Data Protection Officer

About the job

We are looking for an experienced Data Protection Officer to lead and oversee the company’s data privacy and protection compliance initiatives. The role will ensure adherence to the Data Privacy Act of 2012, its Implementing Rules and Regulations (IRR), National Privacy Commission (NPC) issuances, and other applicable laws and regulations.

The successful candidate will drive the development and continuous improvement of data protection policies, manage privacy risks and incidents, and provide expert guidance to management and business units on data privacy matters.

Key Responsibilities

• Lead the preparation and submission of documents for the registration or renewal of MPT Group companies with the National Privacy Commission.
• Ensure compliance with the Data Privacy Act, its IRR, related NPC issuances, and other applicable laws and regulations.
• Develop, implement, and regularly review data protection policies, procedures, and guidelines.
• Assist in handling data subject requests concerning their rights, including access, correction, and deletion.
• Conduct regular training sessions and workshops to promote employee awareness and understanding of data protection principles.
• Conduct, provide guidance on, and coordinate data privacy impact assessments (DPIAs) and regular risk assessments for new projects, processes, or technologies to identify and mitigate potential privacy risks.
• Act as the primary point of contact among data subjects, the company, and the National Privacy Commission.
• Ensure timely and accurate reporting to the NPC and other regulatory authorities, including data breach notifications and annual security incident reports.
• Serve as the primary point of contact for data breaches and privacy-related incidents.
• Assist in the investigation, documentation, and resolution of privacy concerns, data breaches, and incidents, and implement corrective actions to prevent recurrence.
• Coordinate and lead the response strategy for data breaches and incidents, including notification of relevant authorities and affected individuals, as necessary.
• Advise the Chief Legal and Compliance Officer, senior management, and other departments on data protection and privacy matters.
• Coordinate with the Legal Department in reviewing contracts, data-sharing agreements, consent forms, privacy notices, data processing activities, and other data protection documents to ensure compliance with the Data Privacy Act.
• Monitor developments in data protection laws and best practices, providing timely advice and updates on evolving compliance requirements.
• Continuously assess and improve the company’s data protection framework in response to regulatory changes and technological advancements.
• Conduct regular audits of data processing activities to assess compliance, identify areas for improvement, and implement corrective actions where necessary.
• Prepare regular reports for the Chief Legal and Compliance Officer and management on data protection compliance, risks, and incidents.
• Maintain records of the company’s data processing activities.
• Coordinate with various departments on privacy-related incidents, concerns, and inquiries.

About you

• A Bachelor’s degree in a relevant field is required; a Law degree and admission to the Philippine Bar are preferred.
• At least 5 years of relevant experience in data privacy, data protection, or a related compliance function.
• Strong knowledge of the Philippine Data Privacy Act of 2012, its IRR, NPC issuances, and applicable data protection regulations.
• Experience in implementing data privacy policies, conducting privacy risk assessments, managing data breaches, and ensuring regulatory compliance.
• Excellent analytical, problem-solving, communication, and stakeholder management skills.
• Ability to advise senior management and collaborate effectively with Legal, IT, and other business units.
• Experience in a leadership or supervisory capacity is an advantage.