Data Protection Officer - Contractual

Private Advertiser; Mandaluyong; Hybrid; PHP 670,000 - 1,116,000; Full time

Job summary

Private Advertiser is seeking a Data Protection Officer to embed privacy and data protection practices across the organization. You will be the primary contact for privacy issues and collaborate with privacy, security, and risk teams in monthly meetings.

The role covers ownership of privacy processes, DSAR handling, DPIAs, incident response, DPAs, and vendor privacy controls to ensure compliance with GDPR and Philippine data privacy regulations, in a hybrid work setting with 2–3 days onsite.

Qualifications

• Good understanding of business processes and information technology related to eCommerce.
• In-depth knowledge of data privacy laws governing the organization.
• 1–2 years of experience in data privacy or compliance.
• Knowledge of GDPR and Philippines Data Privacy Act regulations.
• Willingness to learn in privacy management, risk assessment, or compliance.
• Strong communication skills to advocate for privacy practices and liaise with stakeholders.
• Ability to handle confidential information with integrity and discretion.
• Willingness to learn in conducting DPAs, managing data breaches, and maintaining records.

Responsibilities

• Act as the primary point of contact for privacy-related issues and coordinate with privacy, security, legal, and risk teams.
• Own privacy processes and align them with company objectives; refine privacy procedures and mitigate risks.
• Coordinate and document ROPA elements, DPIAs, DSAR handling, and incident response.
• Review contracts and ensure DPAs and privacy controls meet regulatory requirements.
• Manage access rights reviews across systems and coordinate with owners for revocation and improvements.
• Provide privacy-by-design recommendations and assist in vendor privacy management.

Education

Bachelor's degree

Job description

The Data Protection Officer plays a critical role in ensuring that privacy and data protection practices are effectively embedded.

As the primary point of contact for all privacy-related issues and activities. The Privacy Officer works collaboratively with internal stakeholders, with a monthly meeting with a privacy office team (DPO, Security, Legal, Risk) on privacy matters. The role plays a pivotal role in ensuring the follow-up of non-compliance issues.

Responsibilities:

Privacy Process Ownership

• Serve as the (delegated) process owner for PH office privacy procedures and ensure compliance with privacy policies and regulations.
• Review and refine privacy processes to align with company-wide data protection objectives.
• Proactively identify and implement privacy best practices to mitigate risks.
• Conduct risk-based assessments and recommend practical remediation steps within defined timelines (e.g., 30/60/90-day plans).
• Collaborate with cross-functional teams (Marketing, IT, Legal, Security, Procurement, Operations) to ensure alignment and resolve privacy-related gaps.

Cookie, Tracking & Vendor Management

• Review, classify, and document cookies, trackers, and technologies used across the website and applications.
• Assess compliance risks related to cookie usage, online identifiers, and vendor tools such as Google Tag Manager and Consent Management Platforms.
• Evaluate third‑party vendors for privacy compliance and ensure appropriate data processing agreements and documentation are in place.
• Balance business needs (e.g., marketing conversion tracking) with regulatory requirements through evidence-based recommendations.

Register of Processing Activities (ROPA)

• Maintain and update the register of processing activities, ensuring accurate documentation of data processing activities and related information.
• Ensure follow-up on non-compliance issues.
• Capture key ROPA elements including purposes, data categories, retention periods, lawful bases, data flows, recipients, security measures, and data transfers.
• Coordinate with system owners (CRM, ERP, HR, marketing tools) to validate and update data mapping information.

Incident Handling

• Coordinate or assist in the response to privacy incidents, ensuring prompt identification, assessment, and reporting of data breaches.
• Document incident details, root cause, affected data subjects, and corrective actions with attention to accuracy and completeness.

Data Subject Access Requests (DSAR/DSR)

• Conduct or assist in data protection impact assessments (DPIAs) for new projects and existing personal data processing activities.
• Identify potential risks and recommend potential risk treatment activities.
• Manage end‑to‑end DSAR handling including intake, identity verification, scoping, data collection from multiple systems, redaction, and secure delivery.
• Coordinate with IT and Marketing teams to retrieve device-level tracking data when feasible and document limitations transparently.
• Ensure DSAR responses meet legal deadlines and maintain defensible documentation.

Training & Awareness

• Conduct or assist in delivering privacy training and raise awareness, ensuring employees understand their roles in protecting data.
• Stay up-to-date with privacy trends and changes in regulations, and share insights with the team.
• Communicate complex privacy, technical, and regulatory topics in simple, business-friendly language.

Contract Management

• Review new contracts and work with procurement functions and legal teams to ensure compliance with privacy requirements, such as Data Processing Agreements (DPAs).
• Ensure vendor privacy controls align with organizational standards and regulatory requirements.

Access Rights Management

• Coordinate periodic user access reviews across CRM, ERP, HRIS, and marketing systems to ensure least‑privilege access.
• Identify and expand excessive access rights, segregation‑of‑duties conflicts, and outdated permissions.
• Work with system owners to ensure access revocation, documentation, and process improvements.

Portfolio Management

• Participate in specific portfolio management reviews of new initiatives and assess their impact on privacy requirements.
• Provide privacy‑by‑design recommendations, data mapping support, and compliance guidance for new products, features, or vendor integrations.

Qualifications:

• Good understanding of business processes and information technology about eCommerce
• In-depth knowledge of the application within the organization of data privacy laws
• Minimum 1-2 years of experience in data privacy or compliance
• Demonstrated knowledge of GDPR and Philippines Data Privacy Act regulations
• Willingness to learn in privacy management, risk assessment, or compliance
• Strong communication skills to advocate for privacy practices and liaise with various stakeholders
• Ability to handle confidential information with integrity and discretion
• Willingness to learn in conducting DPIAs, managing data breaches, and maintaining records is a must
• Bachelor's degree required
  

Work arrangement: Hybrid, 2-3 days onsite schedule