Data Protection Officer

Metro Pacific Tollways Corporation; Pasig; On-site; PHP 1,200,000 - 1,800,000; Full time

Job summary

Metro Pacific Tollways Corporation seeks an experienced Data Protection Officer to lead privacy compliance across the organization. You will develop and maintain data protection policies, manage DPIAs and privacy risk assessments, and act as the primary liaison with the NPC and internal stakeholders.

The role requires a strong law or data privacy background, at least five years in data protection, and the ability to advise senior management on regulatory changes and incident response.

Qualifications

• Bachelor’s degree in a relevant field; law degree preferred.
• Minimum 5 years in data privacy or related compliance.
• Strong knowledge of the Philippine Data Privacy Act, IRR, NPC issuances.
• Experience implementing privacy policies, DPIAs, and incident responses.
• Excellent analytical, communication, and stakeholder-management skills.

Responsibilities

• Lead registration/renewal documents with the NPC for group entities.
• Ensure compliance with DP Act, IRR, NPC issuances, and applicable laws.
• Develop, implement, and review data protection policies and guidelines.
• Handle data subject requests (access, correction, deletion).
• Conduct training to raise privacy awareness among employees.
• Coordinate DPIAs and regular privacy risk assessments for new projects.
• Serve as liaison between data subjects, the company, and NPC.
• Report timely to NPC and authorities including breach notifications.
• Lead investigations and corrective actions for privacy incidents.
• Coordinate breach response strategy and notifications to authorities and affected individuals.
• Advise senior management on data protection matters and regulatory changes.
• Review contracts and data-sharing agreements for DP Act compliance.
• Monitor evolving privacy laws and update compliance programs.

Skills

Analytical skills

Problem-solving

Communication

Stakeholder management

Leadership

Data privacy knowledge

Education

Bachelor’s degree in a relevant field

Law degree and Philippine Bar admission preferred

Job description

We are looking for an experienced Data Protection Officer to lead and oversee the company’s data privacy and protection compliance initiatives. The role will ensure adherence to the Data Privacy Act of 2012, its Implementing Rules and Regulations (IRR), National Privacy Commission (NPC) issuances, and other applicable laws and regulations.

The successful candidate will drive the development and continuous improvement of data protection policies, manage privacy risks and incidents, and provide expert guidance to management and business units on data privacy matters.

Key Responsibilities

• Lead the preparation and submission of documents for the registration or renewal of MPT Group companies with the National Privacy Commission.
• Ensure compliance with the Data Privacy Act, its IRR, related NPC issuances, and other applicable laws and regulations.
• Develop, implement, and regularly review data protection policies, procedures, and guidelines.
• Assist in handling data subject requests concerning their rights, including access, correction, and deletion.
• Conduct regular training sessions and workshops to promote employee awareness and understanding of data protection principles.
• Conduct, provide guidance on, and coordinate data privacy impact assessments (DPIAs) and regular risk assessments for new projects, processes, or technologies to identify and mitigate potential privacy risks.
• Act as the primary point of contact among data subjects, the company, and the National Privacy Commission.
• Ensure timely and accurate reporting to the NPC and other regulatory authorities, including data breach notifications and annual security incident reports.
• Serve as the primary point of contact for data breaches and privacy-related incidents.
• Assist in the investigation, documentation, and resolution of privacy concerns, data breaches, and incidents, and implement corrective actions to prevent recurrence.
• Coordinate and lead the response strategy for data breaches and incidents, including notification of relevant authorities and affected individuals, as necessary.
• Advise the Chief Legal and Compliance Officer, senior management, and other departments on data protection and privacy matters.
• Coordinate with the Legal Department in reviewing contracts, data-sharing agreements, consent forms, privacy notices, data processing activities, and other data protection documents to ensure compliance with the Data Privacy Act.
• Monitor developments in data protection laws and best practices, providing timely advice and updates on evolving compliance requirements.
• Continuously assess and improve the company’s data protection framework in response to regulatory changes and technological advancements.
• Conduct regular audits of data processing activities to assess compliance, identify areas for improvement, and implement corrective actions where necessary.
• Prepare regular reports for the Chief Legal and Compliance Officer and management on data protection compliance, risks, and incidents.
• Maintain records of the company’s data processing activities.
• Coordinate with various departments on privacy-related incidents, concerns, and inquiries.

About you

• A Bachelor’s degree in a relevant field is required; a Law degree and admission to the Philippine Bar are preferred.
• At least 5 years of relevant experience in data privacy, data protection, or a related compliance function.
• Strong knowledge of the Philippine Data Privacy Act of 2012, its IRR, NPC issuances, and applicable data protection regulations.
• Experience in implementing data privacy policies, conducting privacy risk assessments, managing data breaches, and ensuring regulatory compliance.
• Excellent analytical, problem-solving, communication, and stakeholder management skills.
• Ability to advise senior management and collaborate effectively with Legal, IT, and other business units.
• Experience in a leadership or supervisory capacity is an advantage.