Compliance, Licensing & Data Protection Manager (DPO)

Role Overview

The Compliance, Licensing & Data Protection Manager will be responsible for leading MHC's data protection, risk, and compliance framework, including all licence and grant applications, ensuring the organisation meets all regulatory, contractual, and certification requirements.

This role also serves as the appointed Data Protection Officer (DPO) under Singapore's Personal Data Protection Act (PDPA), and is expected to provide clear, practical, and commercially sound advice to the business on data protection, regulatory, licensing, and compliance matters.

The role will work closely with Business Units, Technology, Operations, Finance, and Group Legal, and is critical in ensuring MHC maintains strong governance standards while enabling business growth and unlocking new commercial opportunities through licensing and grant funding.

Key Responsibilities

Data Protection Leadership (DPO Function)

Serve as the appointed Data Protection Officer (DPO) for MHC
Ensure compliance with the Personal Data Protection Act (PDPA) and related regulations
Develop, review, and update:
Privacy Notices
Terms of Use
Data protection policies and procedures
Provide practical, timely advice to business teams on:
data sharing arrangements
client contracts and integrations
product and platform design (e.g. telemedicine, claims, apps)
Lead and manage Data Protection Impact Assessments (DPIA)
Handle data incidents, breaches, and regulatory reporting, including PDPC engagement where required

Governance, Risk & Compliance (GRC)

Develop, review, and maintain risk and compliance policies and frameworks
Monitor and advise on regulatory developments, including:
PDPC (data protection)
MAS guidelines (e.g. TRM, TPRM where applicable)
MOH and other healthcare-related regulatory developments where relevant
Provide business-facing guidance on regulatory implications and risk mitigation
Support and align with Group ERM and Legal functions

Enterprise Risk Management (ERM)

Lead and manage MHC's enterprise risk management framework, including:
Business Continuity Management (BCM) Risk Assessments
Technology Risk & Vulnerability Assessments (TVRA)
Anti-Money Laundering Risk Assessments (AML RA)
Data Protection Impact Assessments (DPIA)
Business Impact Analysis (BIA)
Track and report key risks, and ensure mitigation actions are implemented

Certifications & Audit Management

Lead and support certification and audit activities, including:
ISO 27001 (Information Security Management System)
ISO 22301 (Business Continuity Management)
OSPAR Attestation
Maintain and update documentation to ensure ongoing compliance
Support MHC's ambition to achieve Singapore Data Protection Trustmark (DPTM)

Licence & Grant Applications

Lead all new licence applications required by MHC's business activities, including but not limited to insurance-related licences, healthcare-related approvals, and any other regulatory licences applicable to MHC's products and services
Identify licensing requirements early in the product / business development cycle and advise the business on regulatory pathways, timelines, and feasibility
Prepare, coordinate, and submit licence applications, ensuring all supporting documentation, policies, and controls are in place
Serve as the primary liaison with regulators (e.g. MAS, MOH, PDPC, IMDA, and other relevant authorities) for licence-related matters
Manage ongoing licence obligations, including renewals, reporting, variations, and notifications
Lead grant applications relevant to MHC, including but not limited to government grants, innovation grants, digitalisation grants, and sector-specific funding (e.g. EDG, PSG, MAS FSTI, IMDA, Enterprise Singapore schemes)
Identify and assess grant opportunities, working with Business Units, Technology, and Finance to scope eligible projects and prepare strong submissions
Manage grant lifecycle: application, approval, claims, milestone reporting, audit, and acquittal
Maintain a centralised tracker of licences held, licences pending, grant applications, and associated obligations
Engage external consultants or advisors where appropriate, and manage them to deliver value-for-money outcomes

Data Governance & Legal Support

Support data governance initiatives in collaboration with Group Legal
Provide input and review on:
data-related contractual clauses
client and partner agreements
Ensure appropriate controls are in place for data access, sharing, and retention

Client, Vendor & Regulatory Due Diligence

Support client due diligence requests, audits, and RFP requirements
Manage vendor due diligence (VDD) assessments, particularly for technology and data vendors
Represent MHC in client audits and compliance discussions

Incident Management & Corrective Actions

Lead investigation and management of compliance and data-related incidents
Manage and track Corrective Action Reports (CAR) to closure
Ensure root cause analysis and implementation of preventive measures

IT Security & Operational Support

Work with Technology teams on:
ISMS (Information Security Management System)
BCMS (Business Continuity Management System)
Support security exercises, audits, and risk assessments

Key Requirement (Critical for Success)

Must be able to advise the business clearly and confidently on data protection, compliance, and licensing matters, including:
interpreting PDPA in real business scenarios
guiding commercial decisions involving data
balancing regulatory compliance with operational practicality
identifying and pursuing licence and grant opportunities that support business growth

Requirements

Bachelor's degree or Diploma in Law, Business, Information Security, or a related field
8–12 years of experience in data protection, compliance, risk, or governance roles
Strong working knowledge of:
Singapore PDPA and PDPC guidelines
Data protection practices within healthcare, insurance, or financial services sectors
Must have experience with:
ISO 27001, ISO 22301, and audit frameworks
Enterprise risk management processes
Regulatory audits and client due diligence
Demonstrated experience in leading licence applications and/or grant applications (e.g. MAS, MOH, IMDA, Enterprise Singapore, or equivalent regulatory / funding bodies) is highly preferred
Familiarity with MAS Technology Risk Management (TRM) and Third Party Risk Management (TPRM) guidelines is an advantage
Experience or exposure to Singapore Data Protection Trustmark (DPTM) is preferred
Strong project management, stakeholder management, and written communication skills, with the ability to manage multiple regulatory and funding workstreams concurrently