Senior Personal Data Protection

indodax - indonesia digital asset exchange; Indonesia; On-site; IDR 120,000,000 - 240,000,000; Full time

Job summary

INDODAX - Indonesia Digital Asset Exchange seeks a privacy officer to ensure data protection compliance across the business. You will map data flows, support DPIAs/PIAs, draft notices and DPAs, and work with Legal, Security, and Product teams to implement mitigations.

The role requires hands-on experience with RoPA, privacy documentation, and familiarity with UU PDP 2022. Financial services experience is a plus in a fintech environment.

Qualifications

• Bachelor's degree in Law, IT, Information Systems, Cybersecurity, or related field.
• Minimum 3 years of privacy experience.
• Strong knowledge of Indonesian PDP regulations (UU PDP 2022).
• Experience with RoPA and data mapping.
• DPIA/PIA experience and privacy risk mitigation.
• Privacy documentation experience (DPA, notices, consent).
• Understanding of data subject rights and breach management.
• Ability to work with cross-functional teams.
• ISO 27001/27701 preferred.
• Fintech/digital assets exposure preferred.

Responsibilities

• Perform privacy compliance assessments and provide actionable recommendations.
• Maintain privacy notices and DPAs and related documents.
• Map data flows and perform RoPA to identify risks.
• Coordinate with Legal, Compliance, IT, Security, Product, HR, and Marketing teams.
• Monitor regulatory changes and implement privacy controls.

Skills

Privacy by design

Data mapping

RoPA

DPIA/PIA

Regulatory compliance

Cross-functional collaboration

UU PDP familiarity

Education

Bachelor's degree in Law/IT/Info Systems/Cybersecurity

Job description

Requirements:

• Bachelor's degree in Law, Information Technology, Information Systems, Cybersecurity, or other relevant fields.


• Minimum 3 years of relevant professional experience in Personal Data Protection, Data Privacy, Privacy Compliance, or related areas.


• Strong working knowledge of Indonesian Personal Data Protection regulations, particularly Law No. 27 of 2022 on Personal Data Protection (UU PDP), including practical implementation in business processes.


• Hands-on experience in data mapping and/or Record of Processing Activities (RoPA), including identifying personal data, processing purposes, data flows, access, retention, and data sharing.


• Experience in conducting or supporting Data Protection Impact Assessments (DPIA) / Privacy Impact Assessments (PIA) and identifying appropriate privacy risk mitigation.


• Experience in preparing and/or reviewing privacy-related documentation, including Privacy Notices, consent mechanisms, Data Processing Agreements (DPA), data sharing provisions, and internal privacy procedures.


• Good understanding of Data Subject Rights, personal data breach management, data retention, and third-party data processing.


• Able to independently handle routine privacy compliance matters, conduct initial privacy assessments, and provide practical recommendations with minimal supervision.


• Able to work effectively with cross-functional stakeholders, particularly Legal, Compliance, Information Security, Technology, Product, HR, and Marketing.


• Good understanding of information security and data governance principles. Familiarity with ISO/IEC 27001 and/or ISO/IEC 27701 is preferred.


• Experience in financial services, fintech, digital assets, payments, technology, e-commerce, or other regulated industries is preferred.


• Professional certification in data privacy/data protection is an advantage but not mandatory.