Data Protection Officer

METRO PACIFIC TOLLWAYS CORPORATION; Philippines; On-site; PHP 900,000 - 1,500,000; Full time

Job summary

METRO PACIFIC TOLLWAYS CORPORATION is seeking an experienced Data Protection Officer to lead the company’s data privacy program in the Philippines. You will ensure compliance with the Data Privacy Act of 2012, manage privacy risks, and guide management and business units on data privacy matters.

You will drive policy development, incident response, DPIAs, training, and reporting to NPC and regulatory authorities, while coordinating with Legal and IT teams to strengthen the data protection

Qualifications

• Bachelor's degree in a relevant field is required.
• Law degree and admission to the Philippine Bar are preferred.
• At least 5 years of experience in data privacy, data protection, or related compliance.

Responsibilities

• Lead preparation and submission of documents for NPC registration/renewal of MPT Group companies.
• Ensure compliance with the Data Privacy Act, IRR, NPC issuances, and related laws.
• Develop, implement, and review data protection policies and guidelines.
• Assist with data subject requests including access, correction, deletion.
• Conduct regular privacy training and awareness sessions for staff.
• Coordinate DPIAs and regular risk assessments for new projects or technologies.
• Act as primary contact among data subjects, the company, and NPC.
• Report to NPC and regulators on data breaches and incidents.

Skills

Data privacy

Regulatory compliance

Stakeholder management

Communication

Leadership

Education

Bachelor's degree

Law degree (preferred)

Job description

About the job

We are looking for an experienced Data Protection Officer to lead and oversee the company's data privacy and protection compliance initiatives. The role will ensure adherence to the Data Privacy Act of 2012, its Implementing Rules and Regulations (IRR), National Privacy Commission (NPC) issuances, and other applicable laws and regulations.

The successful candidate will drive the development and continuous improvement of data protection policies, manage privacy risks and incidents, and provide expert guidance to management and business units on data privacy matters.

Key Responsibilities

• Lead the preparation and submission of documents for the registration or renewal of MPT Group companies with the National Privacy Commission.
• Ensure compliance with the Data Privacy Act, its IRR, related NPC issuances, and other applicable laws and regulations.
• Develop, implement, and regularly review data protection policies, procedures, and guidelines.
• Assist in handling data subject requests concerning their rights, including access, correction, and deletion.
• Conduct regular training sessions and workshops to promote employee awareness and understanding of data protection principles.
• Conduct, provide guidance on, and coordinate data privacy impact assessments (DPIAs) and regular risk assessments for new projects, processes, or technologies to identify and mitigate potential privacy risks.
• Act as the primary point of contact among data subjects, the company, and the National Privacy Commission.
• Ensure timely and accurate reporting to the NPC and other regulatory authorities, including data breach notifications and annual security incident reports.
• Serve as the primary point of contact for data breaches and privacy-related incidents.
• Assist in the investigation, documentation, and resolution of privacy concerns, data breaches, and incidents, and implement corrective actions to prevent recurrence.
• Coordinate and lead the response strategy for data breaches and incidents, including notification of relevant authorities and affected individuals, as necessary.
• Advise the Chief Legal and Compliance Officer, senior management, and other departments on data protection and privacy matters.
• Coordinate with the Legal Department in reviewing contracts, data-sharing agreements, consent forms, privacy notices, data processing activities, and other data protection documents to ensure compliance with the Data Privacy Act.
• Monitor developments in data protection laws and best practices, providing timely advice and updates on evolving compliance requirements.
• Continuously assess and improve the company's data protection framework in response to regulatory changes and technological advancements.
• Conduct regular audits of data processing activities to assess compliance, identify areas for improvement, and implement corrective actions where necessary.
• Prepare regular reports for the Chief Legal and Compliance Officer and management on data protection compliance, risks, and incidents.
• Maintain records of the company's data processing activities.
• Coordinate with various departments on privacy-related incidents, concerns, and inquiries.

About you

• A Bachelor's degree in a relevant field is required; a Law degree and admission to the Philippine Bar are preferred.
• At least 5 years of relevant experience in data privacy, data protection, or a related compliance function.
• Strong knowledge of the Philippine Data Privacy Act of 2012, its IRR, NPC issuances, and applicable data protection regulations.
• Experience in implementing data privacy policies, conducting privacy risk assessments, managing data breaches, and ensuring regulatory compliance.
• Excellent analytical, problem-solving, communication, and stakeholder management skills.
• Ability to advise senior management and collaborate effectively with Legal, IT, and other business units.
• Experience in a leadership or supervisory capacity is an advantage.