Data Privacy Manager

Grant Thornton; Makati; On-site; PHP 900,000 - 1,300,000; Full time

Job summary

Grant Thornton Philippines is seeking a privacy program professional to design, implement, and govern the local privacy framework while aligning with GTA requirements. You will monitor laws, guide business teams, and manage ROPAs across local and global privacy operations.

The role covers risk assessments, incident response support, and collaboration with Legal, Information Security, Risk, Compliance, and HR teams. Travel may be required.

Qualifications

• Extensive experience implementing data privacy in global organizations.
• Bachelor’s degree or equivalent in relevant field.
• 5+ years’ experience implementing privacy technologies in data lakes, software, IT infra and applications.
• Certifications such as CISSP, CISM or CISA preferred.
• Travel up to 5% may be required.

Responsibilities

• Support design, implementation and continuous improvement of the privacy compliance framework in the Philippines.
• Assist in governance mechanisms, standards, policies, procedures and controls.
• Monitor compliance with privacy laws and organizational requirements.
• Provide guidance to business teams on privacy obligations and best practices.
• Create and update Records of Processing Activities (ROPAs).
• Coordinate and assist in incident reporting and global privacy tooling.
• Coordinate meetings and information flow with internal contacts.
• Support privacy reviews of products and services with templates.

Skills

Privacy governance

Regulatory compliance

Privacy risk management

Incident management

Global privacy operations

Vendor privacy management

Training & awareness

Audit & compliance support

Stakeholder management

Education

Bachelor’s degree in law, IT or related field

Postgraduate qualification in Data Privacy, Law, Compliance, Risk Management or Info Security

Job description

Key Responsibilities

Privacy Program Governance

• Support the design, implementation, and continuous improvement of the GCS’ privacy compliance framework in the Philippines.
• Assist in establishing governance mechanisms, standards, policies, procedures, and controls related to personal data processing that align to GTA requirements
• Monitor ongoing compliance with relevant privacy laws, regulations, and organizational requirements.
• Provide guidance to business teams on privacy compliance obligations and best practices.
• Creation and update of Records of Processing Activities (ROPAs) for both GCS and global privacy operations.
• Ensure that GTA incident reporting policy is implemented in GCS operations and assist in implementation of technologies supporting incident reporting and processing globally.
• Coordinate and attend meetings, emailing internal contacts for information as directed.
• Supporting Privacy review of products and services, creating review templates and identifying areas for more effective review.

Regulatory Compliance

• Serve as the local privacy compliance resource for Philippine data protection matters.
• Support compliance with the Philippine Data Privacy Act of 2012 and applicable implementing regulations.
• Coordinate privacy registrations, regulatory submissions, and documentation requirements with relevant authorities when required.
• Monitor legislative, regulatory and case law developments and recommend updates to internal processes and controls.
• Consolidate requirements of, enforce and audit against privacy frameworks like DCPP, GDPR, CCPA, NIST, ISO (27001, 27559, 29100, 27701, 27559, DORA, EU AI Act, EU-US DPF)

Privacy Risk Management

• Conduct privacy risk assessments and support Privacy Impact Assessments (PIAs).
• Supporting Privacy review of products and services, creating review templates and identifying areas for more effective review.
• Identify privacy risks associated with business processes, projects, systems, and third-party engagements.
• Recommend mitigation controls and monitor remediation activities.
• Maintain privacy risk registers and compliance documentation.

Incident Management

• Support the investigation, assessment, and management of privacy incidents and data breaches.
• Coordinate with Legal, Information Security, Risk, Compliance, and business stakeholders during incident response activities.
• Assist in determining notification requirements and regulatory reporting obligations.
• Maintain records of privacy incidents and corrective actions.

Global Privacy Operations Support

• Report to the Global Privacy Team and support
• strategic privacy initiatives.
• cross-border privacy compliance activities and global privacy governance programs.
• privacy assessments, audits, reporting, and compliance monitoring activities.
• privacy maturity across the organization.

Third-Party and Vendor Privacy Management

• Review vendor privacy practices and support privacy due diligence activities.
• Assist in evaluating data processing agreements and privacy-related contractual requirements.
• Monitor privacy compliance obligations of third-party service providers.

Training and Awareness

• Develop and deliver privacy awareness programs and training sessions.
• Promote a strong culture of data protection and responsible information handling.
• Create targeted training for employees, leaders, and stakeholders on privacy-related matters.

Audit and Compliance Support

• Support internal and external audits involving privacy compliance requirements.
• Assist with evidence gathering, control testing, and remediation activities.
• Prepare privacy KPI metrics, governance reports, and management updates.

Qualifications

Education

• Bachelor’s degree in law, Information Technology, Information Security, Business Administration, Risk Management, Compliance, Human Resources, or a related field.
• Postgraduate qualification in Data Privacy, Law, Compliance, Risk Management, or Information Security is an advantage.

Experience

• Extensive experience in implementing data privacy processes in global organizations to include implementation of privacy by design, risk management and compliance support.
• Bachelor's degree or equivalent (computer science, data science, IT)
• 5+ years’ experience implementing privacy enhancing technologies in data lakes, software, IT infrastructure and applications.
• Certifications (e.g., CISSP, CISM, or CISA preferred)
• AI product development experience.
• Project planning experience (PMP or similar certification).
• Experience in professional services organizations.
• Excellent verbal and written communication skills.
• Travel percentage: 5% (may be occasional travel if required)

Preferred Certifications

One or more of the following certifications is highly preferred:

• Certified Information Privacy Professional (CIPP/A, CIPP/E, or CIPP/US)
• Certified Information Privacy Manager (CIPM)
• Certified Information Privacy Technologist (CIPT)
• ISO 27701 Lead Implementer or Lead Auditor
• Certified Information Systems Security Professional (CISSP)
• Data Privacy Competency certification from the National Privacy Commission (NPC)

Key Competencies

Technical Competencies

• Privacy compliance and governance
• Data Protection Impact Assessments (DPIAs)
• Privacy incident management
• Regulatory compliance
• Third-party risk management
• Privacy by Design principles
• Data lifecycle management
• Records management

Behavioral Competencies

• Strong stakeholder management
• Analytical and problem-solving capability
• Excellent communication and presentation skills
• High professional integrity and confidentiality
• Ability to influence across functions and geographies
• Strong project management and organizational skills

Success Measures

Within the first 12 months, the successful candidate will:

• Support the establishment and maturation of the Philippines privacy compliance framework.
• Improve visibility and governance of personal data processing activities.
• Strengthen privacy risk assessment and monitoring capabilities.
• Enhance privacy awareness across business teams.
• Contribute to global privacy initiatives and cross-border compliance programs.
• Establish effective partnerships with Risk, Legal, Compliance, Information Security, HR, and Operations teams.