Senior Manager, Data Privacy

PCCW Services Limited; Hong Kong; On-site; HKD 800,000 - 1,200,000; Full time

Job summary

PCCW Services Limited is seeking a Senior Manager, Data Privacy to lead the establishment and ongoing enhancement of the data privacy governance framework across the eMPF platform. The role provides first-line defense on privacy, data protection, and governance in collaboration with regulators, trustees, providers and internal teams.

You will oversee governance reviews, design privacy controls, conduct risk assessments, manage data classifications and retention, and coordinate incident

Qualifications

• 8+ years of relevant experience in data privacy, data governance, risk management, compliance, information security, or related disciplines.
• 2+ years in a leadership, managerial, or senior advisory capacity within financial services, pension administration or trustee, regulatory bodies, or large-scale technology-driven organizations.
• Demonstrated experience designing and implementing enterprise-wide privacy governance and compliance programmes.
• Proven track record managing interactions with regulators, auditors, and senior stakeholders.
• Experience in pension, financial services, public sector, or highly regulated environments is an advantage.

Responsibilities

• Review the data governance and management framework and update it as required
• Design, oversee and improve privacy management programme controls
• Review processes/procedures, ensure the data governance and management framework is followed, and assess adequacy of data privacy controls
• Conduct sample checking on data privacy controls to ensure they are effective
• Recommend how to strengthen data privacy controls
• Conduct review of the data privacy-related documents
• Perform data classifications based on data definitions in data dictionaries
• Review business justifications for data retention periods, and ensure data housekeeping is in place
• Conduct data privacy risk assessment and propose mitigations
• Perform privacy impact assessment on change requests and implement the required changes (e.g., whether the privacy policy and/or the personal information collection statement requirechanges)
• Support reporting and management of data privacy incidents, by preparing data breach incident report and drafting data breach notification form
• Incorporate lessons learned from data breach incident to enhance data privacy controls
• Collaborate with auditors to complete privacy impact assessment and privacy compliance audit, and ensure the findings and recommendations are implemented
• Assist in Privacy Commissioner's investigation and/or inspection (if applicable), and ensure the findings/recommendations/enforcement notice are implemented.
• Review and follow up complaints/reporting of infringement of personal data privacy rights (if any)
• Keep up to date on applicable regulatory requirements, assess and implement all changes needed for fulfilling the requirements
• Support development teams to design and implement data governance tools (e.g., master data management tool for data lineage and data quality)
• Propose agenda, prepare meeting materials, conduct meetings to engage data stakeholders, and follow up action items
• Design training plan, develop training materials, and deliver training to data stakeholders, and improve data privacy training based on the feedback from data stakeholder

Skills

Data privacy

Governance

Risk management

Compliance

Information security

Job description

Senior Manager, Data Privacy will serve as a team lead to establish, oversee, and continuously enhance the data privacy governance framework across the eMPF platform.The incumbent will provide the first-line-of-defense support on all matters relating to data privacy, data protection, and data governance.

The successful candidate will work closely with senior management, regulators, trustees, service providers, technology teams, and relevant internal stakeholders to ensure compliance with all applicable privacy laws, regulatory requirements, and industry best practices.

Your Role

• Review the data governance and management framework and update it as required
• Design, oversee and improve privacy management programme controls
• Review processes/procedures, ensure the data governance and management framework is followed, and assess adequacy of data privacy controls
• Conduct sample checking on data privacy controls to ensure they are effective
• Recommend how to strengthen data privacy controls
• Conduct review of the data privacy-related documents
• Perform data classifications based on data definitions in data dictionaries
• Review business justifications for data retention periods, and ensure data housekeeping is in place
• Conduct data privacy risk assessment and propose mitigations
• Perform privacy impact assessment on change requests and implement the required changes (e.g., whether the privacy policy and/or the personal information collection statement requirechanges)
• Support reporting and management of data privacy incidents, by preparing data breach incident report and drafting data breach notification form
• Incorporate lessons learned from data breach incident to enhance data privacy controls
• Collaborate with auditors to complete privacy impact assessment and privacy compliance audit, and ensure the findings and recommendations are implemented
• Assist in Privacy Commissioner's investigation and/or inspection (if applicable), and ensure the findings/recommendations/enforcement notice are implemented.
• Review and follow up complaints/reporting of infringement of personal data privacy rights (if any)
• Keep up to date on applicable regulatory requirements, assess and implement all changes needed for fulfilling the requirements
• Support development teams to design and implement data governance tools (e.g., master data management tool for data lineage and data quality)
• Propose agenda, prepare meeting materials, conduct meetings to engage data stakeholders, and follow up action items
• Design training plan, develop training materials, and deliver training to data stakeholders, and improve data privacy training based on the feedback from data stakeholder

To Succeed in the Role

• 8+ years of relevant experience in data privacy, data governance, risk management, compliance, information security, or related disciplines.
• 2+ years in a leadership, managerial, or senior advisory capacity within financial services, pension administration or trustee, regulatory bodies, or large-scale technology-driven organizations.
• Demonstrated experience designing and implementing enterprise-wide privacy governance and compliance programmes.
• Proven track record managing interactions with regulators, auditors, and senior stakeholders.
• Experience in pension, financial services, public sector, or highly regulated environments is an advantage.

Candidates with less experiences will be considered as Manager