Data Protection Officer

Private Advertiser; Taguig; Hybrid; PHP 1,000,000 - 1,800,000; Full time

Job summary

Private Advertiser in the Philippines seeks a Data Protection Officer (DPO) to establish and oversee the company's data privacy, governance, and AI governance frameworks, ensuring compliance with RA 10173 and NPC issuances. The DPO acts as second line of defense, providing independent challenge and advisory support across privacy matters.

You will liaise with regulators, support business units, and embed privacy across operations, outsourcing, and AI-enabled solutions.

Qualifications

• Experience implementing data privacy programs in accordance with RA 10173.
• Knowledge of NPC issuances and BSP regulations.
• Familiarity with data governance and privacy by design.

Responsibilities

• Oversee data privacy governance and regulatory compliance in all frameworks.
• Maintain RoPA oversight and manage data subject rights processes.
• Provide second-line oversight of Enterprise Data Governance and coordinate with risk management.

Skills

Regulatory compliance

Data privacy governance

AI governance

NPC liaison

Risk management

Job description

The Data Protection Officer (DPO) is responsible for establishing, maintaining, and providing independent oversight of the Company's Data Privacy, Data Governance, and Artificial Intelligence (AI) Governance frameworks, ensuring compliance with the Data Privacy Act of 2012 (RA 10173) and its Implementing Rules and Regulations, National Privacy Commission (NPC) issuances, and Bangko Sentral ng Pilipinas (BSP) regulations, and having regard to applicable international standards such as ISO/IEC 27701, the NIST Privacy Framework, and ISO/IEC 42001, where relevant. As a Second Line of Defense function within the Compliance Department, the DPO provides independent challenge, oversight, and advisory support over the First Line's management of privacy, data governance, and AI risks, without assuming operational ownership of business processes, systems, or controls. The DPO serves as the Company's subject matter expert and primary point of contact with regulators on data privacy matters, and supports business units, Information Security, Technology, Legal, Procurement, Enterprise Risk Management, and Internal Audit in embedding privacy, data governance, and AI governance requirements across the Company's operations, digital initiatives, outsourcing arrangements, and AI-enabled solutions.

The DPO exercises this mandate with functional independence consistent with RA 10173, its Implementing Rules and Regulations, and NPC Circular 16-01, and promotes a culture of accountability, responsible data management, ethical AI, and regulatory compliance in support of the Company's digital transformation and innovation initiatives.

Duties and Responsibilities:

1. Regulatory Compliance and Data Privacy Governance

• Serve as the Company's designated Data Protection Officer in accordance with applicable data privacy laws and regulations.
• Act as the primary liaison with the National Privacy Commission (NPC), Bangko Sentral ng Pilipinas (BSP), regulators, auditors, and other supervisory authorities on data privacy matters.
• Ensure the Company's compliance with its obligations as a Personal Information Controller (PIC) under RA 10173 and NPC Circular 16-01, including registration and notification requirements with the NPC.
• Monitor changes in privacy, AI, technology, and data governance regulations and assess organizational impact.
• Develop, maintain, and periodically update the Company's Data Privacy Management Program, policies, standards, procedures, guidelines, and governance framework.
• Ensure alignment of privacy governance with the Compliance Management System and applicable regulatory requirements.
• Coordinate regulatory submissions, compliance attestations, and responses relating to data privacy and personal data processing.

2. Records of Processing, Data Subject Rights, and Consent Governance

• Maintain oversight of the Company's Records of Processing Activities (RoPA), ensuring completeness, accuracy, and periodic validation by data and system owners.
• Provide independent oversight of the Company's handling of Data Subject Rights requests (access, correction, erasure, objection, and data portability), including monitoring turnaround times and escalating unresolved cases.
• Review consent mechanisms, privacy notices, and disclosure language for accuracy, sufficiency, and compliance with RA 10173 and applicable NPC issuances.

3. Second Line Data Governance Oversight

• Provide independent second-line oversight over the Company's Enterprise Data Governance Framework, with primary focus on personal and privacy-relevant data domains.
• Coordinate with Enterprise Risk Management and the Data Office/Chief Data Officer function on enterprise-wide data quality and data aggregation matters (e.g., BCBS 239) to avoid duplication of mandate.