Data Privacy Consultant

Role Overview

Acuative is seeking a Senior Data Privacy Consultant to join the Personal Data Protection team of a prominent research university in Saudi Arabia. This role involves hands-on management of daily privacy operations to enhance the organization's compliance with the Saudi Personal Data Protection Law (PDPL) and SDAIA regulations. The consultant will act as a proactive partner to the Data Protection Officer (DPO), facilitating workshops, managing privacy documentation, conducting assessments, handling incidents, and mentoring internal privacy representatives for sustainable compliance improvements.

Key Responsibilities

• Identify departments and data processing activities lacking Records of Processing Activities (RoPAs), collaborating with stakeholders to develop and validate these records and obtain necessary approvals.
• Implement or utilize a screening method to evaluate processing activities, identifying high-risk ones to conduct Data Protection Impact Assessments (DPIAs), assign owners for risks and controls, and monitor remediation progress through a Governance, Risk, and Compliance (GRC) system.
• Establish and apply a risk-tiering framework for third-party data processors, focusing on assessing high-risk vendors, recommending corrective measures, and integrating robust security controls into agreements, including KSA Standard Contractual Clauses.
• Support comprehensive data breach management processes, encompassing incident containment, root cause analysis, mitigation, and coordination with cyber security, legal, communications, and human resources teams, as well as regulatory notification and inquiry response.
• Coordinate appointment and training of Privacy Champions within business units, clearly defining roles and ensuring a structured handover with ongoing support.
• Manage Data Subject Rights (DSR) requests by overseeing their reception, registration, validation, and resolution while optimizing the workflow to eliminate bottlenecks.
• Review and advise on data minimization practices, update privacy notices reflecting operational changes, and ensure retention schedules comply with PDPL mandates, assisting in establishing deletion procedures.
• Create and deliver tailored privacy training programs and develop online modules to enhance organizational privacy awareness.
• Perform additional privacy-related duties as directed by the PDP function and DPO.

Candidate Profile

• Minimum of six years in data privacy, data protection, or governance risk and compliance roles, including at least two years of active operational privacy experience.
• In-depth knowledge of Saudi Arabian PDPL, implementing regulations, Data Transfer Regulations, and SDAIA guidelines. Familiarity with GDPR is advantageous.
• Demonstrated capability in creating and managing RoPAs, conducting DPIAs, and assessing third-party privacy risks.
• Proven experience handling personal data breaches including regulatory reporting.
• Expertise in managing DSR requests and maintaining related registers.
• Strong skills in facilitating workshops and managing stakeholders across legal, IT, security, procurement, and business units.
• Competence in drafting clear compliance documents such as Data Processing Agreements, Standard Contractual Clauses, privacy notices, retention policies, role descriptions, and training content.
• Proficiency in English communication, both written and spoken.
• Willingness to work full-time onsite in Thuwal, Kingdom of Saudi Arabia.
• Preferred qualifications include certifications such as CIPP/E, CIPM, or CIPT; experience with GRC tools (e.g., ServiceNow GRC, OneTrust, Archer); background in higher education or research environments dealing with human subject data; Arabic language skills; and knowledge of information security standards like ISO 27001 and NCA ECC.