Data Privacy Consultant

Acuative Middle East; Jeddah; On-site; SAR 360,000 - 500,000; Full time

Job summary

Acuative Middle East is seeking a Senior Data Privacy Consultant to be embedded within the PDP function of a leading research university in Saudi Arabia. You will operate hands-on, running day-to-day privacy operations and strengthening compliance under PDPL and SDAIA regulations.

This is an operational role requiring practical experience with RoPAs, DPIAs, DPIA gating, third-party risk, and breach management, plus training and coaching across the organization. On-site in Thuwal is required.

Qualifications

• 6+ years in data privacy, data protection, or GRC roles with hands-on privacy work.
• Deep knowledge of PDPL, Implementing Regulations, Data Transfer Regulations, SDAIA guidance.
• Experience building RoPAs, conducting DPIAs, and third-party privacy risk assessments.
• Experience managing personal data breaches and regulatory notifications.
• Experience handling DSRs and maintaining a DSR register.
• Strong workshop facilitation and stakeholder management across legal, IT, security, and procurement.
• Ability to draft DPAs, SCCs, privacy notices, retention schedules, and training material.
• Fluent English is required; Arabic a plus; willing to work on-site in Thuwal, KSA.

Responsibilities

• Identify business units and processing activities lacking RoPAs and build them via stakeholder workshops.
• Validate and update RoPAs with process owners and secure sign-off from BU Heads and DPO.
• Develop or apply DPIA processes, screen activities, and conduct DPIAs on high-risk processing.
• Record risks in the GRC platform and track them to closure with owners and sign-offs.
• Assess data processors, prescribe actions, and embed controls into DPAs and SCCs.
• Review vendor security controls in DPAs and conduct transfer risk assessments.
• Develop template security controls and update guidance for researchers on handling human subject data.
• Support privacy incidents end to end: containment, root cause analysis, and regulatory communications.
• Run Privacy Champion workshops and deliver targeted training; manage handover with SME support.
• Handle DSR requests end to end and fix bottlenecks in DSR workflows.
• Review privacy notices and retention schedules; guide operations on compliant deletion.

Skills

Data privacy

GRC

RoPA development

DPIA execution

Vendor risk assessments

Breach management

Workshop facilitation

Policy drafting

English fluency

Tools

ServiceNow GRC

OneTrust

Archer

Job description

About the role:

Acuative is hiring a Senior Data Privacy Consultant to be embedded within the Personal Data Protection (PDP) function of a leading research university in Saudi Arabia. You will act as a hands-on extension of the DPO's team, running the day-to-day privacy operations program and strengthening the organization's compliance posture under the Saudi Personal Data Protection Law (PDPL) and SDAIA regulations.

This is an operational role, not an advisory-only role. You will facilitate workshops with business units, populate and validate compliance artifacts, run assessments, manage incidents, and coach internal privacy champions so the organization becomes self-sufficient over time.

What you will do:

Records of Processing Activities (RoPAs)

• Identify business units and processing activities without RoPAs and build them through stakeholder workshops.
• Validate and update existing RoPAs with process owners, and secure sign-off from BU Heads and the DPO.

Data Protection Impact Assessments (DPIAs)

• Develop or apply a process gating methodology to screen all processing activities and flag high-risk ones.
• Conduct DPIAs on high-risk activities, identify privacy risks and controls, assign risk and control owners, and obtain sign-off.
• Record all identified risks in the GRC platform and track them to closure.

Third-Party Privacy Risk Management

• Identify data processors not yet subject to due diligence and build a High/Medium/Low risk tiering methodology.
• Assess high-risk processors, prescribe corrective actions and timelines, and coordinate with Procurement and the relevant BUs.
• Review vendor security controls in Data Processing Agreements (DPAs), perform transfer risk assessments, and embed required controls into DPAs and KSA Standard Contractual Clauses.
• Develop template security controls by contract type with Information Security, and update guidance for researchers on securing human subject research data.

Data Breach Management

• Support the DPO on privacy incidents end to end: containment, root cause analysis, mitigation, and coordination with Cyber Incident Response, Legal, Communications, and HR.
• Support regulatory breach notifications and responses to SDAIA inquiries.

Privacy Hub and Spoke Model

• Run workshops with BU Heads to appoint Privacy Champions across the organization.
• Define the Privacy Champion role (responsibilities, expectations) and secure management sign-off.
• Deliver 1-1 training to champions and manage a structured handover of privacy activities, with three months of SME support post-transition.

Data Subject Rights (DSR)

• Handle DSR requests end to end: intake, register logging, validation, internal coordination, response, and closure.
• Identify and fix process bottlenecks in the DSR workflow.

Data Minimization, Privacy Notices, and Retention

• Conduct data minimization reviews on intake forms, data sharing proposals, transfer risk assessments, and DPIAs.
• Review and update privacy notices based on RoPA and DPIA findings, changes in lawful basis, consent management, and legitimate interest procedures; draft new notices where needed.
• Review retention schedules against PDPL requirements and support process owners and technical stewards in setting compliant retention periods and technical SOPs for deletion.

Privacy Training

• Develop and deliver specialized on-site privacy training for units and build online training modules.

Ad-hoc Support

• Any other privacy tasks requested by the PDP function and the DPO.

What we are looking for:

Required:

• 6+ years in data privacy, data protection, or GRC roles, with at least 2 years of hands-on operational privacy work (not purely policy or advisory).
• Deep working knowledge of the Saudi PDPL, its Implementing Regulations, the Data Transfer Regulations, and SDAIA guidance. Familiarity with GDPR is a strong plus.
• Proven experience building and maintaining RoPAs, conducting DPIAs, and running third-party privacy risk assessments.
• Experience managing personal data breaches, including regulatory notification.
• Experience handling Data Subject Rights requests and maintaining a DSR register.
• Strong workshop facilitation and stakeholder management skills across business, legal, IT, security, and procurement teams.
• Ability to draft clear compliance documentation: DPAs, SCCs, privacy notices, retention schedules, role definitions, and training material.
• Fluent English, written and spoken.
• Willingness to work on-site full-time in Thuwal, KSA.

Preferred:

• CIPP/E, CIPM, CIPT, or equivalent privacy certification.
• Experience with GRC platforms (e.g., ServiceNow GRC, OneTrust, Archer) for risk logging and tracking.
• Background in higher education, research institutions, or other environments handling human subject research data.
• Arabic language proficiency.
• Experience with information security frameworks (ISO 27001, NCA ECC) and reviewing technical security controls in vendor contracts.