Data Privacy and Protection Specialist

FirstRand Bank; Johannesburg; On-site; ZAR 520,000 - 900,000; Full time

Job summary

FirstRand Bank Limited is seeking a Data Privacy Specialist (SME) to join the Data Privacy and Protection CoE. The role strengthens privacy capabilities across the organisation, focusing on governance, documentation, and risk management.

You will work with data owners, product teams, and engineers to embed privacy-by-design in AI and analytics initiatives. Ideal candidates will have 4–5 years in privacy programme management, solid knowledge of PAIA/POPIA, and experience with leading privacy

Qualifications

• LLB/B.Com LLB or related field required; strong grounding in governance.
• 4–5 years in Data Privacy Programme Management.
• Working knowledge of PAIA/POPIA and practical application to access requests.
• Experience with privacy tech platforms is a plus.

Responsibilities

• Lead privacy operations and governance activities.
• Draft and harmonise privacy documentation.
• Assess privacy risks in designs and implementations.
• Embed privacy-by-design across AI and analytics projects.
• Coordinate privacy risk assessments and DPIAs.
• Deliver privacy training and awareness globally.

Skills

Privacy governance

Data privacy law

Stakeholder management

Audit risk

Compliance frameworks

Education

LLB

B.Com LLB

Risk Management

Audit

Tools

OneTrust

TrustArc

Securiti

Job description

Job Description

We are seeking a highly skilled and experienced Data Privacy Specialist (SME) to join our Data Privacy and Protection Centre of Excellence (CoE) with FirstRand. This role is pivotal in strengthening our data privacy and protection capabilities across the organisation. Hello future Data Privacy and Protection Technical SME

FirstRand believes that its people are its single most important resource and will not operate in a sector unless it has people who are right for that market and who share FirstRand's business values. We recruit self-starters who have a passion for what they do. We empower them, hold them accountable and reward them appropriately. We value diversity in our people, particularly for the way that this contributes to innovative thinking. If you think you will flourish in our environment, and you believe you have the necessary skills and competencies for the position advertised, then we are looking for you!

Key Responsibilities

• Privacy Operations & Governance
• Represent the CoE and provide subject matter expertise in privacy for Information Governance, Data Privacy and Protection Risk Framework, PAIA, and Industry engagements across FirstRand.
• Support the evolution of FirstRand's Privacy and PAIA program globally in alignment with international data protection frameworks and best practice.
• Draft, review, maintain, and harmonise privacy documentation, including internal procedures, notices, guidance, and training materials.
• Identify and assess potential privacy risks inherent in technical designs and implementations and contribute to implement privacy enhancing features and fixes.
• Maintain and oversee Data Privacy and PAIA risks, coordinating with stakeholders to ensure implementation of mitigation plans.
• Engage with data owners, architects, and product teams to embed privacy-by-design ( PdD ) principles generally. Collaborate with relevant teams to ensure PdD in the development and deployment of AI, analytics, and other emerging technologies.
• Contribute to the privacy risk assessments for AI and other innovative use cases for technology, data sharing, and automation tools.
• Support the automation of privacy operations to scale compliance and accelerate the responsible use of personal information across FirstRand. Oversee implementation, ongoing management, reporting, and quality control of privacy management platforms and tools. Collaborate with information security and information technology teams to align privacy technologies with security controls.
• Develop and maintain user guidelines and provide training on privacy platform functionality and best practices, including privacy assessments, records of processing activities ( RoPA ), third party risk assessments, incident management and PAIA management.
• Review governance and business requirements and define workflows and processes that support efficient privacy and PAIA management activities within FirstRand.
• Enhance and support the privacy incident management process, coordination efforts, investigations and root cause assessments.
• Conduct and advise on privacy and PAIA assurance, monitoring, and audit activities.
• Conduct and advise on data privacy impact assessments, third party risk assessments, and the management of RoPAs.
• Support development and appropriate management of Data Subject Rights' workflows.
• Establish and manage essential PAIA and Privacy management information dashboards and reporting tools. Track key metrics such as the number of Data Subject Access Requests (DSARs), incident volumes and trends, initiated and completed Data Protection Impact Assessments (DPIAs), vendor reviews, and other relevant data across FirstRand.
• Coordinate and deliver privacy training and awareness initiatives, ensuring global relevance and compliance with local regulations.
• Assess training needs by engaging stakeholders, reviewing incidents/metrics, and staying current on regulatory requirements and organizational changes.

Required Qualifications

• Minimum: LLB, B.Com LLB, or Risk Management, Audit, or related field.
• Advantageous: CIPP/E, CIPM, CIPT, or similar.
• Experience:
• 4-5 years in Data Privacy Programme Management, or related fields.
• Working knowledge of PAIA and POPIA and their practical application to access-to-information requests.
• Proven experience with data privacy laws, PAIA, compliance frameworks, and IT risk governance.
• Exposure to privacy issues related to AI, data analytics, or other emerging technologies is a strong advantage.
• Advantageous: Hands on experience with industry leading privacy management platforms and tools (e.g., OneTrust, TrustArc, Securiti, etc.).
• Governance, Risk and Compliance automation.
• Strong written communication, attention to detail and ability to operate within statutory deadlines.

Core Competencies

• Ability to deliver practical, pragmatic, and creative privacy solutions.
• Strong analytical and problem-solving skills, with the ability to use metrics to drive improvement.
• Excellent communicatio