Data Protection Analyst (1-year Contract)

VISTRA; Kuala Lumpur; On-site; MYR 60,000 - 90,000; Full time

Job summary

VISTRA in Malaysia seeks a Data Protection Analyst to support the privacy programme across regulatory monitoring, DLP, PIAs, incident response, data subject rights, and governance. You will work with cross-functional teams to implement controls and maintain documentation.

The role requires strong knowledge of Malaysian and EU data protection laws, excellent communication in English and Malay, and the ability to coordinate with multiple stakeholders in a multicultural environment.

Qualifications

• Strong knowledge of Malaysian and EU data protection laws.
• Proven experience in data protection and privacy compliance.
• Excellent communication, interpersonal, and organizational skills.
• Proficiency in English and Malay is essential.

Responsibilities

• Support regulatory monitoring and PDPA compliance.
• Administer the Data Loss Prevention programme and report trends.
• Assist privacy impact assessments (PIAs) for new projects.
• Coordinate data subject rights requests and responses.
• Maintain privacy records and provide routine governance reporting.
• Assist incident response and breach management.
• Support vendor/privacy reviews with stakeholders.

Skills

English skills

Malay skills

Cross-functional

Multicultural teamwork

Job description

Job Description: Data Protection Analyst - Malaysia

Job Summary:

The Data Protection Analyst supports the delivery and continuous improvement of the organisation’s data protection and privacy programme in Malaysia. The role provides operational support across regulatory monitoring, data loss prevention, privacy assessments, incident response, data subject rights, third-party reviews, training and record-keeping, escalating complex or high-risk matters to the Group Privacy Officer.

Key Responsibilities:

Regulatory Compliance:

Support compliance with applicable Malaysian data protection requirements, including the Personal Data Protection Act (PDPA), and other relevant data protection laws and internal standards.

Monitor legal and regulatory developments, summarise relevant changes and support updates to guidance, controls and programme documentation.

Act as the organisation’s registered Data Protection Officer in Malaysia, supporting the fulfilment of applicable statutory requirements and escalating material or complex matters to the Group Privacy Officer.

Administer the Data Loss Prevention (DLP) programme, including monitoring alerts, coordinating investigations and supporting the implementation and ongoing improvement of DLP controls. Work with relevant stakeholders to identify and address data loss risks, maintain programme documentation and provide regular reporting on trends, incidents and remedial actions.

Policy Development and Implementation:

Support the drafting, implementation and maintenance of data protection policies, procedures, guidance and supporting materials.

Coordinate periodic reviews and help ensure documentation reflects applicable legal requirements, internal standards and agreed practices.

Data Privacy Impact Assessments (PIAs):

Support privacy impact assessments for new or changed projects, systems and processes by gathering information, identifying initial privacy risks and documenting proposed controls.

Coordinate with relevant stakeholders to track agreed actions and accelerate complex, high-risk or unresolved matters for further review.

Training and Awareness:

Assist with the preparation and delivery of data protection training, guidance and employee communications.

Support awareness campaigns and respond to routine privacy queries, referring specialist or sensitive matters to the appropriate privacy lead.

Incident Response and Breach Management:

Support the triage, investigation and documentation of suspected personal data incidents and breaches in accordance with the incident response process.

Gather relevant information, track remedial actions and assist with the preparation of internal assessments and regulatory or client notifications where required.

Vendor and Third-Party Risk Management:

Support privacy reviews of vendors and other third parties by gathering due diligence information, identifying potential gaps and recording agreed actions.

Work with Legal, Procurement, Information Security and business stakeholders to support the inclusion and review of appropriate data protection terms and controls.

Data Subject Rights and Requests:

Coordinate data subject rights requests, including access, correction and deletion requests, by verifying requirements, gathering information, tracking deadlines and escalating complex matters for review.

Record-Keeping and Reporting:

Maintain accurate and up-to-date privacy records, trackers and supporting documentation, including records of processing activities, assessments, incidents, requests and training activity.

Prepare routine management information and support the collation of information for internal governance, audit, client and regulatory reporting.

Qualifications and Skills:

• Strong knowledge of Malaysian and EU data protection laws, and related regulations.
• Proven experience in data protection and privacy compliance.
• Excellent communication, interpersonal, and organizational skills.
• Ability to collaborate effectively within a multicultural and cross-functional team environment.
• Proficiency in English and Malay is essential.