Data Protection Officer (DPO)
AI job insight
Bank of Africa Kenya Limited is seeking a Data Protection Officer to oversee compliance with data protection and privacy requirements. The role involves governance, data mapping, DPIAs, regulatory monitoring, and third-party data processing oversight in Nairobi.
- Leads the bank’s data protection and privacy framework
- Oversees data inventories, mapping, and DPIA processes
- Advises on regulatory changes and high-risk processing
Similar jobs
More roles you may want to review before you leave.AI summary
Bank of Africa Kenya Limited is seeking a Data Protection Officer to oversee compliance with data protection and privacy requirements. The role involves governance, data mapping, DPIAs, regulatory monitoring, and third-party data processing oversight in Nairobi.
- Leads the bank’s data protection and privacy framework
- Oversees data inventories, mapping, and DPIA processes
- Advises on regulatory changes and high-risk processing
- Reviews data-sharing, outsourcing, and third-party arrangements
- Requires a bachelor’s degree and two years of experience
AI job guide
Use this guide to check salary signals, requirements, documents, application steps and safety before you apply.
AI salary guide
Not enough public dataNot enough public salary data is available for this exact role. Before applying, prepare to ask about gross pay, benefits, contract length, probation period, transport and any allowances.
Can you qualify for this role?
- Required2+ years of relevant experienceThe job post includes a minimum experience signal.
- RequiredEducation or certification mentioned in the postThe captured text mentions education, a diploma, certificate, or licence.
- PreferredPractical evidence in security, internship, Data protection officerThe tags and summary point to skills connected with this role.
- RequiredAvailability to work in NairobiThe vacancy is associated with this location.
- UnclearComfort with the Other contract termsConfirm hours, duration, probation and benefits at the original source.
Documents to prepare
- Likely requiredUpdated CV
- Role specificCover letter or short employer message
- OptionalProfessional references
- Role specificAcademic or professional certificates
- VerifyID or passport only after verifying the employer
Application tips for this job
- Place your strongest Data Protection Officer (DPO) evidence in the first half of your CV.
- In your cover letter or employer message, connect your experience to Bank of Africa Kenya Limited and the role in Nairobi.
- Add concrete examples related to security, internship, Data protection officer, ideally with measurable outcomes or clear responsibilities.
- Follow the instructions from Opened Career Kenya; avoid sending documents to unofficial contacts or copied links.
- Confirm the deadline, interview location and employer contact before sharing personal documents.
- Prepare a polite question about pay, benefits and contract terms for later interview stages.
Source and safety check
- Opened Career Kenya
- Original source link available
- Application method is clear
- Deadline not specified
- No major risk signal was detected in the captured text.
Never pay for interviews, shortlisting, medical checks, uniforms, or job placement. Confirm every application at the original source before sharing personal documents. Report suspicious listing.
Interview preparation
- What experience makes you a strong fit for this Data Protection Officer (DPO) role in security, internship?
- How have you handled responsibilities similar to those in this job post?
- Are you available to work in Nairobi under the listed contract or schedule?
- Prepare examples with clear responsibilities, tools used and measurable outcomes.
- Review the source and research Bank of Africa Kenya Limited before the interview.
Ask what the first priorities will be in the role and how success will be measured.
Similar jobs to consider
Use AI to apply better
After confirming the original source, use Career Assistant to check role fit, tailor your CV and prepare a cover letter or employer message.
Original source description
November 3, 2026
Nairobi
,
Kenya
Expiration date: January 2, 2027
2 Years
Gender: Both
Qualifications
Bachelor Degree
Job Description
Job Purpose
To provide independent oversight, guidance and assurance on the Bank’s compliance with data protection and privacy requirements, while leading the development and continuous improvement of the Bank’s data protection framework. The role ensures lawful, transparent and secure management of personal data, promotes a strong culture of privacy and accountability, and supports the Bank’s strategic, digital transformation and regulatory objectives.
Responsibilities and Accountability;
Data Protection Governance and Framework
Establish, implement, maintain and continuously improve the Bank’s Data Protection and Privacy Framework, policies, standards, procedures and guidelines.
Provide oversight of the Bank’s implementation of data protection and privacy requirements across business and support functions.
Establish appropriate governance structures, accountability mechanisms and reporting arrangements to support effective data protection compliance within the Bank.
Monitor regulatory developments and advise the Bank on changes required to maintain compliance with applicable data protection laws and regulations.
Data Inventory and Mapping
Oversee the maintenance of an accurate inventory of the Bank’s personal data processing activities.
Coordinate periodic data inventory and mapping exercises across business and support functions.
Ensure appropriate records are maintained on personal data categories, data subjects, processing purposes, systems, recipients, retention periods and safeguards.
Data Protection Impact Assessments (DPIAs)
Establish and maintain the Bank’s DPIA process and methodology.
Advise business and project teams on processing activities requiring DPIAs.
Review and provide independent oversight of DPIAs for new products, projects, systems, processes and other high-risk processing activities.
Monitor implementation of agreed privacy risk mitigation measures and escalate material residual risks where appropriate.
Contracts, Data Sharing and Third-Party Processing
Review and provide data protection Advise on contracts, outsourcing arrangements, data-sharing agreements and third-party processing arrangements involving personal data.
Advise on appropriate data protection clauses, processor obligations, confidentiality requirements and security safeguards.
Provide guidance on third-party due diligence and monitor compliance with applicable data protection requirements in material processing and data-sharing arrangements.
Cross-Border Data Transfers
Provide guidance and oversight on the transfer of personal data outside Kenya.
Assess the data protection implications of cross-border processing and transfers involving Group, technology providers, cloud service providers and other third parties.
Advise on appropriate safeguards and regulatory requirements applicable to cross-border data transfers.
Maintain appropriate records of material cross-border data transfer arrangements.
Privacy by Design and Privacy by Default
Promote the integration of Privacy by Design and Privacy by Default principles into the Bank’s products, services, systems, processes and projects.
Provide privacy Advise during the design, development, procurement, implementation and significant modification of initiatives involving personal data.
Identify and advise on privacy risks arising from digital transformation, emerging technologies, analytics, automation and other data-driven initiatives.
Privacy Notices, Transparency and Lawful Processing
Review and advise on privacy notices, consent forms and customer/employee communications to ensure transparency and compliance with applicable data protection requirements.
Monitor compliance with lawful processing, consent, data minimization, purpose limitation, data accuracy and retention requirements.
Advise business and support functions on appropriate legal bases and transparency requirements throughout the personal data lifecycle.
Data Subject Rights Management
Coordinate and monitor responses to data subject requests, including requests for access, correction, objection, restriction, deletion/erasure, portability and other applicable rights.
Ensure requests are handled accurately and within applicable statutory and internal timelines.
Maintain the data subject rights register and monitor recurring issues and trends for appropriate remediation.
Monitoring and Assurance
Conduct periodic reviews and assessments to evaluate the effectiveness of the Bank’s data protection framework, policies, procedures and controls.
Identify and assess data protection control gaps, compliance exceptions and areas of heightened privacy risk.
Track remediation actions arising from monitoring reviews, DPIAs, incidents, audits and regulatory assessments, and follow up on timely closure.
Provide independent assurance and recommendations to management on the effectiveness of data protection controls and the Bank’s overall privacy compliance position.
Prepare periodic monitoring and assurance reports for Senior Management and relevant governance committees.
Training and Awareness
Develop and implement an annual data protection training and awareness Programme aligned to the Bank’s risk profile and regulatory requirements.
Develop targeted training for employees and functions involved in high-risk or sensitive personal data processing.
Promote awareness of employees’ responsibilities relating to the collection, use, storage, sharing, retention and disposal of personal data.
Monitor training completion and assess the effectiveness of data protection awareness initiatives.
Promote a strong culture of privacy, accountability and responsible handling of personal data across the Bank.
Incident Management
Establish and maintain the Bank’s personal data breach and privacy incident management framework.
Coordinate the investigation, assessment, documentation and monitoring of personal data breaches and privacy incidents.
Advise relevant stakeholders on regulatory notification and data subject communication requirements arising from qualifying breaches.
Coordinate, where applicable, regulatory notifications to the ODPC and communications to affected data subjects within prescribed timelines.
Maintain the personal data breach and privacy incident register and monitor corrective and preventive actions.
Identify systemic privacy weaknesses and recommend measures to prevent recurrence.
Regulatory and ODPC Engagement
Serve as the Bank’s primary contact and liaison with the Office of the Data Protection Commissioner (ODPC) and other relevant regulatory authorities on data protection matters.
Coordinate regulatory correspondence, information requests, consultations, inspections and other engagements relating to data protection.
advise management on regulatory findings, directives and required remediation actions.
Monitor the Bank’s fulfilment of data protection-related regulatory obligations and commitments.
Minimum Requirements;
Education
Bachelor’s degree in information technology, Risk Management, Business Administration, Law, or a related discipline.
Professional qualification
A recognized professional qualification or certification in Data Protection/Privacy, Information Security, Risk or Compliance.
Minimum 2 years’ professional experience in data protection, privacy, compliance, risk, information security or a related discipline in banking, financial services or another regulated industry.