Data Protection Officer

METRO PACIFIC TOLLWAYS CORPORATION; Eastern Manila District; On-site; PHP 900,000 - 1,500,000; Full time

Job summary

METRO PACIFIC TOLLWAYS CORPORATION is seeking an experienced Data Protection Officer to lead the company’s privacy program and ensure compliance with the Data Privacy Act of 2012, IRR, and NPC issuances. You will guide management and business units on privacy matters and oversee policy development, risk assessments, and incident response.

You will drive DPIAs, training, and reporting to NPC, acting as the primary liaison for privacy concerns, and coordinating with Legal and Compliance on data

Qualifications

• 5+ years of experience in data privacy or related compliance.
• Strong knowledge of the Philippine Data Privacy Act and NPC issuances.
• Experience implementing data privacy policies and managing data breaches.
• Law degree preferred.
• Leadership or supervisory experience is a plus.

Responsibilities

• Lead registration/renewal documents for NPC as required.
• Ensure compliance with the Data Privacy Act, IRR, and NPC issuances.
• Develop and review data protection policies and guidelines.
• Handle data subject requests (access, correction, deletion).
• Conduct training to promote privacy awareness among employees.
• Coordinate DPIAs and risk assessments for new projects.
• Serve as the primary contact with NPC and regulatory authorities.
• Report data breach incidents and annual security reports timely.

Skills

Data privacy

Policy development

Risk assessment

Stakeholder management

Training & awareness

Education

Law degree

Job description

About the job

We are looking for an experienced Data Protection Officer to lead and oversee the company's data privacy and protection compliance initiatives. The role will ensure adherence to the Data Privacy Act of 2012, its Implementing Rules and Regulations (IRR), National Privacy Commission (NPC) issuances, and other applicable laws and regulations.

The successful candidate will drive the development and continuous improvement of data protection policies, manage privacy risks and incidents, and provide expert guidance to management and business units on data privacy matters.

Key Responsibilities

• Lead the preparation and submission of documents for the registration or renewal of MPT Group companies with the National Privacy Commission.
• Ensure compliance with the Data Privacy Act, its IRR, related NPC issuances, and other applicable laws and regulations.
• Develop, implement, and regularly review data protection policies, procedures, and guidelines.
• Assist in handling data subject requests concerning their rights, including access, correction, and deletion.
• Conduct regular training sessions and workshops to promote employee awareness and understanding of data protection principles.
• Conduct, provide guidance on, and coordinate data privacy impact assessments (DPIAs) and regular risk assessments for new projects, processes, or technologies to identify and mitigate potential privacy risks.
• Act as the primary point of contact among data subjects, the company, and the National Privacy Commission.
• Ensure timely and accurate reporting to the NPC and other regulatory authorities, including data breach notifications and annual security incident reports.
• Serve as the primary point of contact for data breaches and privacy-related incidents.
• Assist in the investigation, documentation, and resolution of privacy concerns, data breaches, and incidents, and implement corrective actions to prevent recurrence.
• Coordinate and lead the response strategy for data breaches and incidents, including notification of relevant authorities and affected individuals, as necessary.
• Advise the Chief Legal and Compliance Officer, senior management, and other departments on data protection and privacy matters.
• Coordinate with the Legal Department in reviewing contracts, data-sharing agreements, consent forms, privacy notices, data processing activities, and other data protection documents to ensure compliance with the Data Privacy Act.
• Monitor developments in data protection laws and best practices, providing timely advice and updates on evolving compliance requirements.
• Continuously assess and improve the company's data protection framework in response to regulatory changes and technological advancements.
• Conduct regular audits of data processing activities to assess compliance, identify areas for improvement, and implement corrective actions where necessary.
• Prepare regular reports for the Chief Legal and Compliance Officer and management on data protection compliance, risks, and incidents.
• Maintain records of the company's data processing activities.
• Coordinate with various departments on privacy-related incidents, concerns, and inquiries.

About you

• At least 5 years of relevant experience in data privacy, data protection, or a related compliance function.
• Strong knowledge of the Philippine Data Privacy Act of 2012, its IRR, NPC issuances, and applicable data protection regulations.
• Experience in implementing data privacy policies, conducting privacy risk assessments, managing data breaches, and ensuring regulatory compliance.
• Excellent analytical, problem-solving, communication, and stakeholder management skills.
• Ability to advise senior management and collaborate effectively with Legal, IT, and other business units.
• A law degree or relevant academic qualifications is preferred.
• Experience in a leadership or supervisory capacity is an advantage.