Data Protection Officer

Data Protection Officer

**About Tamara**

Tamara is the leading shopping and payments platform in Saudi Arabia and the GCC region, with a mission to empower people in their daily lives and revolutionize how they shop, pay, and bank. The company was founded by serial entrepreneur Abdulmajeed Alsukhan along with his partners Turki Bin Zarah and Abdulmohsen Al Babtain. Tamara operates out of its headquarters in Riyadh, Saudi Arabia, and has offices in the UAE, Egypt, Germany, and Vietnam. Our large, dedicated team of professionals continues to grow as we expand our reach and impact.

**Role Overview**: The Data Protection Officer (DPO) is responsible for developing, implementing, and managing the organization's data protection strategy to ensure full compliance with the Saudi Personal Data Protection Law (PDPL) and other applicable data protection regulations. The DPO serves as the primary point of contact for all data privacy and protection matters, ensuring that personal data is processed legally, securely, and ethically throughout the organization.

**Key Responsibilities**:

- **Develop and Implement Data Protection Policies**:

- Establish and maintain comprehensive data protection policies, procedures, and guidelines in alignment with the Saudi PDPL and international best practices.
- Ensure all data processing activities comply with PDPL and integrate data protection principles into all organizational processes.
- Create a data governance framework that includes policies for data retention, data deletion, and data archiving, aligned with PDPL.
- **Monitor Compliance with PDPL and Other Regulations**:

- Conduct regular reviews and audits of data processing activities to ensure compliance with PDPL.
- Identify, assess, and mitigate potential compliance gaps and collaborate with relevant stakeholders to implement corrective measures.
- Maintain documentation to demonstrate compliance with PDPL requirements, including data processing activities, risk assessments, and decisions related to data protection.
- **Manage Data Protection Impact Assessments (DPIAs)**:

- Ensure that DPIAs are carried out in accordance with PDPL and that any identified risks are mitigated effectively.
- **Handle Data Subject Requests and Complaints**:

- Address complaints related to data protection from internal and external parties, ensuring swift resolution in compliance with PDPL.
- **Manage Data Breach Response**:

- Establish and maintain a data breach response plan compliant with PDPL requirements.
- Ensure thorough documentation of all breaches and corrective actions taken, meeting PDPL's notification and reporting obligations.
- **Serve as Point of Contact with Regulatory Authorities**:

- Act as the primary liaison between the organization and the Saudi Data and Artificial Intelligence Authority (SDAIA) or other relevant regulatory bodies.
- Coordinate and prepare responses to inquiries, audits, and investigations from regulatory authorities.
- Maintain a positive and cooperative relationship with regulators, providing necessary documentation and information promptly.
- **Provide Training and Awareness**:

- Develop and deliver comprehensive training programs to educate employees about their responsibilities under PDPL and the organization's data protection policies.
- Conduct regular awareness sessions and workshops to foster a culture of data protection and privacy compliance within the organization.
- **Advise on Data Protection Strategy and Governance**:

- Provide strategic advice to senior management on data protection matters, including risk management, data security, and regulatory compliance.
- Work closely with IT, Legal, HR, and other departments to integrate data protection into all organizational functions.
- Develop and implement a roadmap for ongoing data protection improvements, aligned with business objectives and PDPL requirements.
- **Maintain Records of Processing Activities (RoPA)**:

- Ensure the creation and maintenance of comprehensive records of all data processing activities conducted by the organization, in line with PDPL.
- Ensure these records are accurate, up to date, and readily available for inspection by regulatory authorities.
- **Stay Up to Date with Legal Developments**:

- Monitor and interpret changes in PDPL and other data protection regulations to provide proactive advice to the organization.
- Update internal policies and procedures as necessary to reflect new regulatory requirements or best practices.
- **Develop and Oversee Consent Management Processes**:

- Ensure clear and transparent communication about the purposes for data collection and processing, and manage consent withdrawal efficiently.
- **Ensure Compliance with Data Localization Requirements**:

- Ensure that all personal data collected or processed is stored in compliance with PDPL's data localization requirements, ensuring data is stored within Saudi Arabia unless specific conditions allow otherwise.
- Work with IT