Data & Privacy Compliance Officer

Job Description

Trust, Data and Resilience (TDR)Our TDR team sits within the Group Operations function and is responsible for mission-critical areas including cyber, information, data, privacy and resilience. These are challenges that impact our clients globally. Our TDR team develops the platforms, drives the processes and builds partnerships to benefit millions of people every day. They thrive in providing solutions to complex issues, devote time and energy to designing new and innovative solutions, and all in an environment that demands being risk-aware, not risk-averse. TDR chooses progress over perfection and aims to always participate with a constructive purpose. The team makes an impact wherever they are based, be it in our offices around the world, our Global Business Solution centres in China, India, Malaysia and Poland, or even from our home.Now you have an opportunity to make a meaningful impact with a diverse and passionate team of creators, innovators and achievers. With us, you ll learn, be inspired, and make an impact every day. The success of our work hinges on how we use the unique diversity of our people to realise the effects we seek to achieve: Always on. Always safe. Always Simple.The Role ResponsibilitiesThis role is an essential part of the Group Data Protection Office (DPO) / the central Privacy Compliance team: the team responsible for setting global standards and providing expert guidance on the privacy, banking secrecy and data sovereignty requirements that the Group is subject to. The successful candidate will have the opportunity to work with stakeholders across the Group s broad footprint and all three lines of defence, and will be joining in time to influence the Group s approach to assessing and managing data risks as we embark on a data & privacy transformation programme.To be successful, the candidate should have experience in interpreting and advising on privacy or other data-related laws, or on data governance good practice; be a problem-solver and self-starter; and a strong communicator and team player.Strategy

• Provide advice on the interpretation, application and implementation of laws and regulations pertaining to privacy and data protection, banking secrecy and sovereignty;
• Support both the GDPO and deputy GDPO with the implementation of the Groups privacy strategy;
• Provide expert guidance on privacy and banking secrecy risk assessment and management.

Business

• Provide subject matter expertise (SME) guidance to Businesses and Functions, and colleagues in Conduct, Financial Crime & Compliance (CFCC) on privacy, secrecy and sovereignty risks and relevant mandatory obligations across the Group s footprint;
• Monitor relevant legislative and regulatory changes and advise on associated impact to the Group s business and operational functions;

• Actively engage in and contribute to the relevant workstreams of the Group s Data & Privacy Transformation Programme.

Processes

• Support implementation of a robust plan for managing privacy, secrecy and sovereignty risks;
• Review, assess and advise on Privacy Impact Assessments (PIAs), Records of Processing Activities and data incidents;
• Support global initiatives as requested by the GDPO;
• Help draft mandatory documentation, such as Standards and guidelines, and help maintain a library of mandatory documentation;
• Draft and maintain additional, non-mandatory documentation such as FAQs, guidelines and awareness-raising materials including content for the team s intranet (Bridge) site.

People and Talent

• Provide effective second-line subject-matter expertise and support to first and second line colleagues;
• Champion good privacy practice and standards across the Group;
• Develop and provide training to colleagues to support the wide adoption of data protection principles and good practices;
• Collaborate with first line colleagues to foster an environment that drives appropriate risk control behaviour, including early anticipation, identification and mitigation of privacy and other data risks, escalating issues in line with the Group s Operational Risk Framework.

Risk Management

• Oversee, monitor and challenge implementation of controls to mitigate risks;

• Ensure privacy, secrecy and sovereignty controls are tested in accordance with any controls testing plans;
• Support risk assessments to identify gaps and deficiencies, and help determine remedial action to correct or mitigate risk;
• Provide subject matter expertise and support on privacy, secrecy and sovereignty risk identification and management;
• Assist with the proactive and timely identification, assessment, and dissemination of evolving legal and regulatory changes / practices and associated risks on privacy, secrecy and sovereignty issues across the Group;
• Assist in agreeing the scope of audits and second-line / Compliance Monitoring Reviews;
• Support any firm-wide internal audits;
• Support the integration of privacy and secrecy requirements into the third-party risk management framework.

Governance

• Establish and maintain strong relationships with key stakeholders at all levels, while independently performing own duties;
• Work with first and second line colleagues to support the identification and development of innovative solutions to protect data and enhance the Group s approach to managing data-related risks.

Regulatory & Business Conduct:

• Display exemplary conduct and live by the Group s Values and Code of Conduct.
• Take personal responsibility for embedding the highest standards of ethics, including regulatory and business conduct, across the Group. This includes understanding and ensuring compliance with, in letter and spirit, all applicable laws, regulations, guidelines and the Group Code of Conduct.
• Support the Group Data Protection Office to achieve the outcomes set out in the Bank s Conduct Principles: Fair Outcomes for Clients; Effective Financial Markets; Financial Crime Compliance; The Right Environment.
• Effectively and collaboratively identify, escalate, mitigate and resolve risk, conduct and compliance matters.

Key Stakeholders

• Colleagues in Compliance / CFCC, including country DPOs and CFCC Assurance
• The first line Data Management & Privacy Operations and Processes & Controls teams
• The Chief Data Officer s team
• The Chief Information Security Risk Officer s team and other connected Policy owner teams
• Group Internal Audit
• Legal

Other Responsibilities

• Embed Here for good and Groups brand and demonstrate the Valued Behaviours in the Strategy, Governance and Core Compliance team.
• Perform other responsibilities as assigned.

,

Keyskills :
draftinglegalcompliancefilingformssubject matter expertiseenvironmental impact assessmentrisk controlmusic makingsecurity riskinternal audit