Data Governance and Privacy Manager

Old Mutual Life Assurance Company (SA) Ltd (PFA); Johannesburg; On-site; ZAR 900,000 - 1,500,000; Full time

Job summary

Old Mutual Life Assurance Company (SA) Ltd (PFA) is seeking a Data Governance and Privacy Manager to establish independent 2nd line oversight of data governance, data risk, data quality and privacy compliance across OMI. The role ensures data is treated as a strategic asset and aligns with SA regulatory mandates such as POPIA.

You will provide independent challenge to 1st line operations, define risk appetites, oversee DPIAs, data lineage and access controls, and collaborate with Compliance,

Qualifications

• Independent oversight of data governance, data risk, data quality and privacy compliance.
• Ability to define data risk taxonomy and appetite statements.
• Experience challenging first-line risk assessments and controls.

Responsibilities

• Establish and maintain a Data Risk Management Framework aligned to enterprise risk.
• Define data risk taxonomy including data quality, privacy and lineage.
• Provide independent challenge to first line operating units.
• Oversee DPIAs for new initiatives and technology implementations.
• Review data incidents, breaches and root cause analyses.
• Monitor data migration risks and regulatory submissions.

Skills

Data governance

Data risk

Data quality

Privacy compliance

Independent oversight

Regulatory alignment

Job description

Let's Write Africa's Story Together! Old Mutual is a firm believer in the African opportunity and our diverse talent reflects this.

Job Description

The Data Governance and Privacy Manager is responsible for establishing, leading, and maintaining independent 2nd line oversight of data governance, data risk, data quality and privacy compliance across OMI.

This role ensures that OMI manages data as a strategic and regulatory compliant asset. The incumbent provides independent challenge to 1st line operational teams (IT, Data Architecture, Engineering, Underwriting, Claims and Operations) while ensuring full alignment with SA regulatory mandates and requirements (e.g. POPIA).

Responsibilities will include the following:

Data Risk Framework and Appetite

• Develop, maintain and embed the Data Risk Management Framework, policy and standards, aligned to the Old Mutual Group enterprise risk framework.
• Define the data risk taxonomy (data quality, data privacy, data lineage, retention, data access, AI/model data, third-party data).
• Propose data risk appetite statements, key risk indicators (KRIs) and tolerance thresholds for approval by the risk committees.
• Provide independent oversight of the implementation and effectiveness of data governance policies, standards, procedures and control frameworks.
• Ensure that data risks are appropriately integrated into enterprise risk registers, technology risk assessments, operational risk assessments and relevant business risk management processes.
• Maintain a forward-looking view of emerging data risks arising from business strategy, digital transformation, acquisitions, technology changes, outsourcing and new data use cases.

Independent Data Risk Oversight and Challenge

• Conduct independent reviews and risk assessments of material data processes, systems, business initiatives, third-party vendor data sharing agreements and change programmes.
• Review and challenge first-line risk and control self-assessments (RCSAs) for data-related risks across underwriting, claims, finance, actuarial and IT.
• Oversee and challenge Data Protection Impact Assessments (DPIAs) for all new business initiatives products, and technology implementations.
• Evaluate the design and operating effectiveness of data controls, including preventive, detective and corrective controls.
• Identify systemic weaknesses, recurring control failures and risk concentrations across business units, applications, data domains and third parties.
• Review material data incidents, breaches, quality failures and reporting inaccuracies to assess root causes, control weaknesses and the adequacy of management responses.
• Track data risk events, incidents and breaches through root-cause analysis to closure of remediation actions.

Data Governance and Data Quality Oversight

• Assess whether appropriate controls exist to ensure data is accurate, complete, consistent, valid, timely, unique and fit for its intended purpose.
• Oversee the risk management practices supporting data lineage, traceability, reconciliation and data transformation across source systems, operational platforms, data warehouses and reporting environments.
• Monitor material data quality issues, recurring exceptions, unresolved defects and the effectiveness of corrective actions.
• Provide oversight of data migration and conversion risks, including reconciliation, completeness validation, record integrity and business sign-off.
• Assess the reliability of critical management information and regulatory submissions where data deficiencies could affect decision-making, financial soundness or regulatory compliance.

Data Privacy, Protection and Confidentiality Risk

• Provide independent oversight of data protection and privacy risks in collaboration with the Information Officer, Privacy, Legal, Compliance and Information Security functions.
• Assess whether appropriate controls are in place to protect personal, sensitive, confidential and commercially critical information throughout its lifecycle.
• Oversee risk management arrangements relating to data classification, access restrictions, encryption, masking, anonymisation, secure transfer, retention and secure disposal.
• Assess risks associated with unauthorised access, disclosure, loss, alteration, misuse or inappropriate sharing of data.
• Challenge weaknesses in data access governance, including excessive privileges, inappropriate access, segregation-of-duties conflicts and inadequate periodic access reviews.
• Assess risks arising from the processing and sharing of policyholder, claimant, beneficiary, employee and other personal information.
• Provide risk oversight of cross-border data transfers, outsourced processing, data sharing arrangements and the use of external service providers.
• Monitor material data privacy and confidentiality incidents, ensuring that root causes, control weaknesses and corrective actions are addressed by accountable First Line owners.
• Support the relevant control functions in assessing compliance with appli