Data Privacy Expert - 4-5-Month Engagement

Role overview

Experience and language

• Requires 3–5+ years of relevant data protection or data privacy experience.
• Requires fluency in written and spoken Arabic and English.
• Requires knowledge of data privacy principles including data minimization, purpose limitation, lawful basis, and accountability.
• Requires experience maintaining data protection policies, procedures, and standards, conducting DPIAs, and embedding privacy-by-design.
• Requires understanding of PDPL, NDMO, and SDAIA standards, plus experience with privacy risk assessments and audits.
• Requires familiarity with data classification and personal-data controls and with privacy management tools.

Other qualifications

• Privacy certifications such as CIPM, CIPP/E, or equivalent, and CDMP/DAMA are preferred.
• A bachelor's degree in Law, Business, Computer Science, Information Management, Cybersecurity, or a related field is listed.
• The role calls for analytical reasoning, problem-solving, communication, consulting, collaboration, project management, attention to detail, and thorough documentation.

Compliance, assessments, and records

• Perform compliance assessments and internal audits against PDPL, its Implementing Regulations, NDMO/SDAIA standards, and internal policies; document findings and track corrective actions.
• Review processing activities, identify non-compliance or data-handling risks, escalate significant issues, assist with violation investigations, and maintain compliance records.
• Conduct privacy risk assessments and maintain a risk register with assigned owners and mitigation plans.
• Conduct and document DPIAs for new or modified processing and incorporate findings into risk and data-protection strategies.
• Maintain the Record of Processing Activities, personal data inventories, and data-flow maps as processing changes, including data monetization initiatives.

Privacy operations

• Help maintain privacy notices, transparency statements, and consent mechanisms that reflect actual processing purposes and legal bases.
• Support handling of data subject access, correction, deletion, portability, and objection requests within regulatory timelines.
• Assist with breach detection, recording, and timely notification under the breach process and PDPL requirements; document evidence and lessons learned.

Third parties, awareness, and advisory

• Support privacy reviews of vendors and data processing agreements, including subprocessors and cross-border transfer controls.
• Participate in prospective supplier privacy risk assessments and ongoing processor and vendor compliance monitoring.
• Guide and train employees on personal data protection responsibilities and support Privacy Champions across business units.
• Monitor PDPL, NDMO, and SDAIA developments, assist with SDAIA/NDMO coordination, and integrate privacy-by-design and data minimization into projects and system changes.