Data Protection Officer (Legal Counsel)

Confidential Hires; Singapore; On-site; SGD 180,000 - 260,000; Full time

Job summary

Confidential Hires, a globally regulated fintech company, seeks an experienced Legal Counsel to act as group Data Protection / Privacy and AI governance lead. You will hold statutory DPO appointments and work with regulators across EU/EEA, UK, Australia, Singapore, Bermuda, US and Brazil.

You will collaborate with product, engineering and security teams, manage RoPA and transfer regimes, draft DPAs and SCCs, oversee incident response, and drive the company’s privacy training program.

Qualifications

• Qualified lawyer with 5+ years of PQE in fintech, securities, payments, or crypto.
• Working knowledge of GDPR, UK GDPR, PDPA, Bermuda PIPA, or Australian Privacy Act is highly advantageous.
• Fluency in English and Mandarin or Cantonese is required.

Responsibilities

• Hold the designated DPO/Privacy Officer seat for in-scope entities and liaise with regulators.
• Own RoPA, retention, cross-border transfer registers and applicable privacy laws.
• Advise product, engineering, security and risks on privacy-by-design and AI governance.
• Draft and negotiate DPAs, SCCs, and outsourcing terms with GDPR Art.28 and applicable acts.
• Lead incident and breach response with legal oversight across jurisdictions.
• Oversee data subject rights operations and regulator escalations.
• Deliver annual privacy and AI training programmes.

Skills

Regulatory compliance

Privacy by design

DPO / data protection

Cross-functional collaboration

Stakeholder management

Education

Law degree / Qualified lawyer

Job description

We are a globally regulated digital asset and fintech company pioneering the future of PayFi and cross-border payments. Through stablecoin innovation and a robust network of global banking partners, we provide seamless fiat-to-crypto infrastructure for enterprise and consumer markets worldwide. Operating with a dynamic startup mindset but grounded in stringent regulatory compliance across multiple international jurisdictions, we are building the next-generation global payments network.

We are seeking an experienced Legal Counsel to act as our group coordinator for data protection, privacy, and AI governance. Fitting into our Global Legal team and reporting to the General Counsel, this role covers a global footprint including the EU/EEA, UK, Australia, Singapore, Bermuda, the US, and Brazil.

In this role, you will hold statutory DPO appointments for jurisdictions where eligible. The ideal candidate is an experienced lawyer from the fintech, securities, payment, or crypto space with practical exposure to data privacy. You do not need to be an exclusive privacy specialist, but you must be comfortable holding an independent statutory seat, working collaboratively across the business, and being credible with regulators, engineering teams, and senior executives.

Key Responsibilities:

• Hold the designated DPO / Privacy Officer seat for each in-scope entity and act as the single point of contact for supervisory authorities
• Own the group Data Registers / Record of Processing Activities (RoPA), retention and cross-border transfer registers, and the relevant laws and regulations
• Advise Product, Engineering, Security and Risks on privacy-by-design, and lead AI governance, including the model inventory and AI Act risk classification
• Draft and negotiate Data Protection Agreements (DPAs), Standard Contractual Clauses (SCCs) and outsourcing terms, aligning GDPR Art. 28, MiCAR Art. 73 and DORA Art. 30(3) obligations into one package
• Own the multi-jurisdiction incident and breach matrix and act as legal lead on live incidents
• Supervise data subject rights operations and personally handle complex or regulator-escalated requests
• Deliver the group's annual privacy and AI training programme

Requirements:

• Qualified lawyer with 5+ years of PQE. Must have a background in the fintech, securities, payment, or crypto industries.
• Meaningful exposure to data protection and privacy matters. While you do not need to be a pure privacy specialist, a working command of frameworks like GDPR, UK GDPR, Singapore PDPA, Bermuda PIPA, or the Australian Privacy Act is highly advantageous.
• Fluency in English and either Mandarin or Cantonese is strictly required.
• Hands‑on experience drafting and negotiating DPAs, SCCs, and transfer documentation, as well as exposure to managing data breaches, regulator notifications, or data subject requests.
• Certifications such as CIPP/E, CIPM, or equivalent qualifications in information/cyber-security are welcomed but not strictly mandatory. Practical experience is valued equally.
• Stakeholder Management: Comfortable holding an independent statutory seat and collaborating smoothly with Compliance, Risk, IT, MLRO, and CISO functions.