Data Governance and Privacy Manager

Old Mutual South Africa; Johannesburg; On-site; ZAR 900,000 - 1,300,000; Full time

Job summary

Old Mutual South Africa, Johannesburg, invites a Data Governance and Privacy Manager to lead independent 2nd line oversight of data governance, data risk, data quality and privacy compliance across OMI. The role challenges 1st line teams to meet SA regulatory mandates, including POPIA, while treating data as a strategic asset.

You will establish frameworks, monitor DPIAs, data risk indicators, and control effectiveness, and ensure data incidents are investigated and remediated.

Responsibilities

• Data Risk Framework and Appetite: Develop, maintain and embed the Data Risk Management Framework, policy and standards, aligned to the Old Mutual Group enterprise risk framework.
• Define the data risk taxonomy (data quality, data privacy, data lineage, retention, data access, AI/model data, third-party data).
• Propose data risk appetite statements, KRIs and tolerance thresholds for approval by risk committees.
• Provide independent oversight of data governance policies, standards, procedures and control frameworks.
• Ensure data risks are integrated into enterprise risk registers, technology risk assessments and business risk management processes.
• Maintain a forward-looking view of emerging data risks from strategy, digital transformation, acquisitions and new data use cases.
• Independent Data Risk Oversight and Challenge: Conduct independent reviews and risk assessments of material data processes, systems, third-party data sharing and change programmes.
• Review and challenge first-line RCSAs for data-related risks across underwriting, claims, finance, actuarial and IT.
• Oversee DPIAs for new initiatives, products and technology implementations.
• Evaluate design and operating effectiveness of data controls.
• Identify systemic weaknesses and risk concentrations across units, applications, data domains and third parties.
• Review material data incidents and breaches to assess root causes and remediation.
• Track data risk events and breaches through remediation actions.
• Data Governance and Data Quality Oversight: Assess controls to ensure data is accurate, complete, consistent, valid, timely, unique and fit for purpose.
• Oversee risk management practices supporting data lineage, traceability, reconciliation and data transformation across source systems, platforms, data warehouses and reporting environments.

Job description

Let's Write Africa's Story Together!

Old Mutual is a firm believer in the African opportunity and our diverse talent reflects this.

Job Description

The Data Governance and Privacy Manager is responsible for establishing, leading, and maintaining independent 2nd line oversight of data governance, data risk, data quality and privacy compliance across OMI.

This role ensures that OMI manages data as a strategic and regulatory compliant asset. The incumbent provides independent challenge to 1st line operational teams (IT, Data Architecture, Engineering, Underwriting, Claims and Operations) while ensuring full alignment with SA regulatory mandates and requirements (e.g. POPIA).

Responsibilities will include the following:

Data Risk Framework and Appetite

• Develop, maintain and embed the Data Risk Management Framework, policy and standards, aligned to the Old Mutual Group enterprise risk framework.
• Define the data risk taxonomy (data quality, data privacy, data lineage, retention, data access, AI/model data, third-party data).
• Propose data risk appetite statements, key risk indicators (KRIs) and tolerance thresholds for approval by the risk committees.
• Provide independent oversight of the implementation and effectiveness of data governance policies, standards, procedures and control frameworks.
• Ensure that data risks are appropriately integrated into enterprise risk registers, technology risk assessments, operational risk assessments and relevant business risk management processes.
• Maintain a forward-looking view of emerging data risks arising from business strategy, digital transformation, acquisitions, technology changes, outsourcing and new data use cases.

Independent Data Risk Oversight and Challenge

• Conduct independent reviews and risk assessments of material data processes, systems, business initiatives, third-party vendor data sharing agreements and change programmes.
• Review and challenge first-line risk and control self-assessments (RCSAs) for data-related risks across underwriting, claims, finance, actuarial and IT.
• Oversee and challenge Data Protection Impact Assessments (DPIAs) for all new business initiatives products, and technology implementations.
• Evaluate the design and operating effectiveness of data controls, including preventive, detective and corrective controls.
• Identify systemic weaknesses, recurring control failures and risk concentrations across business units, applications, data domains and third parties.
• Review material data incidents, breaches, quality failures and reporting inaccuracies to assess root causes, control weaknesses and the adequacy of management responses.
• Track data risk events, incidents and breaches through root-cause analysis to closure of remediation actions.

Data Governance and Data Quality Oversight

• Assess whether appropriate controls exist to ensure data is accurate, complete, consistent, valid, timely, unique and fit for its intended purpose.
• Oversee the risk management practices supporting data lineage, traceability, reconciliation and data transformation across source systems, operational platforms, data warehouses and reporting environments.