Senior Data Privacy Operations Lead (PDPL)

Acuative Middle East; Jeddah; On-site; SAR 360,000 - 500,000; Full time

Job summary

Acuative Middle East is seeking a Senior Data Privacy Consultant to be embedded within the PDP function of a leading research university in Saudi Arabia. You will operate hands-on, running day-to-day privacy operations and strengthening compliance under PDPL and SDAIA regulations.

This is an operational role requiring practical experience with RoPAs, DPIAs, DPIA gating, third-party risk, and breach management, plus training and coaching across the organization. On-site in Thuwal is required.

Qualifications

• 6+ years in data privacy, data protection, or GRC roles with hands-on privacy work.
• Deep knowledge of PDPL, Implementing Regulations, Data Transfer Regulations, SDAIA guidance.
• Experience building RoPAs, conducting DPIAs, and third-party privacy risk assessments.
• Experience managing personal data breaches and regulatory notifications.
• Experience handling DSRs and maintaining a DSR register.
• Strong workshop facilitation and stakeholder management across legal, IT, security, and procurement.
• Ability to draft DPAs, SCCs, privacy notices, retention schedules, and training material.
• Fluent English is required; Arabic a plus; willing to work on-site in Thuwal, KSA.

Responsibilities

• Identify business units and processing activities lacking RoPAs and build them via stakeholder workshops.
• Validate and update RoPAs with process owners and secure sign-off from BU Heads and DPO.
• Develop or apply DPIA processes, screen activities, and conduct DPIAs on high-risk processing.
• Record risks in the GRC platform and track them to closure with owners and sign-offs.
• Assess data processors, prescribe actions, and embed controls into DPAs and SCCs.
• Review vendor security controls in DPAs and conduct transfer risk assessments.
• Develop template security controls and update guidance for researchers on handling human subject data.
• Support privacy incidents end to end: containment, root cause analysis, and regulatory communications.
• Run Privacy Champion workshops and deliver targeted training; manage handover with SME support.
• Handle DSR requests end to end and fix bottlenecks in DSR workflows.
• Review privacy notices and retention schedules; guide operations on compliant deletion.

Skills

Data privacy

GRC

RoPA development

DPIA execution

Vendor risk assessments

Breach management

Workshop facilitation

Policy drafting

English fluency

Tools

ServiceNow GRC

OneTrust

Archer

Job description

Acuative Middle East is seeking a Senior Data Privacy Consultant to be embedded within the PDP function of a leading research university in Saudi Arabia. You will operate hands-on, running day-to-day privacy operations and strengthening compliance under PDPL and SDAIA regulations.

This is an operational role requiring practical experience with RoPAs, DPIAs, DPIA gating, third-party risk, and breach management, plus training and coaching across the organization. On-site in Thuwal is required.