Data Protection Specialist

FairPrice Group; Singapore; On-site; SGD 90,000 - 130,000; Full time

Job summary

FairPrice Group seeks a Data Protection Specialist to safeguard customer and employee personal data across its digital, retail, food services, and loyalty units. You will work under the GRC - Data Protection team to operationalise, monitor, and enhance the Data Protection function.

The role balances PDPA compliance with protecting commercially sensitive assets, partnering with BU and CF data owners to eliminate data blindspots and ensure ongoing risk mitigation.

Qualifications

• Understanding of Singapore PDPA and advisory guidelines.
• Professional privacy certifications (e.g., CIPP/A, CIPM, CIPT) preferred.
• Ability to translate regulatory mandates into business context.

Responsibilities

• Support DPIA pre- and post-implementation checks on systems and data stores.
• Verify data protection controls are enforced before and after go-live.
• Maintain Data Asset Inventory and data mapping with data owners.
• Ensure centralized registry of data assets with no shadow processing.
• Support breach readiness and regulatory reporting in incidents.
• Monitor data retention and disposal compliance across departments.

Skills

PDPA knowledge

Privacy certifications

Regulatory compliance

Data protection

Stakeholder communication

Education

Bachelor’s Degree in Law/Info Security/CS or related

Job description

Job Description

As a Data Protection Specialist at FairPrice Group (FPG), you will play a critical role in safeguarding customer and employee personal data across FPG’s expanding digital, retail, food services, and loyalty business units. Reporting directly to the GRC - Data Protection team, you will support the operationalisation, monitoring, and continuous enhancement of FPG’s Data Protection function.

This role balances statutory regulatory compliance under the Singapore Personal Data Protection Act 2012 (PDPA) with the active protection of commercially sensitive and confidential corporate assets. You will work closely with Business Unit (BU) and Corporate Function (CF) data owners to eliminate operational data blindspots, ensure that data protection controls are maintained after implementation, and transition FPG into a robust, active risk mitigation model.

Key Responsibilities & Core Duties

• Compliance Assurance & Control Verification


• Data Protection Impact Assessment (DPIA) : Perform pre- & post-implementation compliance checks on business systems, databases, and applications after a DPIA has been executed.


• Control Verification: Verify and ensure that approved data protection and cybersecurity controls are not modified, bypassed, or dropped prior to or after going live.


• Data Asset Inventory (DAI) Management


• Data Mapping: Engage directly with BU and CF data owners to systematically catalog, map, and document all active data repositories and cross-border data flows.


• Single Source of Truth: Maintain and update a centralized, comprehensive registry of FPG’s data assets, ensuring no shadow data processing or operational blindspots exist.


• Breach Readiness Support: Keep data flow maps updated to support immediate risk assessments and regulatory reporting in the event of a security incident.


• Data Retention & Disposal Auditing


• Retention Compliance Checks: Establish, schedule, and run localized data retention and disposal compliance checks across various departments.


• Data Minimization: Partner with business units to actively purge, anonymize, or destroy stale customer personal data and legacy commercial bidding documentation that no longer serve business or legal purposes.


• Liability Reduction: Minimize toxic data accumulation to reduce FPG’s total storage risk and potential exposure during regulatory investigations or litigation discovery.


• User Access & Privilege Reviews


• Access Control Audits: Partner with system administrators, IT security, and system owners to conduct continuous, programmatic user access privilege reviews.


• Least Privilege Enforcement: Audit internal data-sharing workflows and strictly enforce the principle of least privilege across all applications containing customer or employee personal data.


• Asset Protection: Safeguard highly sensitive, commercially confidential corporate assets (e.g., product margins, pricing algorithms, vendor agreements) from unauthorized internal access or accidental disclosure.


• Compliance Monitoring & Drift Management


• Monitoring Calendar: Administer and execute the annual data protection compliance monitoring calendar, conducting cross-departmental spot-checks and audits.


• Metrics Compilation: Gather, track, and compile key data risk metrics and compliance indicators for reporting to the Data Protection Lead and senior management.


• Emerging Tech & AI Alignment: Monitor and manage compliance drift as operational practices evolve, particularly regarding the deployment of generative AI chatbots, automated recommendation systems, and customer voicebots, aligning them with IMDA/PDPC guidelines.

Job Requirements

• Bachelor’s Degree in Law, Information Security, Business Administration, Computer Science, or a related discipline.


• Professional privacy certifications (e.g., CIPP/A, CIPM, CIPT), or holding a Practitioner Certificate in Personal Data Protection (Singapore), are highly preferred.


• 3 to 5 years of direct operational experience in data protection, privacy compliance, legal affairs, information security governance, or corporate risk management.


• Deep and comprehensive understanding of the Singapore Personal Data Protection Act 2012 (PDPA), including PDPC Advisory Guidelines


• Comfort and familiarity in evaluating digital architectures, software integrations, marketing campaign structures, and data flows. Proven ability to translate complex regulatory mandates into pragmatic, commercial business contexts.


• Possesses the professional gravity, communication skills, and confidence to engage with business unit heads, challenge operational practices, and push back on compliance deviations without relying on constant escalation.