Data Protection Officer - Internal Audit

Al Khayyat Investments (AKI); Dubai; On-site; AED 250,000 - 400,000; Full time

Job summary

Al Khayyat Investments is seeking a Data Protection Officer to lead data protection and privacy activities across the Group. The role requires a technically strong professional with experience in IT audit, information security, technology compliance, data protection, and privacy governance.

As Data Protection Officer, you will conduct DPIAs, risk assessments, and oversee data classification while ensuring compliance with UAE PDPL, GDPR, and related standards.

Qualifications

• Bachelor’s degree in IT, CS, or info security required.
• 2–3 years in IT internal audit, information security audit, or technology compliance.
• Knowledge of ISO 27001, NIST CSF, GDPR, UAE PDPL and related frameworks.
• Experience with ERP or cloud/SaaS platforms (SAP, Oracle, Microsoft Dynamics).
• Strong report writing and stakeholder management skills.

Responsibilities

• Lead data protection and privacy activities across group operations.
• Ensure alignment with data protection policies and regulations.
• Support data governance, classification, labelling, and processing records.
• Conduct risk assessments, DPIAs, transfer impact assessments, and privacy risk register.
• Perform IT general controls and information security audits across vendors.
• Review DPAs, data processing agreements, and privacy due diligence.
• Support data breach response, including investigation and regulatory notification.
• Deliver data protection awareness and training across the organisation.
• Collaborate with Internal Audit, IT, and business teams on controls.

Skills

IT audit experience

Information security

Privacy governance

Stakeholder management

Education

Bachelor's degree in Information Technology / Computer Science

Tools

SAP

Oracle

Microsoft Dynamics

Cloud platforms

SaaS applications

Job description

Al Khayyat Investments is looking for a Data Protection Officer to lead data protection and privacy activities across the Group.

This role is suitable for a technically strong professional with experience in IT audit, information security, technology compliance, data protection, and privacy governance.

Key Responsibilities

• Lead data protection and privacy activities across group operations and support functions.
• Ensure alignment with data protection policies, data classification standards, and applicable regulations.
• Support data governance activities, including data classification, labelling, and Records of Processing Activities.
• Conduct risk assessments, DPIAs, transfer impact assessments, and maintain the privacy risk register.
• Perform audits covering IT General Controls, information security, cyber security, data processing activities, systems, vendors, and third parties.
• Review vendor arrangements, data processing agreements, and privacy due diligence requirements.
• Support personal data breach response, including investigation, impact assessment, and regulatory notification.
• Deliver data protection awareness and training across the organisation.
• Work closely with Internal Audit, IT, and business teams to assess controls across ERP, CRM, HR, e-commerce, SaaS platforms, and emerging technologies.

Requirements

• Bachelor’s degree in Information Technology, Computer Science, Information Security, or a related field.
• 2–3 years of experience in IT internal audit, information security audit, technology compliance, or consulting.
• Knowledge of ISO 27001, COBIT, NIST CSF, UAE PDPL, ADHICS, KSA PDPL/SDAIA, Oman PDPL, GDPR, ISO/IEC 27701, or NIST Privacy Framework.
• Experience with enterprise systems such as SAP, Oracle, Microsoft Dynamics, cloud platforms, or SaaS applications.
• Strong report-writing, communication, and stakeholder management skills.

Preferred

• CIA, CISA, ISO 27701 Lead Implementer/Auditor, or equivalent certification.
• Experience in a large, diversified, or multi-entity organisation.
• Familiarity with GRC platforms and AI governance concepts.