Personal Data Protection Specialist

Position Overview

We are seeking a highly skilled and dedicated Personal Data Protection Specialist to join our organization and lead our efforts in ensuring full compliance with the Saudi Personal Data Protection Law (PDPL) and other relevant data privacy regulations. This critical role will be responsible for developing, implementing, and monitoring robust personal data protection policies, procedures, and controls across all clinical, operational, and administrative functions. The ideal candidate will play a pivotal role in safeguarding the personal data of patients, employees, and stakeholders while fostering a culture of ethical and compliant data handling throughout the healthcare organization.

Key Responsibilities

The Personal Data Protection Specialist will be accountable for the following core responsibilities:

Organizational Accountabilities

• Policy and Procedure Compliance: Ensure all work is performed in strict adherence to approved policies, processes, procedures, and instructions. Identify opportunities for continuous improvement in systems, processes, and practices by leveraging leading industry practices, cost reduction strategies, and productivity enhancements.
• Operational Excellence: Ensure day-to-day activities are executed in alignment with established policies and procedures. Follow up on escalated cases or issues to guarantee efficient and timely resolution.
• Strategic Alignment: Support the organization’s data protection and privacy strategy in full compliance with PDPL and the National Data Management Office (NDMO) frameworks.
• Regulatory Compliance: Ensure adherence to Saudi PDPL, NDMO Data Governance Framework, and Ministry of Health (MOH) data privacy requirements.
• Privacy Principles: Promote the implementation of privacy-by-design and privacy-by-default principles across all healthcare systems and processes.
• Audit Preparedness: Support organizational readiness for regulatory, accreditation, and compliance audits related to personal data protection.
• Stakeholder Collaboration: Work closely with internal stakeholders to integrate data protection requirements into operations, systems, and policies, ensuring a cohesive approach to data privacy.
• Continuous Improvement: Contribute to the ongoing enhancement of data protection controls and risk mitigation measures to maintain a robust privacy posture.

Functional Accountabilities

PDPL Compliance & Governance

• Regulatory Interpretation: Interpret and implement PDPL requirements across the organization to ensure comprehensive compliance.
• Policy Development: Develop, review, and maintain data protection policies, procedures, and guidelines to align with regulatory standards.
• Data Subject Rights: Support compliance with data subject rights, including access, correction, deletion, and consent management.
• Records Management: Maintain accurate and up-to-date records of processing activities (RoPA) for personal data.

Data Privacy Risk Management

• Impact Assessments: Conduct Data Privacy Impact Assessments (DPIAs) for new systems, projects, and processes to identify and mitigate risks.
• Risk Identification: Assess and mitigate personal data protection risks to prevent potential breaches or non-compliance.
• Incident Response: Support incident response and breach management in coordination with IT, Legal, and Compliance teams to ensure swift and effective resolution.

Monitoring, Audits & Reporting

• Compliance Monitoring: Continuously monitor compliance with data protection controls and internal policies to identify gaps or areas for improvement.
• Reporting: Prepare comprehensive compliance reports, dashboards, and documentation for management review and decision-making.
• Audit Support: Assist in internal and external audits related to data privacy and personal data protection to demonstrate organizational compliance.

Awareness & Training

• Training Programs: Develop and deliver data protection awareness and training programs tailored to staff needs and organizational requirements.
• Expert Guidance: Act as the primary subject matter expert for data privacy inquiries, providing guidance and support to employees and stakeholders.
• Cultural Promotion: Foster a culture of accountability and ethical data handling across the organization to ensure sustained compliance.

Stakeholder Collaboration

• IT Coordination: Collaborate with IT teams to ensure secure data handling, robust access controls, and effective encryption measures.
• Legal Partnership: Coordinate with Legal teams on contracts, data sharing agreements, and consent requirements to ensure legal compliance.
• Cross-Functional Engagement: Work with Clinical, Health Information Management (HIM), Human Resources (HR), and Operations teams to ensure compliance across all data domains.

Qualifications and Experience

To excel in this role, candidates must meet the following qualifications and requirements:

Knowledge and Experience

• Industry Experience: 5–8 years of progressive experience in data quality, data governance, compliance, or data management, with a preference for candidates with healthcare sector experience.
• Regulatory Knowledge: In-depth understanding of Saudi PDPL, NDMO Data Governance Framework, and healthcare data regulations.
• Standards Familiarity: Experience with CBAHI / JCI data-related standards and reporting requirements to ensure alignment with industry best practices.
• Technical Proficiency: Hands-on experience with healthcare information systems, including HIS, EMR, ERP, and data warehouses, to support data protection initiatives.
• Analytical Skills: Strong analytical abilities with proficiency in data analysis and reporting tools such as SQL, Excel, Power BI, or specialized data quality tools.
• Soft Skills: Exceptional communication, documentation, and problem-solving skills to effectively convey complex data privacy concepts and drive organizational change.
• Ethical Mindset: A commitment to ethical data handling and a proactive approach to identifying and mitigating privacy risks.