Data Protection Officer - Internal Audit

Al Khayyat Investments (AKI); Dubai; On-site; AED 90,000 - 130,000; Full time

Job summary

Al Khayyat Investments is seeking a Data Protection Officer to drive privacy strategy and program governance across the Group. The role demands strong knowledge of data protection regulations and IT audit practices.

The candidate will oversee DPIAs, data classification, vendor due diligence, and incident response, collaborating with IT, Internal Audit, and business teams to safeguard data across ERP, CRM, HR, and cloud platforms.

Qualifications

• Bachelor’s degree in IT, CS, Information Security, or related field.
• 2-3 years of experience in IT internal audit, information security audit, technology compliance, or consulting.
• Hands-on audit experience is essential.
• Knowledge of ISO 27001, COBIT, NIST CSF, UAE PDPL, ADHICS, KSA PDPL/SDAIA, Oman PDPL, GDPR, ISO/IEC 27701, or NIST Privacy Framework.
• Experience with enterprise systems such as SAP, Oracle, Microsoft Dynamics, cloud platforms, or SaaS applications.
• Strong report-writing, communication, and stakeholder management skills.

Responsibilities

• Lead data protection and privacy activities across group operations.
• Ensure alignment with data protection policies and regulations.
• Support data governance activities including data classification, labelling, and Records of Processing Activities.
• Conduct risk assessments, DPIAs, transfer impact assessments, and maintain privacy risk register.
• Perform audits covering IT General Controls, information security, cyber security, data processing activities, systems, vendors, and third parties.
• Review vendor arrangements, data processing agreements, and privacy due diligence requirements.
• Support personal data breach response including investigation and regulatory notification.
• Deliver data protection awareness and training across the organisation.
• Collaborate with Internal Audit, IT, and business teams to assess controls across ERP, CRM, HR, e-commerce, SaaS platforms, and emerging technologies.

Skills

IT audit

information security

technology compliance

data protection

privacy governance

report writing

stakeholder management

IT controls

risk assessment

Education

Bachelor's degree in Information Technology, Computer Science, Information Security, or a related field

Tools

SAP

Oracle

Microsoft Dynamics

cloud platforms

SaaS applications

Job description

Al Khayyat Investments is looking for a Data Protection Officer to lead data protection and privacy activities across the Group.

This role is suitable for a technically strong professional with experience in IT audit, information security, technology compliance, data protection, and privacy governance.

Key Responsibilities

• Lead data protection and privacy activities across group operations and support functions.
• Ensure alignment with data protection policies, data classification standards, and applicable regulations.
• Support data governance activities, including data classification, labelling, and Records of Processing Activities.
• Conduct risk assessments, DPIAs, transfer impact assessments, and maintain the privacy risk register.
• Perform audits covering IT General Controls, information security, cyber security, data processing activities, systems, vendors, and third parties.
• Review vendor arrangements, data processing agreements, and privacy due diligence requirements.
• Support personal data breach response, including investigation, impact assessment, and regulatory notification.
• Deliver data protection awareness and training across the organisation.
• Work closely with Internal Audit, IT, and business teams to assess controls across ERP, CRM, HR, e-commerce, SaaS platforms, and emerging technologies.

Requirements

• Bachelor’s degree in Information Technology, Computer Science, Information Security, or a related field.
• 2-3 years of experience in IT internal audit, information security audit, technology compliance, or consulting.
• Hands-on audit experience is essential.
• Knowledge of ISO 27001, COBIT, NIST CSF, UAE PDPL, ADHICS, KSA PDPL/SDAIA, Oman PDPL, GDPR, ISO/IEC 27701, or NIST Privacy Framework.
• Experience with enterprise systems such as SAP, Oracle, Microsoft Dynamics, cloud platforms, or SaaS applications.
• Strong report-writing, communication, and stakeholder management skills.

Preferred

• CIA, CISA, ISO 27701 Lead Implementer/Auditor, or equivalent certification.
• Experience in a large, diversified, or multi-entity organisation.
• Familiarity with GRC platforms and AI governance concepts.