Data Privacy Manager

National Commercial Bank; As Sudiyah; On-site; OMR 60,000 - 90,000; Full time

Job summary

National Commercial Bank in Oman seeks a senior Data Privacy professional to manage and operationalize its privacy program, ensuring day‑to‑day compliance with PDPL, SAMA, NDMO, and international standards.

You will support the Head of Data Privacy Office by driving privacy initiatives, managing risks, handling DSARs, incidents, and embedding privacy controls across business, technology, and third‑party activities.

Qualifications

• 5-8 years of experience in data privacy or related field.
• Experience operating privacy controls within a regulated/financial services environment.
• Strong knowledge of PDPL, SAMA regulations, and privacy operational controls.
• Hands-on experience with DSARs, ROPA, DPIAs, and privacy incident handling.

Responsibilities

• Manage and operationalize the bank's data privacy program and implement approved privacy frameworks, controls, and processes.
• Support privacy initiatives, manage privacy risks, and handle data subject rights and incidents.
• Embed privacy controls across business, technology, and third-party activities.
• Assist in alignment of privacy controls with information security, data classification, and data governance.

Skills

Stakeholder management

Documentation

Regulatory knowledge

Education

Bachelor's degree

Privacy/security/compliance certifications (advantage)

Job description

To manage and operationalize the Bank’s Data Privacy program by implementing approved privacy frameworks, controls, and processes, ensuring day-to-day compliance with PDPL, SAMA, NDMO, and applicable international standards.

The role supports the Head of Data Privacy Office by executing privacy initiatives, managing privacy risks, handling data subject rights and incidents, and embedding privacy controls across business, technology, and third‑party activities.

Key Accountabilities

• Implement and operationalize approved data privacy policies, standards, procedures, and guidelines across the Bank.
• Ensure consistent execution of privacy controls by business units and technology teams.
• Monitor adherence to privacy requirements and escalate non‑compliance issues as required.
• Support alignment between privacy controls and information security, data classification, and data governance frameworks.

Regulatory Compliance & Operational Privacy

• Execute privacy compliance activities in line with PDPL, SAMA, and NDMO requirements.
• Monitor regulatory updates and support impact assessments and implementation actions.
• Support audits, regulatory reviews, and internal assessments related to data privacy.
• Maintain and update Records of Processing Activities (ROPA) and data inventories.

Data Subject Rights Management

• Manage and coordinate Data Subject Rights Requests (DSARs), including access, correction, deletion, and portability, in line with PDPL timelines.
• Coordinate with internal stakeholders to ensure accurate, complete, and timely responses.
• Maintain DSAR logs, evidence, and reporting metrics.

Privacy Risk, DPIAs & New Initiatives

• Conduct and support Privacy Impact Assessments (DPIAs) for new products, systems, vendors, and initiatives.
• Identify privacy risks and recommend mitigation controls.
• Support privacy‑by‑design implementation in digital, analytics, AI, and transformation initiatives.

Incident & Breach Handling

• Maintain the privacy incident register and ensure proper documentation.
• Support notification processes to regulators and affected individuals, as required.

Data Lifecycle & Retention

Qualifications, Experience, Skills & Competencies

Education:

• Bachelor's degree acceptable educational level accompanied by a strong banking experience.
• Relevant certifications (privacy, security, risk, or compliance) are an advantage.

Experience:

• 5-8 years of Experience in the Data Privacy or a related field
• Experience operating privacy controls within a regulated or financial services environment is preferred.
• Strong working knowledge of PDPL, SAMA regulations, and privacy operational controls.
• Hands‑on experience with DSARs, ROPA, DPIAs, and privacy incident handling.
• Understanding of data lifecycle management and data classification.
• Strong coordination, documentation, and stakeholder management skills.
• Ability to translate regulatory requirements into practical controls.