Data Protection Officer (DPO) - PayLink

Salla; Al Khobar; On-site; SAR 240,000 - 420,000; Full time

Job summary

PayLink seeks an experienced Data Protection Officer to lead the data privacy program, ensuring compliance with Saudi PDPL, implementing PIAs, and advising on regulatory obligations. The role requires collaboration with Legal, IT, Security, and Product teams to strengthen privacy controls and governance.

The DPO will oversee DSAR processes, privacy risk management, and privacy incident response, while promoting Privacy by Design and by Default across business processes.

Qualifications

• Bachelor's degree in Law, Information Security, Cybersecurity, Compliance, Information Technology or related field.
• Privacy certifications such as CIPP/E, CIPM, CIPP/A preferred.
• Hands-on experience with Data Protection, Privacy Compliance or Regulatory Compliance.

Responsibilities

• Develop and maintain privacy framework per PDPL and SAMA requirements.
• Monitor regulatory developments and ensure ongoing compliance with data protection laws.
• Serve as primary contact for regulators on data protection matters.
• Advise management on privacy risks, obligations, and controls.
• Conduct Privacy Impact Assessments (PIAs/DPIAs) and manage privacy risk assessments.
• Lead Data Subject Rights processes and privacy incident response.
• Deliver privacy training and engage stakeholders across Legal, IT, Cybersecurity and Product teams.

Skills

Data Protection

Privacy Compliance

Stakeholder management

Education

Bachelor's degree in Law, Information Security, Cybersecurity, Compliance, Information Technology

Tools

CIPP/E

CIPM

CIPP/A

Job description

Job Summary

We are seeking an experienced Data Protection Officer (DPO) to lead and oversee PayLink's data privacy and protection framework, ensuring compliance with Saudi Arabia's Personal Data Protection Law (PDPL), its Implementing Regulations, and applicable regulatory requirements.

The ideal candidate will have hands-on experience implementing data protection programs, conducting Privacy Impact Assessments (PIAs/DPIAs), managing privacy risks, and advising stakeholders on data protection obligations, preferably within FinTech, banking, payments, or other regulated financial services environments.

Key Responsibilities

Data Protection & Regulatory Compliance

• Develop, implement, and maintain the organization's data protection and privacy compliance framework in accordance with Saudi PDPL, its Implementing Regulations, and applicable SAMA requirements.
• Monitor regulatory developments and ensure ongoing compliance with applicable data protection laws and standards.
• Serve as the primary point of contact for relevant regulatory authorities on data protection matters.
• Advise senior management on privacy risks, regulatory obligations, and compliance improvements.

Privacy Governance & Risk Management

• Develop, review, and maintain privacy policies, procedures, data retention schedules, and internal guidelines.
• Conduct and oversee Privacy Impact Assessments (PIAs/DPIAs) for new products, systems, and business processes.
• Identify, assess, and mitigate privacy risks associated with personal data processing, third-party vendors, and cross-border data transfers.
• Embed Privacy by Design and Privacy by Default principles into business operations.

Data Subject Rights & Incident Management

• Establish and manage processes for handling Data Subject Access Requests (DSARs) and other rights under Saudi PDPL.
• Establish and manage processes for handling Data Subject Access Requests (DSARs) and other data subject rights under Saudi PDPL, in coordination with Information Security, Legal, and IT teams to ensure timely and compliant responses.
• Monitor compliance with data protection requirements and maintain appropriate documentation and audit evidence.

Training & Stakeholder Engagement

• Develop and deliver employee privacy awareness and data protection training programs.
• Collaborate with Legal, Compliance, Cybersecurity, IT, Product, and business teams to ensure effective privacy controls.

• Bachelor's degree in Law, Information Security, Cybersecurity, Compliance, Information Technology, or a related field.
• Professional privacy certifications such as CIPP/E, CIPM, CIPP/A are preferred.
• Demonstrated hands-on experience in Data Protection, Data Privacy, Privacy Compliance, or Regulatory Compliance.
• Strong knowledge of Saudi Personal Data Protection Law (PDPL) and its Implementing Regulations.
• Understanding of SAMA regulatory requirements and their application to financial institutions, payment service providers, or FinTech companies.
• Proven experience developing and implementing privacy policies, data protection frameworks, and compliance procedures.
• Practical experience conducting Privacy Impact Assessments (PIAs/DPIAs), privacy risk assessments, and maintaining Records of Processing Activities (RoPA).
• Experience managing Data Subject Rights Requests (DSARs), personal data breaches, and privacy incident response.
• Ability to collaborate with cross-functional teams and communicate regulatory requirements to technical and non-technical stakeholders.
• Strong analytical, documentation, communication, and stakeholder management skills.
• Professional proficiency in English; Arabic proficiency is highly preferred