Job particulars
- Job title
- Executive Head of Privacy
- Hiring organisation
- Testimonials
- Location
- Nairobi, Kenya
- Employment type
- Full-time
- Work arrangement
- On-site
- Industry
- Legal
- Level
- Management
- Experience
- 15+ years
- Posted
- 23 Oct 2026
- Closing date
- 29 Oct 2026
Key responsibilities
- Health and Safety
- Uphold the company code of conduct, policies and procedures, ensuring integrity and accountability in every aspect of your work.
- All employees have a responsibility to adhere to safety, health, and wellbeing policies, guidelines and procedures in all actions and decisions.
- Key accountabilities and decision ownership:.
- Privacy Strategy, Governance & Accountability.
- Define and maintain the enterprise privacy strategy, policy suite, standards and baselines, aligned to Kenya’s DPA 2019 (rights, lawful bases, DPIAs, cross border rules).
- Operate a privacy governance model (committees, charters, decision rights) with clear DPO/DPIA ownership and Board/ExCo reporting.
- Implement and continually improve a PIMS under ISO/IEC 27701:2025 (stand alone management system), integrating with existing ISMS where helpful.
- Adopt ISO/IEC 29100 privacy principles/roles as a common language across squads and vendors.
- Map policies to GSMA Mobile Privacy Principles to ensure consistent mobile first customer protections.
- Maintain privacy risk appetite, KRIs, and exception management, with time bound remediation and independent challenge.
- Privacy by Design & Ethical Data Use.
- Bake privacy by design checkpoints into lifecycle gates (ideation → design → build → release), with DPIAs/PIAs for high risk processing.
- Apply ISO/IEC 27701 guidance to define controller/processor responsibilities, data minimisation, purpose limitation, and accountability evidence.
- Use ISO/IEC 29100 principles to evaluate fairness, transparency, individual participation, and accountability in AI/ML use cases.
- Adopt GSMA Mobile Privacy Design patterns for consent UX, notice, and in app privacy controls on mobile channels.
- Publish ethical data use guardrails (e. g., no dark patterns, PETs where feasible, children’s data safeguards) and review them quarterly.
- Implement model cards and data ethics reviews for high impact algorithms affecting eligibility, pricing, or customer outcomes.
- Responsible AI Governance.
- Define and implement AI governance frameworks covering ethics, privacy, explainability, and accountability.
- Establish enterprise-wide policies and standards for responsible AI development and deployment.
- Ensure compliance with data protection laws (e. g., DPA 2019) and emerging global AI regulations.
- Oversee AI use cases across the business to ensure alignment with privacy, fairness, and ethical standards.
- Embed privacy-by-design and responsible AI principles into AI/ML lifecycle (design, development, deployment)
- Conduct AI risk assessments including bias, misuse, model transparency, and data protection risks.
- Partner with Technology, Data, and AI teams to embed governance into MLOps and AI Factory processes.
- Provide oversight and reporting to leadership on AI-related risks, controls, and regulatory exposure.
- Data Subject Rights, Consent & Lifecycle Management.
- Standardise lawful basis and consent frameworks (opt in/opt out logic, proof of consent, preference centres) across web, app, USSD, and agent channels per DPA 2019 and General Regulations.
- Industrialise DSARs (access, rectification, erasure, portability, objection) with SLA metrics and audit trails.
Candidate requirements
- Bachelor’s degree in Law, Information Technology, Data Science, Cybersecurity, Risk, Business, or related field.
- Postgraduate qualification (LLM, MSc Data Protection, MBA, Cybersecurity, Digital Governance, or Risk Management) strongly preferred.
- At least one advanced privacy credential:.
- O CIPP/E, CIPP/US, or CIPP/A (Certified Information Privacy Professional)
- O CIPM (Certified Information Privacy Manager)
- O CIPT (Certified Information Privacy Technologist)
- O CDPSE (Certified Data Privacy Solutions Engineer)
- O ISO 27701 / ISO 27001 Lead Implementer or Lead Auditor.
- O CISM / CISSP (advantageous in tech-heavy environments)
- Deep expertise in:.
- O Kenya Data Protection Act (DPA 2019)
- O ODPC regulatory framework.
- O GDPR-equivalent global privacy standards.
- O Cross-border data transfer compliance.
- O Privacy by Design & Default frameworks.
- O Data governance & lifecycle management.
- O Consent management & preference governance.
- O Data minimization & purpose limitation controls.
- O Privacy Impact Assessments (PIAs/DPIAs)
- O Third-party privacy risk management.
- O Data subject rights (DSARs) operationalization.
- O Breach management & regulatory notification processes.
- Strong understanding of:.
- O AI & analytics governance (Responsible AI, data ethics)
- O API ecosystems & embedded finance risks.
- O Cloud data architecture & digital platforms.
- O Customer analytics & marketing data risk.
- O Telco data, mobile money data, and digital identity risks.
- 12–15+ Years in Privacy, Data Protection, Information Governance, or Digital Risk.
- Minimum 5+ years in senior leadership role.
Candidate safety
Never pay an employer or recruiter for a job offer. Review the application instructions after signing in and report suspicious vacancies to Kebarick.
Hiring organisation
Testimonials