Data Privacy Counsel

Privy; Indonesia; On-site; IDR 320,000,000 - 520,000,000; Full time

Job summary

Privy is seeking a privacy-focused counsel to monitor and drive compliance with Indonesia's Personal Data Protection laws across products, tech platforms, and services.

The role requires 2+ years in corporate/tech law and data privacy, with strong regulatory knowledge, lifecycle management, and cross-functional collaboration across Legal, Product, and Security teams. English and Bahasa Indonesia proficiency is essential.

Qualifications

• Minimum 2 years of experience in corporate and technology law, data privacy, data protection, compliance, or related fields.
• Strong understanding of data protection laws, incl. Indonesia UU PDP No.27/2022 and implementing regulations.
• Knowledge of personal data lifecycle management (collection, use, storage, retention, access, deletion).
• Proficiency in privacy frameworks, risk assessment, and evaluating privacy implications of products and processes.
• Strong written and verbal communication in Bahasa Indonesia and English.
• Ability to collaborate with Product, Technology, Information Security, Legal, Compliance, and Business teams.
• Certifications in privacy/data protection/information security preferred (e.g., CIPP, CIPM, CIPT, ISO/IEC 27701, AIGP).
• Experience in tech/SaaS/digital services or regulated industries; familiarity with AI governance privacy considerations.

Responsibilities

• Monitor and assess Privy's compliance with Personal Data Protection laws and regulations, including UU PDP and PSrE obligations.
• Develop, implement, and review Personal Data protection policies and governance frameworks, including AI governance aspects.
• Conduct Data Protection Impact Assessments (DPIAs) for products, technologies, and AI-enabled solutions; maintain RoPA and related docs.
• Perform privacy compliance reviews and internal audits; identify risks and remediation aligned with UU PDP and ISO/IEC 27701.

Skills

Data privacy

Privacy regulations

Risk assessment

Communication

Cross-functional collaboration

Education

CIPP/CIPM/CIPT

ISO/IEC 27701

AIGP

Tools

DPIA tooling

RoPA maintenance

Job description

• Minimum 2 years of relevant experience in corporate and technology law, data privacy, data protection, compliance, or related fields.
• Strong understanding of data protection laws and regulations, particularly Indonesia's Personal Data Protection Law (UU PDP No. 27 Tahun 2022), including relevant implementing regulations, international privacy standards, and industry best practices.
• Strong knowledge of personal data lifecycle management, including data collection, use, sharing, storage, retention, access, and deletion.
• Proficiency in privacy frameworks, data protection practices, and risk assessment, with the ability to evaluate privacy implications of products, technologies, and business processes.
• Strong analytical, problem-solving, and communication skills, with the ability to explain complex privacy and regulatory requirements to both technical and non-technical stakeholders.
• Strong written and verbal communication skills in Bahasa Indonesia and English.
• Ability to collaborate effectively with cross-functional stakeholders, including Product, Technology, Information Security, Legal, Compliance, and Business teams.
• Professional certifications in privacy, data protection, information security, or AI governance (e.g., CIPP, CIPM, CIPT, ISO/IEC 27701, or AIGP) are preferred.
• Experience in technology, SaaS, digital services, or regulated industries, as well as familiarity with AI governance and emerging technology-related privacy considerations, is a plus.

Job Descriptions :

• Monitor and assess Privy's compliance with applicable Personal Data Protection laws and regulations, particularly UU PDP and its implementing regulations, including relevant PSrE obligations related to Personal Data protection.
• Develop, implement, and periodically review Personal Data protection policies, procedures, and governance frameworks, including privacy aspects of AI governance, and promote Privacy by Design and Privacy by Default across Privy Group's business processes, products, and technologies.
• Conduct Data Protection Impact Assessments (DPIAs) for new and existing products, technologies, systems, business processes, and AI-enabled solutions, and maintain the Record of Processing Activities (RoPA) and other relevant privacy compliance documentation.
• Conduct privacy compliance reviews and internal audits to evaluate the effectiveness of Personal Data protection measures, identify privacy risks and compliance gaps, and provide recommendations for remediation in alignment with UU PDP and ISO/IEC 27701.