Data Protection Officer

Singtel; Kuala Lumpur; Sur place; Confidential; Plein temps

Résumé du poste

Singtel is launching a new Shared Services Centre in Kuala Lumpur. The Sudong Data Protection Officer (DPO) will provide independent oversight, governance, and monitoring of PDPA compliance for Sudong and the GBS. You will collaborate with Singtel’s Group Privacy Offices to safeguard personal data processed by GBS.

The role includes overseeing DPIAs, breach management, and regulatory engagement, with a focus on privacy by design and risk mitigation across the organisation in Malaysia.

Qualifications

• Bachelor's degree in Law, Information Technology, Information Security, Risk Management, Compliance, Business Administration, or related field.
• Professional privacy/security/compliance certifications preferred (CIPP, CIPM, CISSP, CISM).

Responsabilités

• Provide independent oversight and governance of PDPA compliance for Sudong and GBS.
• Coordinate with Singtel Group DPO and Privacy Offices on privacy matters.
• Develop and maintain privacy policies, procedures, and DPIA processes.
• Advise management on privacy requirements and risks; monitor regulatory changes.
• Oversee data breach management and DPIAs; ensure timely responses and escalation.

Connaissances

Privacy governance

Stakeholder management

English proficiency

Bahasa Malaysia

Formation

Bachelor's degree in Law or IT or related

Description du poste

Be a part of something BIG!

Say HELLO to BIG Possibilities with Singtel GBS KL (Sudong MY Sdn Bhd)! Singtel is Asia's leading communications technology group, our presence spans across 21 countries in Asia, Australia, and Africa. We thrive on innovation, digital transformation, and harnessing next-generation technology to create a more sustainable and digital future. Now, we are bringing this energy to Kuala Lumpur with the launch of our brand-new Shared Services Centre!

Reporting to the GBS KL Site Lead, the Sudong Data Protection Officer (DPO) is responsible for providing independent oversight, governance, and monitoring of Sudong's compliance with the Malaysia Personal Data Protection Act 2010 (PDPA) and other applicable data protection and privacy requirements.

The DPO serves as the focal point for data protection matters within Sudong, ensuring that personal data is processed in accordance with legal, regulatory, and organisational requirements. The DPO operates independently in overseeing Sudong's privacy compliance and will work closely with the Singtel Group DPO and other Group Privacy Offices on matters relating to the personal data of Singtel and other Group entities.

In addition, the DPO oversees Sudong's compliance with its data protection obligations when Global Business Services (GBS) processes personal data on behalf of Singtel and other Group entities, ensuring appropriate governance, policies, controls, and risk management measures are in place to safeguard personal data and support regulatory compliance.

Make An Impact By

• Privacy Governance & Compliance
• Oversee and monitor Sudong's compliance with MY PDPA and applicable privacy requirements.
• Develop, maintain and roll out privacy policies, procedures and guidance across GBS.
• Advise Sudong management and business functions on privacy requirements and risks.
• Monitor regulatory developments and recommend updates to policies, processes and controls.
• Escalate material privacy risks and compliance gaps to Sudong management.
• Data Protection Impact Assessments (DPIA)
• Establish and manage the DPIA process for Sudong.
• Advise and support business functions in conducting DPIAs where required.
• Review new projects, systems and processing activities for privacy risks.
• Recommend appropriate measures to mitigate identified privacy risks.
• Promote Privacy by Design across GBS.
• Personal Data Breach Management
• Establish and oversee Sudong's personal data breach management process.
• Coordinate the assessment, investigation and management of privacy incidents.
• Maintain Sudong's Personal Data Breach Register.
• Coordinate notifications to the Malaysia Personal Data Protection Commissioner and affected individuals where required.
• Promptly escalation incidents involving personal data processed on behalf of Singtel or other Group entities to the relevant DPO/Privacy Office.
• Monitor corrective and preventive actions arising from incidents.
• Data Subject Rights
• Oversee requests relating to Sudong-owned personal data, including access, correction, withdrawal of consent and other applicable rights.
• Ensure requests are handled in accordance with MY PDPA requirements and prescribed timelines.
• Third-Party Privacy Risk
• Conduct or oversee privacy assessments for vendors handling Sudong personal data.
• Ensure appropriate privacy requirements and contractual safeguards are incorporated into vendor arrangements.
• Monitor significant third-party privacy risks and follow up on remediation.
• Compliance Monitoring
• Conduct periodic privacy compliance reviews across GBS.
• Monitor adherence to MY PDPA, internal policies and privacy controls.
• Identify compliance gaps and recommend corrective actions.
• Track remediation and report significant issues to Sudong management.
• Training & Awareness
• Develop and deliver MY PDPA training for GBS staff.
• Establish privacy onboarding and refresher training requirements.
• Promote privacy awareness through eLearning, newsletters, posters, screensavers and other awareness activities.
• Provide practical guidance to staff on the appropriate handling of personal data.
• GBS Data Processor Oversight
• Where GBS processes personal data on behalf of Singtel or other Group entities, the Sudong DPO will:
• Monitor Sudong's compliance with its Data Processor obligations.
• Ensure applicable privacy, security, retention and incident reporting requirements are implemented within GBS.
• Coordinate with the relevant Group DPO/Privacy Office where required.
• Support DPIAs, compliance reviews, investigations and assurance activities relating to GBS processing.
• Ensure privacy incidents involving Group data are promptly escalated to the relevant Data Controller.
• Regulatory Engagement
• Act as Sudong's key contact for the Malaysia Personal Data Protection Commissioner on privacy matters.
• Support regulatory enquiries, investigations and compliance activities.
• Ensure required DPO information and regulatory records are maintained and updated.

Qualifications

• Bachelor's degree in Law, Information Technology, Information Security, Risk Management, Compliance, Business Administration, or a related discipline.
• Professional certifications in data privacy, information security, risk, or compliance are preferred, such as:
• • Certified Information Privacy Professional (CIPP/A, CIPP/E or equivalent)
  • Certified Information Privacy Manager (CIPM)
  • Certified Information Systems Security Professional (CISSP)
  • Certified Information Security Manager (CISM)
  • Other relevant privacy, governance, risk, or compliance certifications.

Experience & Knowledge

• Strong working knowledge of the Malaysia Personal Data Protection Act 2010 (PDPA) and other applicable data protection and privacy requirements.
• Relevant experience in data privacy, compliance, risk management, legal, information security, governance, or a related field.
• Experience or knowledge in conducting Data Protection Impact Assessments (DPIAs), managing data breaches, performing privacy compliance reviews, and assessing third-party privacy risks.
• Practical understanding of privacy governance frameworks, data lifecycle management, and privacy-by-design principles.
• Experience working in a shared services, global business services, multinational, or regulated environment is an advantage.

Competencies

• Ability to maintain sufficient independence, authority, and autonomy to effectively discharge the responsibilities of the DPO role.
• Direct access to Sudong senior management to provide independent advice and elevate privacy matters where necessary.
• Ability to independently identify, assess, raise, and elevate privacy risks, compliance concerns, and recommendations.
• Strong stakeholder management, influencing, and communication skills, with the ability to engage effectively across all levels of the organisation.
• Ability to work collaboratively across Human Resources, Information Technology, Operations, Procurement, Security, Risk, Legal, and other GBS functions.
• Proficiency in both Bahasa Malaysia and English, with strong verbal and written communication skills.
• Ability to balance regulatory compliance requirements with business objectives while maintaining an independent oversight role.

Regulatory & Independence Requirements

• Meet all applicable Malaysian regulatory requirements relating to residency, accessibility, and contactability for an appointed DPO.
• Avoid holding responsibilities or decision-making authority that could create an actual, potential, or perceived conflict of interest with the independent oversight responsibilities of the DPO.
• Be empowered to provide objective advice, challenge practices where necessary, and report privacy risks directly to senior management without undue influence.