Role Purpose (Why do we need this role)
To support the Head of Risk & Compliance in the execution and operational delivery of the Group's risk management and compliance frameworks. The role provides analytical, technical, and governance support to ensure effective implementation of data protection programmes, sanctions compliance, enterprise risk management, and crisis management.
Role Accountabilities (What is this role responsible for delivering)
Data Protection
- To monitor applicable data protection and privacy laws, including but not limited to the Personal Data Protection Act (PDPA) and the General Data Protection Regulation (GDPR), and to provide functional guidance on compliance therewith. This includes assigning roles and responsibilities within the internal privacy working groups, as well as identifying and communicating regulatory obligations, risks, and implications arising from new or amended data protection laws and regulations.
- To review and update internal data protection policies and documentation (including, but not limited to, the Data Protection & Privacy Policy, Cookies Policy, and Privacy Notices), and to ensure the implementation and ongoing monitoring of compliant processes governing the collection, accuracy, retention, use, security, transparency, access to, and correction of personal data.
- To review and advise on contractual provisions relating to data protection, including data privacy clauses, non-disclosure agreements (NDAs) and Data Processing Agreements (DPAs), to ensure consistency with applicable legal and regulatory requirements.
- To collaborate with designated process owners in the completion of Privacy Impact Assessments (PIAs) and Personal Data Processing (PDP) risk assessments, and to provide guidance on privacy by design and by default principles, including the identification, mitigation, and remediation of privacy risks.
- To ensure that all requests, enquiries, and complaints from data subjects are managed and responded to within prescribed timelines, in compliance with applicable legal and regulatory requirements.
- To interface with data subjects, as required, to provide transparent information regarding the processing of their personal data, including their rights (such as access, correction, and erasure), and the safeguards implemented by the organisation to protect such data.
- To support and advise on data protection compliance audits and impact assessments, including determining when such assessments are required, the appropriate methodologies to be applied, the adequacy of safeguards implemented, and whether the outcomes of such assessments are compliant with applicable data protection laws.
- To work in coordination with Information Technology and relevant stakeholders to maintain and update a comprehensive register of processing activities (ROPA), providing an accurate and current record of all personal data processing activities undertaken by the organisation.
- To escalate to the Data Protection Officer on any data breaches and immediate remediations actions.
Sanctions Compliance
- To conduct sanctions due diligence and review in respect of counterparties, vessels, and dual-use goods, and to escalate identified risks or potential breaches in coordination with the Head of Risk and Compliance, Legal, and other relevant stakeholders.
- To review and provide advice on contractual provisions relating to sanctions compliance, ensuring alignment with applicable laws, regulations, and internal policies.
- To monitor and assess regulatory developments in relation to sanctions and export controls, and to support gap analyses, internal audits, and remediation initiatives to address new or evolving compliance requirements.
Enterprise Risk Management
- Maintain Corporate Risk Register, including risk identification, assessment and mitigation tracking and reporting
- Coordinate risk reporting cycles and preparation of material & meeting minutes for quarterly Risk Committee meetings.
Crisis Management
- Make every effort to be aware of and understand your role in the event of a crisis.
- Make every effort to attend any relevant training, simulations and or meetings relating to Crisis Management
- Perform your role as best as possible in a calm and collaborative manner in line with the relevant policy and procedures in the event of a Crisis
- Provide input and feedback towards the ongoing improvement of the Crisis Management framework and procedure.
Key Qualifications & Skills(What knowledge will ensure success in the role)
Technical Skills
- Above 5 years of experience in Data Privacy, Sanctions Compliance, Enterprise Risk Management, or related disciplines
- Bachelor's degree in law, Business or any related discipline; professional certification such as Certified Information Privacy Manager (CIPM) or Certified Information Privacy Professional/ Europe (CIPP/E) will be advantageous
- Clear understanding of data protection laws, privacy & Sanctions compliance requirements especially in cross border environments
- Familiarity with compliance monitoring, internal controls and regulatory frameworks
Professional Skills
- Strong analytical and problem-solving skills
- Good organisational and coordination capabilities
- Effective communication skills with ability to engage cross-functionally
- Ability to manage multiple priorities in a dynamic operational environment
- Demonstrates integrity, professionalism and attention to detail
