Data Protection Manager / Privacy Manager (9-month contract), OLGA

Responsibilities

• This position is for Office of Legal and General Affairs (OLGA).
• Multi-jurisdiction privacy compliance
• Accountable for ensuring the University's data protection and privacy practices remain compliant across Singapore, China, Indonesia, Thailand, and Vietnam — including monitoring the regional regulatory environment, assessing the impact of legal changes on University programmes, services, systems, and research, and translating new requirements into practical compliance action, with particular attention to higher-risk markets.
• Privacy assessments, agreements, and documentation
• Accountable for conducting Data Protection Impact Assessments and reviewing and negotiating data privacy clauses, Data Processing Agreements, collection statements, and consent language with vendors, partners, and third parties; and for developing and maintaining current privacy policies, notices, templates, and records of processing (including localisation across jurisdictions).
• Stakeholder advisory and programme support
• Accountable for advising faculties, professional units, and other stakeholders on the legality and operational feasibility of products, systems, and programmes; handling information requests from authorities and third parties lawfully and proportionately; embedding privacy-by-design into new systems and services; and delivering privacy awareness and training across the University.
• Governance and regulator engagement
• Accountable for supporting the DPOs in maintaining the data protection management programme (data inventory mapping, risk assessments, gap analysis, controls), in acting as a contact point for data protection authorities, and in breach and incident handling — including investigation support, documentation, and remediation tracking.
• Other duties as assigned.
  

Qualifications

• Essential
• Degree or Diploma holder, with a strong grounding in data protection and privacy.
• Desirable
• A privacy certification — for example, IAPP CIPP/A, CIPP/E, CIPM, or FIP
• Knowledge
• Working knowledge of data protection and privacy law across the relevant APAC jurisdictions — Singapore, China, Indonesia, Thailand, and Vietnam — including the ability to interpret and apply fast-evolving regional requirements. Familiarity with privacy operational practices such as Data Protection Impact Assessments, records of processing, data inventory mapping, risk and gap analysis, privacy-by-design, and breach/incident handling. Understanding of Data Processing Agreements, privacy clauses, collection statements, and consent mechanisms. Awareness of regulator expectations and processes for engaging data protection authorities.
• Skills
• Practical judgement — the ability to balance risk against operational feasibility and give clear, actionable advice. The ability to manage competing priorities across multiple jurisdictions in an organised and timely way, working independently as a subject-matter lead. Attention to detail.
  

Other Information

Remuneration and appointment terms shall commensurate with qualifications and experience. SMU reserves the right to modify the appointment terms where necessary.