and compliance attestations.
Awareness & Capacity Building
Develop and coordinate annual data protection awareness programmes.
Deliver targeted training for high-privacy risk functions including:
Digital Banking
Credit
Operations
Marketing
HR
IT
Procurement
Customer Service
Fraud
AML/KYC
Promote a privacy-conscious culture across the Bank.
Maintain training completion and certification records.
Regulatory Liaison & External Representation
Serve as the primary point of contact for Data Protection Authorities (ODPC), managing regulatory inquiries, statutory registration renewals, compliance audits, inspections, and mandatory notifications.
Serve as the primary escalation point for data subjects, overseeing the handling of Data Subject Access Requests (DSARs) and ensuring they are resolved accurately within statutory timelines.
Reporting & Governance
Prepare periodic reports covering for example:
Data protection compliance status
Open privacy risks
DPIAs completed/outstanding
Data subject requests
Data breaches/incidents
Third-party privacy risks
Regulatory matters
Policy exceptions
RCSA/control testing results
Remediation status
Key privacy KRIs
KNOWLEDGE, SKILLS & EXPERIENCE
Bachelor's degree in Law, Information Technology, Data Science, Risk Management, Compliance, Business, Finance or related discipline.
Professional qualification in data protection/privacy, risk, compliance, audit, information security or related field.
5 - 8 years' experience, preferably within banking, financial services, fintech or another highly regulated environment.
Practical knowledge of the Kenyan Data Protection Act and Regulations.
Professional Certificates
CIPM / CIPP / CDPO / equivalent privacy qualification (e.g. Certified Data Privacy Solutions Engineer (CDPSE), Certified Information Privacy Profession(CIPP)
CAMS, CISA, CISM, ISO 27001, ISO 31000 or related qualification.
Desirable
Experience with ODPC regulatory engagements.
Experience in data governance, privacy risk assessments, DPIAs and third-party risk.
Active membership or affiliation with professional privacy and security organizations (e.g., IAPP, ISACA, ISC2).
Technical / Functional Skillset
Data protection & privacy regulatory knowledge - DPA, ODPC Regulations & Guidelines
Privacy risk management, DPIAs and Privacy-by-Design
Data governance, ROPA, data mapping and retention
Data breach/incident management and regulatory reporting
Third-party/data processor risk management
RCSA, control testing, KRIs and compliance monitoring
Policy development, regulatory interpretation and assurance
Strong understanding of banking, digital, technology and customer-data environments
Data protection awareness and training
Behavioral Competencies
Behavioral Competencies
High integrity, confidentiality and ethical judgment
Strong attention to detail
Analytical and risk-based thinking
Independent challenge and professional skepticism
Strong stakeholder engagement and influencing skills
Clear written and verbal communication
Ability to manage sensitive/confidential matters
Proactive and solution-oriented
Organized, disciplined and delivery-focused
Ability to translate regulatory requirements into practical business controls