Data Protection Officer
AI job insight
Sidian Bank is hiring a Data Protection Officer in Nairobi to establish, implement and monitor the bank's data protection and privacy framework in line with the Kenya Data Protection Act, 2019 and ODPC guidance. The role provides second-line oversight over privacy risks and serves as the appointed DPO per Section 24 of the Act.
- Permanent role at Sidian Bank serving as the appointed Data Protection Officer under Section 24 of the Kenya Data Protection Act 2019.
- Owns the bank's data protection framework, policies, regulatory obligations register and annual compliance plan.
- Partners with Legal, Compliance, Risk, IT Security, ICT, Product Development and Internal Audit while maintaining DPO independence.
Similar jobs
More roles you may want to review before you leave.AI summary
Sidian Bank is hiring a Data Protection Officer in Nairobi to establish, implement and monitor the bank's data protection and privacy framework in line with the Kenya Data Protection Act, 2019 and ODPC guidance. The role provides second-line oversight over privacy risks and serves as the appointed DPO per Section 24 of the Act.
- Permanent role at Sidian Bank serving as the appointed Data Protection Officer under Section 24 of the Kenya Data Protection Act 2019.
- Owns the bank's data protection framework, policies, regulatory obligations register and annual compliance plan.
- Partners with Legal, Compliance, Risk, IT Security, ICT, Product Development and Internal Audit while maintaining DPO independence.
- Requires a Bachelor's degree and 5+ years of relevant experience.
AI job guide
Use this guide to check salary signals, requirements, documents, application steps and safety before you apply.
AI salary guide
Not enough public dataNot enough public salary data is available for this exact role. Before applying, prepare to ask about gross pay, benefits, contract length, probation period, transport and any allowances.
Can you qualify for this role?
- Required5+ years of relevant experienceThe job post includes a minimum experience signal.
- RequiredEducation or certification mentioned in the postThe captured text mentions education, a diploma, certificate, or licence.
- PreferredPractical evidence in security, call_center, internshipThe tags and summary point to skills connected with this role.
- RequiredAvailability to work in NairobiThe vacancy is associated with this location.
- UnclearComfort with the Full Time contract termsConfirm hours, duration, probation and benefits at the original source.
Documents to prepare
- Likely requiredUpdated CV
- Role specificCover letter or short employer message
- OptionalProfessional references
- Role specificAcademic or professional certificates
- VerifyID or passport only after verifying the employer
Application tips for this job
- Place your strongest Data Protection Officer evidence in the first half of your CV.
- In your cover letter or employer message, connect your experience to Sidian Bank and the role in Nairobi.
- Add concrete examples related to security, call_center, internship, ideally with measurable outcomes or clear responsibilities.
- Follow the instructions from Opened Career Kenya; avoid sending documents to unofficial contacts or copied links.
- Confirm the deadline, interview location and employer contact before sharing personal documents.
- Prepare a polite question about pay, benefits and contract terms for later interview stages.
Source and safety check
- Opened Career Kenya
- Original source link available
- Application method is clear
- Deadline not specified
- No major risk signal was detected in the captured text.
Never pay for interviews, shortlisting, medical checks, uniforms, or job placement. Confirm every application at the original source before sharing personal documents. Report suspicious listing.
Interview preparation
- What experience makes you a strong fit for this Data Protection Officer role in security, call_center?
- How have you handled responsibilities similar to those in this job post?
- Are you available to work in Nairobi under the listed contract or schedule?
- Prepare examples with clear responsibilities, tools used and measurable outcomes.
- Review the source and research Sidian Bank before the interview.
Ask what the first priorities will be in the role and how success will be measured.
Similar jobs to consider
Use AI to apply better
After confirming the original source, use Career Assistant to check role fit, tailor your CV and prepare a cover letter or employer message.
Original source description
October 12, 2026
Nairobi
,
Kenya
Expiration date: December 11, 2026
5+ Years
Gender: Both
Qualifications
Bachelor Degree
Job Description
Job Purpose
The job holder will support the Bank’s Data Protection Office in establishing, implementing, monitoring and continuously improving the Bank’s data protection and privacy framework, ensuring compliance with the Data Protection Act, 2019, applicable Data Protection Regulations, ODPC guidance and relevant CBK requirements, while embedding privacy-by-design and responsible data management across the Bank. The role will provide second-line oversight and assurance over privacy risks arising from customer, employee, supplier, digital, technology and third-party data processing activities.
The ODPC’s mandate includes regulating processing of personal data, protecting data subjects’ privacy and overseeing compliance with the Data Protection Act.
KEY RESPONSIBILITIES AND ACTIVITIES
Data Protection Governance
Act as the Bank’s appointed Data Protection Officer in accordance with Section 24 of the Kenya Data Protection Act 2019, ODPC Guidance Notes on DPOs, and relevant Section 25 Principles of Data Protection, performing the role independently and without conflict of interest.
Support implementation and continuous enhancement of the Bank’s Data Protection and Privacy Framework. Maintain the Bank’s data protection governance structure, policies, standards, procedures and guidelines. Maintain a regulatory obligations register covering the Data Protection Act, Regulations, ODPC guidance and applicable banking requirements with specific ODPC guidance on DPIAs, DPO responsibilities, consent, cross-border transfers and data-sharing,
Coordinate periodic review of data protection policies and procedures.
Provide data protection input into Board, Board Risk Committee and Management reporting. Maintain appropriate evidence of compliance and regulatory readiness.
Design and maintain data protection policies, governance frameworks, operational controls, reporting mechanisms, and annual data protection compliance plans.
Work closely with Legal, Compliance, Risk, IT Security, ICT, Product Development, and Internal Audit functions including other business functions while maintaining the functional independence of the DPO role.
Serve as the operational secretariat and primary execution officer working alongside Data Protection Committee risk champions across business units to drive consistent compliance.
Data Protection Risk Management
Maintain the Bank’s Data Protection Risk Register and monitor emerging privacy risks.
Coordinate data protection risk assessments across business units.
Support integration of privacy risks into the Bank’s RCSA, operational risk, technology risk, third-party risk and enterprise risk frameworks.
Define and monitor data protection KRIs and thresholds.
Escalate material privacy risks, breaches and control weaknesses to the DPO and relevant governance committees.
Track remediation actions and ensure closure within approved timelines.
Data Protection Impact Assessments
Coordinate and review Data Protection Impact Assessments (DPIAs) for high-risk processing activities.
Provide privacy input into new products, digital channels, systems, AI/analytics initiatives, outsourcing and major projects.
Embed Privacy by Design and Default within product and technology development processes.
Review proposed changes to processing purposes, data fields, retention periods and data-sharing arrangements.
Data Subject Rights
Establish and monitor processes for handling data subject requests.
Oversee requests relating to access, rectification, objection, restriction, erasure and other applicable data subject rights.
Monitor response timelines and maintain appropriate records.
Coordinate with key business units such as, Legal, Compliance, Operations, IT and business units where requests require cross-functional intervention.
Emerging Tech & Privacy by Design
Provide expert privacy guidance on AI systems, predictive analytics, automated decision-making, behavioural profiling, fraud prevention engines, biometric data, cloud migrations, and other emerging banking technologies.
Embed Privacy by Design and Privacy by Default throughout product development life cycles, system implementation, process engineering, and third-party API integrations.
Review and advise on records of processing activities (RoPA), DFM’s Data Retention & Disposal schedule privacy notices across digital/branch channels, consent management, and legal bases for processing under Section 25 principles.
Data Breach & Incident Management
Support the Bank’s personal data breach management and notification framework.
Coordinate investigation and assessment of privacy incidents with Information Security, Cybersecurity, Legal, Compliance and relevant business units.
Assess regulatory notification requirements and escalation thresholds.
Maintain a central register of data protection incidents and lessons learned.
Ensure corrective actions arising from privacy incidents are tracked to closure.
Third-Party & Outsourcing Privacy Risk
Review data protection aspects of third-party arrangements, outsourcing, cloud services and technology partnerships.
Support due diligence and ongoing monitoring of data processors.
Review data processing agreements and privacy clauses in conjunction with Legal and Procurement.
Monitor cross-border transfers and related safeguards.
Maintain oversight of processor compliance and contractual obligations.
Privacy Incident & Breach Management – Direct data protection incident response protocols, overseeing breach triage, root-cause assessments, containment strategies, and statutory notifications to the ODPC and affected data subjects within regulatory timelines.
Provide independent oversight and challenge regarding third-party privacy risk assessments, vendor due diligence, and joint data controller/processor arrangements.
Oversee the management and escalation of personal data breaches, ensuring technical risk evaluation, root-cause investigation, statutory documentation, and timely regulatory notifications
Data Governance & Records
Maintain oversight of the Bank’s Records of Processing Activities (ROPA).
Support data inventory and data-flow mapping across critical business processes.
Monitor data retention and disposal requirements.
Coordinate periodic review of data classification and handling requirements.
Support implementation of appropriate controls over sensitive and confidential information.
Regulatory Compliance & Assurance
Monitor compliance against the Data Protection Act, Regulations and applicable ODPC guidance.
Coordinate responses to ODPC information requests, inspections, complaints and regulatory reviews.
Support regulatory examinations and remediation programs.
Conduct periodic thematic reviews of data protection controls.
Maintain regulatory evidence and compliance attestations.
Awareness & Capacity Building
Develop and coordinate annual data protection awareness programmes.
Deliver targeted training for high-privacy risk functions including:
Digital Banking
Credit
Operations
Marketing
HR
IT
Procurement
Customer Service
Fraud
AML/KYC
Promote a privacy-conscious culture across the Bank.
Maintain training completion and certification records.
Regulatory Liaison & External Representation
Serve as the primary point of contact for Data Protection Authorities (ODPC), managing regulatory inquiries, statutory registration renewals, compliance audits, inspections, and mandatory notifications.
Serve as the primary escalation point for data subjects, overseeing the handling of Data Subject Access Requests (DSARs) and ensuring they are resolved accurately within statutory timelines.
Reporting & Governance
Prepare periodic reports covering for example:
Data protection compliance status
Open privacy risks
DPIAs completed/outstanding
Data subject requests
Data breaches/incidents
Third-party privacy risks
Regulatory matters
Policy exceptions
RCSA/control testing results
Remediation status
Key privacy KRIs
KNOWLEDGE, SKILLS & EXPERIENCE
Bachelor’s degree in Law, Information Technology, Data Science, Risk Management, Compliance, Business, Finance or related discipline.
Professional qualification in data protection/privacy, risk, compliance, audit, information security or related field.
5–8 years’ experience, preferably within banking, financial services, fintech or another highly regulated environment.
Practical knowledge of the Kenyan Data Protection Act and Regulations.
Professional Certificates
CIPM / CIPP / CDPO / equivalent privacy qualification (e.g. Certified Data Privacy Solutions Engineer (CDPSE), Certified Information Privacy Profession(CIPP)
CAMS, CISA, CISM, ISO 27001, ISO 31000 or related qualification.
Desirable
Experience with ODPC regulatory engagements.
Experience in data governance, privacy risk assessments, DPIAs and third-party risk.
Active membership or affiliation with professional privacy and security organizations (e.g., IAPP, ISACA, ISC2).
Technical / Functional Skillset
Data protection & privacy regulatory knowledge – DPA, ODPC Regulations & Guidelines
Privacy risk management, DPIAs and Privacy-by-Design
Data governance, ROPA, data mapping and retention
Data breach/incident management and regulatory reporting
Third-party/data processor risk management
RCSA, control testing, KRIs and compliance monitoring
Policy development, regulatory interpretation and assurance
Strong understanding of banking, digital, technology and customer-data environments
Data protection awareness and training
Behavioral Competencies
Behavioral Competencies
High integrity, confidentiality and ethical judgment
Strong attention to detail
Analytical and risk-based thinking
Independent challenge and professional skepticism
Strong stakeholder engagement and influencing skills
Clear written and verbal communication
Ability to manage sensitive/confidential matters
Proactive and solution-oriented
Organized, disciplined and delivery-focused
Ability to translate regulatory requirements into practical business controls