Data Protection Officer - Yubi MENA

Role context

Strategy and leadership

• Develop the regional data protection strategy and scalable privacy framework for new products and GCC markets.
• Embed privacy-by-design and privacy-by-default reviews in product development and material processing changes.
• Maintain a privacy risk register and KRIs/KPIs covering compliance, DPIAs, rights requests, incidents, retention, third parties, transfers, and remediation.
• Liaise with regional regulators and data subjects; escalate complaints and complex rights requests.
• Lead personal-data incident response, regulatory assessment and notification, data-subject communications, and remediation.
• Coordinate with global privacy counterparts while applying regional requirements.

Privacy programme

• Set data retention, archival, deletion, and anonymisation requirements across systems, backups, analytics, and third parties.
• Maintain privacy policies, procedures, standards, RoPA, data-flow maps, data inventories, and processing-role assessments.
• Conduct or oversee DPIAs for products, changes, credit scoring, AI/ML, profiling, high-risk processing, and integrations.
• Review privacy clauses and transfer mechanisms in vendor, lender, partner, and data-sharing agreements.
• Own data-subject rights processes, including intake, verification, assessment, fulfilment, exemptions, and audit trails.
• Maintain regulatory applicability and data-transfer/data-residency registers and monitor regional legal developments.

Third parties, AI, and governance

• Lead privacy due diligence for fintech partners, cloud and hosting providers, KYC/AML vendors, credit bureaus, and other processors or data-sharing partners.
• Assess cross-border access, transfers, and residency requirements and establish safeguards and approvals.
• Advise on privacy in AI/ML credit scoring, underwriting, profiling, training, inference, and external AI services.
• Advise on transparency, explainability, data minimisation, purpose limitation, bias mitigation, human oversight, and rights in automated lending decisions.
• Brief leadership and risk/audit committees on privacy metrics, findings, incidents, remediation, and emerging AI governance expectations.

Training and programme management

• Deliver tailored privacy training for employees, including credit, sales, and technology teams handling sensitive data.
• Manage external counsel and privacy consultants and coordinate regulatory examinations, audits, and information requests.
• Plan privacy programme resources and provide input to the annual privacy budget.
• Maintain current knowledge of applicable MENA privacy laws and relevant international frameworks such as GDPR.

Education and experience

• Degree in law, information technology, business, or a related discipline.
• At least 8 years in data protection or privacy, including ownership or operation of a programme in a regulated financial services environment.
• Working knowledge of UAE PDPL and DIFC Data Protection Law; ADGM and KSA PDPL knowledge and implementation experience are desirable.
• Experience with breach response, regulatory notification, investigations, examinations, and regulator engagement.
• Experience advising on privacy for KYC/AML, credit and financial data, data sharing, retention, and vendor agreements in lending, banking, or credit.
• DPO or equivalent senior privacy leadership experience is strongly preferred; AI/ML governance exposure is also strongly preferred.

Skills and qualifications

• Professional data protection certification such as IAPP CIPP/E, CIPM, CIPT, or equivalent is strongly preferred.
• Strong understanding of financial-services data flows, information security, and data architecture.
• Translate privacy law into practical advice and embed controls in product, engineering, and credit processes.
• Exercise independent judgment, handle confidential matters, and engage stakeholders across legal, compliance, technology, security, product, credit, and leadership.
• Excellent written and verbal English is required; Arabic is a plus.