Data Protection Officer, Principal

AIA Malaysia; Kuala Lumpur; On-site; MYR 180,000 - 280,000; Full time

Job summary

AIA Malaysia is seeking a Data Protection Officer to lead the company’s privacy program and ensure compliance with Act 709 and global standards. You’ll liaise with regulators and act as the main contact for data subjects, guiding privacy risk management across business units.

Responsibilities include DPIAs, data breach management, vendor due diligence, and embedding privacy into processes. Candidates should have 7–10 years in compliance/security and relevant certifications.

Qualifications

• Bachelor’s degree in law, business administration, information security, or related field.
• Certifications: CIPP/A, CIPM, CDPO, ISACA/IAPP or similar.

Responsibilities

• Data privacy & compliance oversight across the company.
• Draft, review and maintain local data protection policies and guidelines.
• Implement a risk-based privacy program and embed privacy-by-design.
• Coordinate cross-functional teams to embed privacy requirements.
• Maintain a centralized record of processing activities and privacy risk register.
• Review DPIAs and conduct periodic monitoring, audits, and policy reviews.
• Coordinate with IT, Legal, HR, Operations for privacy controls.

Skills

Data privacy

GDPR

Privacy by design

Data subject rights

Third-party governance

Stakeholder management

Privacy culture

Cybersecurity basics

Education

Bachelor’s degree in law / business / information security

CIPP/A

CIPM

CDPO

ISACA / IAPP accreditation

Tools

Certification programs

Job description

At AIA we've started an exciting movement to create a healthier, more sustainable future for everyone.

As pioneering innovators for over 100 years, we’re now transforming our organisation to be faster, simpler and more connected. Because we want to be even better equipped to develop digital solutions and experiences that help more people live Healthier, Longer, Better Lives.

To get there, we need people with tech/digital/analytics expertise and passion to help develop positive, sustainable change through digitally enhanced experiences that will impact the lives of millions of people and create a healthier future for everyone.

If you believe in developing a better tomorrow, read on.

About The Role

The Data Protection Officer (DPO) leads and oversees the Company’s data protection and privacy program to ensure compliance with the Personal Data Protection Act (Act 709) and other relevant data protection laws. This role supports the organization and its entities in managing personal data processing risks, ensuring regulatory compliance, and promoting a culture of privacy. The DPO also acts as the main liaison for regulatory authorities and a key point of contact for data subjects.

Roles And Responsibilities

• Data Privacy & Compliance Oversight
• Draft, review and maintain on an ongoing basis, local policies and guidelines to ensure compliance with both the AIA Group requirements and local regulatory requirements.
• Implement a risk-based data protection program across the Company and embed privacy-by-design in Company’s processing operations.
• Work with relevant departments/functions to build up and/or implement controls and provide quality and solutions-focused advice on data protection and privacy risk and control issues relevant to the business units for informed decision-making.
• Maintain and oversee a centralized record of personal data processing activities.
• Maintain a privacy risk register aligned to Enterprise Risk Management taxonomy.
• Review and approve Data Privacy Impact Assessments (DPIAs).
• Conduct periodic monitoring and review on the Company as part of control testing, including internal audits, gap assessments, and policy reviews.
• Coordinate cross-functional teams (e.g., IT, Legal, HR, Operations) to embed privacy requirements into business processes and systems.
• Where appropriate or upon request, provide guidance or share expertise with the DPOs of other entities.
• Data Subject Rights Management
• Act as the main point of contact for customers, policyholders, employees, agents, and other individuals regarding their personal data and privacy rights.
• Coordinate and manage escalated responses to data access requests, correction requests, withdrawal of consent, and privacy-related complaints.
• Ensure the handling of data subject rights is aligned with legal and regulatory standards.
• Personal Data Incident / Breach Management
• Establish and maintain data breach response plans, and conduct investigation, documentation, and reporting of breaches within prescribed timelines.
• Third-Party & Outsourcing Governance
• Review data privacy/protection due diligence for third-party vendors.
• Work with Legal and business units to support the facilitation of Data Processing Agreements by incorporating relevant clauses from Act 709, specifying MCIPD disclosure limitations, defining incident-reporting triggers, and establishing the right to audit.
• Regulatory Engagement & Reporting
• Act as the primary liaison with the Commissioner and other relevant regulatory bodies.
• Prepare and submit required documentation, reports, and notifications in relation to personal data processing and data breaches.
• Keep the organization informed of regulatory developments, enforcement trends, and compliance obligations.
• Training, Awareness and Culture
• Work with business unit heads to embed training on data protection and privacy risk subject for employees, sales intermediaries and or third-party service providers. Monitor implementation of an effective training curriculum.
• Conduct data protection and privacy training and communicating obligations to embed a culture of risks and controls within AIA Bhd.

Minimum Job Requirements

• Bachelor’s degree in law, Business Administration, Information Security, or a related field.
• Preferred certifications: Certified Information Privacy Professional (CIPP/A)
• Certified Information Privacy Manager (CIPM)
• Certified Data Protection Officer (CDPO)
• ISACA, IAPP, or similar accreditation

Experience

• Minimum 7 - 10 years of experience in compliance, legal, or information security roles.
• At least 5 years in a data protection role, preferably in the insurance or financial services sector.
• Familiarity with managing group-level or multi-entity privacy governance.

Skills & Attributes

• Deep understanding of Act 709 and global data protection standards (e.g., GDPR).
• Strong grasp of insurance operations, data flows, and third-party engagements.
• Knowledge of information technology and cybersecurity principles.
• High level of integrity, independence, and professional ethics.
• Strong communication, stakeholder management, and problem-solving skills.
• Ability to build awareness and promote a privacy culture throughout the organization.

Build a career with us as we help our customers and the community live Healthier, Longer, Better Lives.

You must provide all requested information, including Personal Data, to be considered for this career opportunity. Failure to provide such information may influence the processing and outcome of your application. You are responsible for ensuring that the information you submit is accurate and up-to-date.