Data Privacy Manager

Grant Thornton (US); Makati; On-site; PHP 900,000 - 1,800,000; Full time

Job summary

Grant Thornton (US) in the Philippines is seeking a Privacy Program professional to support governance, risk management, and regulatory compliance across data privacy initiatives. The role partners with Legal, IT, Risk, and Compliance to implement privacy by design and manage DPIAs, risk registers, and incident responses.

You will contribute to global privacy programs, coordinate with authorities, and promote data protection awareness within the organization.

Qualifications

• Bachelor degree in a relevant field with focus on privacy, law, IT, or security.
• 5+ years implementing privacy processes in global organizations.
• Certifications such as CISSP/CISM/CISA preferred.
• Experience in professional services organizations is a plus.
• Excellent verbal and written communication skills.

Responsibilities

• Support design, implementation, and improvement of privacy compliance framework.
• Assist governance mechanisms, policies, and controls for data processing.
• Monitor compliance with privacy laws and organizational requirements.
• Provide guidance to business teams on privacy obligations.
• Create and update Records of Processing Activities (ROPAs) for GCS and global operations.
• Help implement GTA incident reporting policy and related technologies.
• Coordinate meetings and internal information requests.
• Support privacy reviews of products and services.
• Serve as local privacy compliance resource for Philippine data protection matters.
• Coordinate privacy registrations and regulatory submissions as required.
• Monitor regulatory developments and update internal processes.
• Contribute to privacy risk management including PIAs and risk registers.
• Maintain privacy risk registers and remediation tracking.
• Assist in incident investigation and notification requirements.
• Support global privacy operations and cross-border privacy governance programs.
• Review vendor privacy practices and data processing agreements.
• Develop and deliver privacy awareness training.
• Assist with audits, evidence gathering, and KPI reporting.
• Establish privacy performance metrics and governance reports.

Skills

Privacy governance

Regulatory compliance

Stakeholder management

Communication

Project management

Risk assessment

Data protection

Education

Bachelor's degree in law or IT or information security

Postgraduate qualification in Data Privacy, Law, Compliance, Risk Management, or Information Security

CISSP/CISM/CISA preferred

PMP or similar certification

AI product development experience

Travel 5%

Job description

Job Description:

Key Responsibilities

Privacy Program Governance

• Support the design, implementation, and continuous improvement of the GCS’ privacy compliance framework in the Philippines.
• Assist in establishing governance mechanisms, standards, policies, procedures, and controls related to personal data processing that align to GTA requirements
• Monitor ongoing compliance with relevant privacy laws, regulations, and organizational requirements.
• Provide guidance to business teams on privacy compliance obligations and best practices.
• Creation and update of Records of Processing Activities (ROPAs) for both GCS and global privacy operations.
• Ensure that GTA incident reporting policy is implemented in GCS operations and assist in implementation of technologies supporting incident reporting and processing globally.
• Coordinate and attend meetings, emailing internal contacts for information as directed.
• Supporting Privacy review of products and services, creating review templates and identifying areas for more effective review.

Regulatory Compliance

• Serve as the local privacy compliance resource for Philippine data protection matters.
• Support compliance with the Philippine Data Privacy Act of 2012 and applicable implementing regulations.
• Coordinate privacy registrations, regulatory submissions, and documentation requirements with relevant authorities when required.
• Monitor legislative, regulatory and case law developments and recommend updates to internal processes and controls.
• Consolidate requirements of, enforce and audit against privacy frameworks like DCPP, GDPR, CCPA, NIST, ISO (27001, 27559, 29100, 27701, 27559, DORA, EU AI Act, EU-US DPF)

Privacy Risk Management

• Conduct privacy risk assessments and support Privacy Impact Assessments (PIAs).
• Supporting Privacy review of products and services, creating review templates and identifying areas for more effective review.
• Identify privacy risks associated with business processes, projects, systems, and third-party engagements.
• Recommend mitigation controls and monitor remediation activities.
• Maintain privacy risk registers and compliance documentation.

Incident Management

• Support the investigation, assessment, and management of privacy incidents and data breaches.
• Coordinate with Legal, Information Security, Risk, Compliance, and business stakeholders during incident response activities.
• Assist in determining notification requirements and regulatory reporting obligations.
• Maintain records of privacy incidents and corrective actions.

Global Privacy Operations Support

• Report to the Global Privacy Team and support ostrategic privacy initiatives. ocross-border privacy compliance activities and global privacy governance programs. oprivacy assessments, audits, reporting, and compliance monitoring activities. o privacy maturity across the organization.

Third-Party and Vendor Privacy Management

• Review vendor privacy practices and support privacy due diligence activities.
• Assist in evaluating data processing agreements and privacy-related contractual requirements.
• Monitor privacy compliance obligations of third-party service providers.

Training and Awareness

• Develop and deliver privacy awareness programs and training sessions.
• Promote a strong culture of data protection and responsible information handling.
• Create targeted training for employees, leaders, and stakeholders on privacy-related matters.

Audit and Compliance Support

• Support internal and external audits involving privacy compliance requirements.
• Assist with evidence gathering, control testing, and remediation activities.
• Prepare privacy KPI metrics, governance reports, and management updates.

Qualifications

Education

• Bachelor’s degree in law, Information Technology, Information Security, Business Administration, Risk Management, Compliance, Human Resources, or a related field.
• Postgraduate qualification in Data Privacy, Law, Compliance, Risk Management, or Information Security is an advantage.

Experience

• Extensive experience in implementing data privacy processes in global organizations to include implementation of privacy by design, risk management and compliance support.
• Bachelors degree or equivalent (computer science, data science, IT)
• 5+ years’ experience implementing privacy enhancing technologies in data lakes, software, IT infrastructure and applications.
• Certifications (e.g., CISSP, CISM, or CISA preferred)
• AI product development experience.
• Project planning experience (PMP or similar certification).
• Experience in professional services organizations.
• Excellent verbal and written communication skills.
• Travel percentage: 5% (may be occasional travel if required)

Preferred Certifications

One or more of the following certifications is highly preferred:

• Certified Information Privacy Professional (CIPP/A, CIPP/E, or CIPP/US)
• Certified Information Privacy Manager (CIPM)
• Certified Information Privacy Technologist (CIPT)
• ISO 27701 Lead Implementer or Lead Auditor
• Certified Information Systems Security Professional (CISSP)
• Data Privacy Competency certification from the National Privacy Commission (NPC)

Key Competencies

Technical Competencies

• Privacy compliance and governance
• Data Protection Impact Assessments (DPIAs)
• Privacy incident management
• Regulatory compliance
• Third-party risk management
• Privacy by Design principles
• Data lifecycle management
• Records management

Behavioral Competencies

• Strong stakeholder management
• Analytical and problem-solving capability
• Excellent communication and presentation skills
• High professional integrity and confidentiality
• Ability to influence across functions and geographies
• Strong project management and organizational skills

Success Measures

• Within the first 12 months, the successful candidate will: Support the establishment and maturation of the Philippines privacy compliance framework.
• Improve visibility and governance of personal data processing activities.
• Strengthen privacy risk assessment and monitoring capabilities.
• Enhance privacy awareness across business teams.
• Contribute to global privacy initiatives and cross-border compliance programs.
• Establish effective partnerships with Risk, Legal, Compliance, Information Security, HR, and Operations teams.

Requirements: