Data Protection Officer - Counsel

OSL; Singapore; On-site; SGD 180,000 - 240,000; Full time

Job summary

OSL seeks an experienced Legal Counsel to coordinate data protection, privacy, and AI governance across a global footprint including Singapore. The role reports to the General Counsel and requires credible interaction with regulators and engineering teams.

The candidate will hold statutory DPO seats where eligible, lead RoPA and cross-border registers, and drive privacy-by-design and AI governance in a fintech/crypto environment.

Qualifications

• Qualified lawyer with 5+ years of PQE in fintech, securities, payments or crypto.
• Meaningful exposure to data protection and privacy frameworks (GDPR, UK GDPR, PDPA, Bermuda PIPA, Australian Privacy Act).
• Fluency in English and Mandarin or Cantonese.
• Hands-on experience drafting DPAs, SCCs, and transfer docs; handling data breaches/regulator notifications.

Responsibilities

• Hold the designated DPO/Privacy Officer seat for each in-scope entity and act as single point of contact for supervisory authorities.
• Own RoPA, retention and cross-border transfer registers and the relevant laws and regulations.
• Advise Product, Engineering, Security and Risks on privacy-by-design, and lead AI governance, including model inventory and AI Act risk classification.
• Draft and negotiate DPAs, SCCs and outsourcing terms, aligning GDPR Art. 28, MiCAR Art. 73 and DORA Art. 30(3).
• Own the multi-jurisdiction incident and breach matrix and act as legal lead on live incidents.
• Supervise data subject rights operations and handle regulator-escalated requests.
• Deliver the group's annual privacy and AI training programme.

Skills

Data privacy

Regulatory liaison

Contract drafting

Stakeholder management

Education

PQE 5+ years

Job description

We are seeking an experienced Legal Counsel to act as OSL's group coordinator for data protection, privacy, and AI governance. Fitting into our Global Legal team and reporting to the General Counsel, this role covers a global footprint including the EU/EEA, UK, Australia, Singapore, Bermuda, the US, and Brazil.

In this role, you will hold statutory DPO appointments for jurisdictions where eligible. The ideal candidate is an experienced lawyer from the fintech, securities, payment, or crypto space with practical exposure to data privacy. You do not need to be an exclusive privacy specialist, but you must be comfortable holding an independent statutory seat, working collaboratively across the business, and being credible with regulators, engineering teams, and senior executives.

Key Responsibilities:

• Hold the designated DPO / Privacy Officer seat for each in-scope entity and act as the single point of contact for supervisory authorities


• Own the group Data Registers / Record of Processing Activities (RoPA), retention and cross-border transfer registers, and the relevant laws and regulations


• Advise Product, Engineering, Security and Risks on privacy-by-design, and lead AI governance, including the model inventory and AI Act risk classification


• Draft and negotiate Data Protection Agreements (DPAs), Standard Contractual Clauses (SCCs) and outsourcing terms, aligning GDPR Art. 28, MiCAR Art. 73 and DORA Art. 30(3) obligations into one package


• Own the multi-jurisdiction incident and breach matrix and act as legal lead on live incidents


• Supervise data subject rights operations and personally handle complex or regulator-escalated requests


• Deliver the group's annual privacy and AI training programme

Requirements:

• Qualified lawyer with 5+ years of PQE. Must have a background in the fintech, securities, payment, or crypto industries.


• Meaningful exposure to data protection and privacy matters. While you do not need to be a pure privacy specialist, a working command of frameworks like GDPR, UK GDPR, Singapore PDPA, Bermuda PIPA, or the Australian Privacy Act is highly advantageous.


• Fluency in English and either Mandarin or Cantonese is strictly required.


• Hands-on experience drafting and negotiating DPAs, SCCs, and transfer documentation, as well as exposure to managing data breaches, regulator notifications, or data subject requests.


• Certifications such as CIPP/E, CIPM, or equivalent qualifications in information/cyber-security are welcomed but not strictly mandatory. Practical experience is valued equally.


• Stakeholder Management: Comfortable holding an independent statutory seat and collaborating smoothly with Compliance, Risk, IT, MLRO, and CISO functions.

Vision & Mission

• OSL is the first SFC-licensed digital asset platform in Hong Kong and a PayFi innovator. Through stablecoin payments, cross-border settlement and global licensing, we are building the next-generation payments network. Stablecoins have become everyday money across emerging markets and are widely viewed as blockchain’s "killer app," with industry focus shifting from token issuance to real-world consumer and enterprise payment adoption. The strongest growth lies in cross-border B2B payments, where providers embedding stablecoins into corporate settlement flows can capture significant volume and float. Long-term defensibility comes from regulatory licences, banking partners and cross-border corridors.


• OSL holds or has acquired licences in Hong Kong, Japan, Australia, Bermuda and Indonesia, and is expanding into Europe, Brazil, Southeast Asia and Africa through acquisitions and licence applications. With OSL Pay and StableX, we embed stablecoin settlement into bank accounts and card networks, support 150+ digital assets, and provide 24/7 fiat-stablecoin conversion. As a regulated pioneer with a startup mindset, we believe the future of payments will be driven by real adoption and scalable deployment, not technology narratives. We welcome builders who are passionate about crypto and payments to join us in shaping compliant, global payment infrastructure.