Data Protection Officer - Counsel

OSL; Hong Kong; Vor Ort; HKD 900.000 - 1.500.000; Vollzeit

Zusammenfassung

OSL is seeking a senior Data Protection Officer & Legal Counsel to hold its statutory DPO appointments and lead privacy and AI governance across the group. The role sits in Global Legal, reports to the General Counsel, and covers multiple jurisdictions including the EU/EEA, UK, Australia, Singapore, Bermuda, the US and Brazil.

The ideal candidate will have built or scaled a privacy programme end-to-end and be credible with regulators, engineering teams and senior executives.

Qualifikationen

• Qualified lawyer with 8–10 years PQE, of which 4+ years substantively in data protection
• Strong knowledge of GDPR and related UK GDPR/Singapore PDPA/Bermuda PIPA/Australian Privacy Act
• Proven track record building or scaling a privacy programme end-to-end (RoPA, DPIA, retention, transfer assessments, DSAR)
• Hands-on experience drafting and negotiating DPAs, SCCs, and transfer documentation
• Experience managing live data breaches through regulator notification and closure
• Comfortable holding an independent statutory seat and collaborating with Compliance, Risk, IT, and Security
• Background in digital assets/payments a plus; CIPP/E and CIPM (or FIP) preferred

Aufgaben

• Hold the designated DPO/Privacy Officer seats for in-scope entities and act as the primary contact for authorities
• Own RoPA, retention schedules, cross-border transfer registers, and applicable legal regimes
• Advise Product, Engineering, Security and Risk on privacy-by-design and lead AI governance incl. model inventory and AI Act risk classification
• Draft and negotiate DPAs, SCCs, and outsourcing terms aligning with GDPR Art. 28, MiCAR Art. 73, and DORA Art. 30(3)
• Oversee incident and breach matrices and act as legal lead on live incidents
• Supervise DSAR operations and handle complex or regulator-escalated requests
• Deliver the group’s annual privacy and AI training programme

Kenntnisse

Data privacy governance

GDPR expertise

Regulatory liaison

Compliance leadership

Ausbildung

Law degree with PQE

Tools

DPAs & SCCs drafting

Jobbeschreibung

Job Summary:

We are seeking a senior Data Protection Officer & Legal Counsel to hold OSL's statutory DPO appointments across the group and lead its data protection, privacy and AI governance programme. The role sits in Global Legal, reports to the General Counsel, and covers the EU/EEA, UK, Australia, Singapore, Bermuda, the US and Brazil. The ideal candidate has built or scaled a privacy programme end to end, is comfortable holding an independent statutory seat, and is credible with regulators, engineering teams and senior executives alike.

Key Responsibilities:

• Hold the designated DPO / Privacy Officer seat for each in-scope entity and act as the single point of contact for supervisory authorities


• Own the group Data Registers / Record of Processing Activities (RoPA), retention and cross-border transfer registers, and the relevant laws and regulations


• Advise Product, Engineering, Security and Risks on privacy-by-design, and lead AI governance, including the model inventory and AI Act risk classification


• Draft and negotiate Data Protection Agreements (DPAs), Standard Contractual Clauses (SCCs) and outsourcing terms, aligning GDPR Art. 28, MiCAR Art. 73 and DORA Art. 30(3) obligations into one package


• Own the multi-jurisdiction incident and breach matrix and act as legal lead on live incidents


• Supervise data subject rights operations and personally handle complex or regulator-escalated requests


• Deliver the group's annual privacy and AI training programme

Requirements:

• Qualified lawyer with 8-10 years PQE, of which 4+ years substantively in data protection, ideally in-house


• Expert knowledge of the GDPR sufficient to satisfy Art. 37(5), plus working command of at least two of UK GDPR, Singapore PDPA, Bermuda PIPA or the Australian Privacy Act


• Track record of building or materially scaling a privacy programme end to end - RoPA, Data Protection Impact Assessment (DPIA) methodology, retention, transfer assessments, Data Subject Access Request (DSAR) workflow - not advisory work alone


• Hands-on experience drafting and negotiating DPAs, SCCs and transfer documentation


• Has taken a live personal data breach through to regulator notification and closure


• Comfortable holding an independent statutory seat, working alongside with Compliance, Risk, IT, MLRO and CISO


• Regulated digital asset, payments or financial services background preferred; CIPP/E and CIPM (or FIP) preferred; practical EU AI Act / FRIA experience an advantage

Vision & Mission

• OSL is the first SFC-licensed digital asset platform in Hong Kong and a PayFi innovator. Through stablecoin payments, cross-border settlement and global licensing, we are building the next-generation payments network. Stablecoins have become everyday money across emerging markets and are widely viewed as blockchain's "killer app," with industry focus shifting from token issuance to real-world consumer and enterprise payment adoption. The strongest growth lies in cross-border B2B payments, where providers embedding stablecoins into corporate settlement flows can capture significant volume and float. Long-term defensibility comes from regulatory licences, banking partners and cross-border corridors.


• OSL holds or has acquired licences in Hong Kong, Japan, Australia, Bermuda and Indonesia, and is expanding into Europe, Brazil, Southeast Asia and Africa through acquisitions and licence applications. With OSL Pay and StableX, we embed stablecoin settlement into bank accounts and card networks, support 150+ digital assets, and provide 24/7 fiat-stablecoin conversion. As a regulated pioneer with a startup mindset, we believe the future of payments will be driven by real adoption and scalable deployment, not technology narratives. We welcome builders who are passionate about crypto and payments to join us in shaping compliant, global payment infrastructure.