RCI: Data Privacy Officer

RelianceUnited; Mandaluyong; On-site; PHP 600,000 - 1,200,000; Full time

Job summary

RelianceUnited is seeking a qualified Data Privacy Officer (DPO) to ensure compliance with the National Privacy Commission, the Data Privacy Act, and NPC issuances across the organization in the Philippines.

The DPO will monitor processing activities, conduct PIAs, manage data breach responses, advise on third‑party data sharing, and raise privacy awareness through training and policy development.

Qualifications

• Bachelor's degree in Law, IT, CS, Business Administration, HR, or related field.
• 3–5 years of relevant privacy/compliance experience.
• Strong knowledge of NPC regulations and the Data Privacy Act (RA 10173) and IRR.
• Experience developing and monitoring privacy programs, policies, and procedures.
• Knowledge of PIAs, data mapping, data breach management, and data subject rights management.
• Familiarity with information security principles, cybersecurity practices, records management, and risk assessment methodologies.
• Experience coordinating with internal stakeholders, regulators, auditors, and third-party service providers on privacy and compliance matters.
• Strong analytical, problem-solving, project management, and documentation skills.
• Excellent communication and stakeholder management; capable of privacy awareness training.

Responsibilities

• Monitor compliance with the DPA, IRR, NPC issuances, and applicable laws.
• Collect information to identify processing operations and maintain records.
• Analyze compliance and issue security clearances to third parties.
• Advise PIC/PIP and issue recommendations on privacy matters.
• Oversee renewal of accreditations or certifications and data sharing agreements.
• Ensure conduct of Privacy Impact Assessments relative to activities and systems.
• Advise on complaints and rights exercises by data subjects.
• Ensure proper data breach and security incident management; report to NPC.
• Inform and cultivate privacy awareness within the organization.
• Advocate development and revision of privacy policies and guidelines.
• Serve as primary contact for data subjects and NPC; coordinate with authorities.
• Perform other duties to uphold data privacy and security.

Skills

Privacy compliance

NPC regulations

Data mapping

PIAs

Risk management

Stakeholder management

Education

Bachelor's degree in Law / IT / CS / Business Admin / HR

Job description

Job Objective / Purpose

To comply with the regulatory requirement of the National Privacy Commission that every company which processes personal data should designate at least one (1) Data Privacy Officer (DPO).

The DPO shall be accountable for ensuring the compliance by the PIC or PIP with the DPA, its IRR, issuances by the NPC, and other applicable laws and regulations relating to privacy and data protection.

Duties and Responsibilities

A DPO shall:

a. monitor the PIC’s or PIP’s compliance with the DPA, its IRR, issuances by the NPC and other applicable laws and policies. For this purpose, he or she may:

1.) collect information to identify the processing operations, activities, measures, projects, programs, or systems of the PIC or PIP, and maintain a record thereof;

2.) analyze and check the compliance of processing activities, including the issuance of security clearances to and compliance by third-party service providers;

3.) inform, advise, and issue recommendations to the PIC or PIP;

4.) ascertain renewal of accreditations or certifications necessary to maintain the required standards in personal data processing; and

5.) advice the PIC or PIP as regards the necessity of executing a Data Sharing Agreement with third parties, and ensure its compliance with the law;

b. ensure the conduct of Privacy Impact Assessments relative to activities, measures, projects, programs, or systems of the PIC or PIP;

c. advice the PIC or PIP regarding complaints and/or the exercise by data subjects of their rights (e.g., requests for information, clarifications, rectification or deletion of personal data);

d. ensure proper data breach and security incident management by the PIC or PIP, including the latter’s preparation and submission to the NPC of reports and other documentation concerning security incidents or data breaches within the prescribed period

e. Inform and cultivate awareness on privacy and data protection within the organization of the PIC or PIP, including all relevant laws, rules and regulations and issuances of the NPC;

f. advocate for the development, review and/or revision of policies, guidelines, projects and/or programs of the PIC or PIP relating to privacy and data protection, by adopting a privacy by design approach;

g. serve as the contact person of the PIC or PIP vis-à-vis data subjects, the NPC and other authorities in all matters concerning data privacy or security issues or concerns and the PIC or PIP;

h. cooperate, coordinate and seek advice of the NPC regarding matters concerning data privacy and security; and

i. perform other duties and tasks that may be assigned by the PIC or PIP that will further the interest of data privacy and security and uphold the rights of the data subjects

Background and Qualifications

1. Bachelor's degree in Law, Information Technology, Computer Science, Business Administration, Human Resources, or a related field.




2. At least 3-5 years of relevant experience in data privacy, data protection, compliance, information security, risk management, legal, or governance functions.




3. Strong working knowledge of the National Privacy Commission regulations, including the Data Privacy Act of 2012 (Republic Act No. 10173), its Implementing Rules and Regulations, and related issuances.




4. Experience in developing, implementing, and monitoring data privacy and data protection programs, policies, and procedures.




5. Knowledge of privacy impact assessments (PIAs), data mapping, data breach management, and data subject rights management.




6. Familiarity with information security principles, cybersecurity practices, records management, and risk assessment methodologies.




7. Experience coordinating with internal stakeholders, regulators, auditors, and third-party service providers on privacy and compliance matters.




8. Strong analytical, problem-solving, project management, and documentation skills.




9. Excellent communication and stakeholder management skills, with the ability to conduct privacy awareness and training programs across all levels of the organization.