Data Privacy Senior Manager

Role : Senior Manager Data Privacy Governance
Location : Abu Dhabi

Role Purpose:

To lead the data privacy governance pillar of ADIBs Data Privacy Function within the Group Information Security Department (GISD) by designing implementing and continuously improving the Banks privacy governance framework policies standard operating procedures records of processing privacy risk management and regulatory reporting.

The role ensures that ADIB its subsidiaries and branches process personal data in compliance with the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) CBUAE Consumer Protection Regulation & Standards and other applicable local and international data protection requirements and provides assurance to Senior Management Board Committees and regulators on the effectiveness of the privacy control environment.

Key Accountabilities of the role

Privacy Governance Framework

• Own draft and maintain the Data Privacy Framework Policy Standards SOPs and supporting templates including version control approval workflows and periodic review cycles.

• Maintain the regulatory obligation register and mapping of PDPL CBUAE and other applicable requirements to internal controls and ensure the supporting evidence library is complete and audit-ready.

Records of Processing and Data Mapping

• Oversee the Record of Processing Activities (RoPA) program end to end Business Unit onboarding completeness and quality review escalation and periodic refresh ensuring consistency across all ADIB jurisdictions.

• Govern the privacy management platform (OneTrust) as the single source of truth for RoPA assessments consent and incident records.

Privacy Risk Assessments and Assurance

• Govern the privacy risk management process including risk identification assessment mitigation and recording of residual risk in the Banks GRC tool (Archer) in line with the Operational Risk Management framework.

• Lead the governance of Data Protection Impact Assessments (DPIA) and International Data Transfer Assessments including review challenge and sign-off of business submissions.

• Define monitor and report privacy KPIs and KRIs and prepare reporting packs for Senior Management the CISO Management Risk Committee and Board-level committees.

Data Subject Rights Consent and Transparency

• Oversee governance of data subject rights handling consent management and privacy notices across customer employee candidate and vendor channels (web mobile app branches contact centre and forms).

• Ensure privacy notices and consent mechanisms are accurate tailored by data subject type and available in English and Arabic.

Third Parties and Contracts

• Govern privacy due diligence over third parties in coordination with TPRM and Procurement and ensure Data Processing Agreements and transfer safeguards are in place before onboarding.

• Assess controller / processor / joint controller roles and advise on the corresponding contractual obligations.

Incident Management and Regulatory Engagement

• Support the DPO in the governance of personal data breach management including root cause review lessons learned and regulatory notification decisions.

• Act as a key point of contact for internal audit external auditors consultants and regulators on privacy governance matters and coordinate management responses and remediation plans.

Awareness Culture and Team Leadership

• Design and deliver Group-wide and role-specific privacy awareness and training programs.

• Provide guidance coaching and technical direction to privacy analysts and Business Unit privacy champions and deputize for the DPO where required.
  

Specialist Skills / Technical Knowledge Required for this role:

• Expert knowledge of the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) and its Executive Regulations.

• Strong working knowledge of CBUAE requirements applicable to Licensed Financial Institutions including the Consumer Protection Regulation and Standards (data protection consent and market conduct provisions).

• Knowledge of additional data protection frameworks is considered an advantage in particular DIFC Data Protection Law No. 5 of 2020 ADGM Data Protection Regulations EU GDPR and UK GDPR.

• Proven ability to design and operationalize privacy governance artefacts: policies SOPs RoPA DPIA transfer assessments RACI matrices KPI / KRI frameworks and control libraries.

• Practical experience with privacy management platforms (OneTrust) and GRC tools (Archer).

• Understanding of information security principles data lifecycle management and IT / banking systems landscape.

• Excellent English drafting skills with the ability to translate regulatory requirements into clear operational procedures for business users; Arabic is an advantage.

• Professional certification preferred: CIPP/E CIPM CIPT CDPO CISA CISM or equivalent.

• Strong stakeholder management influencing and presentation skills at Senior Management level.

• Minimum of 8 years of relevant experience in data protection privacy governance regulatory compliance or risk management of which at least 3 years in a senior or managerial capacity.

• Experience gained within banking financial services or another highly regulated industry preferably in the UAE or wider GCC market.

• Demonstrated track record of building or running an enterprise privacy programme covering RoPA DPIA data subject rights breach management and third-party governance.

• Experience of direct engagement with regulators internal audit external auditors and external consultants on privacy and data protection matters.

• Bachelors degree in Law Information Security Risk Management Information Technology or a related discipline; a postgraduate qualification is an advantage.