Senior Manager, Data Privacy Governance

Role : Senior Manager – Data Privacy Governance
Location : Abu Dhabi
Role Purpose:
To lead the data privacy governance pillar of ADIB’s Data Privacy Function within the Group Information Security Department (GISD), by designing, implementing and continuously improving the Bank’s privacy governance framework – policies, standard operating procedures, records of processing, privacy risk management and regulatory reporting.

The role ensures that ADIB, its subsidiaries and branches process personal data in compliance with the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021), CBUAE Consumer Protection Regulation & Standards and other applicable local and international data protection requirements, and provides assurance to Senior Management, Board Committees and regulators on the effectiveness of the privacy control environment.
Key Accountabilities of the role
Privacy Governance Framework

• Own, draft and maintain the Data Privacy Framework, Policy, Standards, SOPs and supporting templates, including version control, approval workflows and periodic review cycles.

• Maintain the regulatory obligation register and mapping of PDPL, CBUAE and other applicable requirements to internal controls, and ensure the supporting evidence library is complete and audit-ready.

Records of Processing and Data Mapping

• Oversee the Record of Processing Activities (RoPA) program end to end – Business Unit onboarding, completeness and quality review, escalation and periodic refresh – ensuring consistency across all ADIB jurisdictions.

• Govern the privacy management platform (OneTrust) as the single source of truth for RoPA, assessments, consent and incident records.

Privacy Risk, Assessments and Assurance

• Govern the privacy risk management process, including risk identification, assessment, mitigation, and recording of residual risk in the Bank’s GRC tool (Archer) in line with the Operational Risk Management framework.

• Lead the governance of Data Protection Impact Assessments (DPIA) and International Data Transfer Assessments, including review, challenge and sign-off of business submissions.

• Define, monitor and report privacy KPIs and KRIs, and prepare reporting packs for Senior Management, the CISO, Management Risk Committee and Board-level committees.

Data Subject Rights, Consent and Transparency

• Oversee governance of data subject rights handling, consent management and privacy notices across customer, employee, candidate and vendor channels (web, mobile app, branches, contact centre and forms).

• Ensure privacy notices and consent mechanisms are accurate, tailored by data subject type, and available in English and Arabic.

Third Parties and Contracts

• Govern privacy due diligence over third parties in coordination with TPRM and Procurement, and ensure Data Processing Agreements and transfer safeguards are in place before onboarding.

• Assess controller / processor / joint controller roles and advise on the corresponding contractual obligations.

Incident Management and Regulatory Engagement

• Support the DPO in the governance of personal data breach management, including root cause review, lessons learned and regulatory notification decisions.

• Act as a key point of contact for internal audit, external auditors, consultants and regulators on privacy governance matters, and coordinate management responses and remediation plans.

Awareness, Culture and Team Leadership

• Design and deliver Group-wide and role-specific privacy awareness and training programs.

• Provide guidance, coaching and technical direction to privacy analysts and Business Unit privacy champions, and deputize for the DPO where required.

Specialist Skills / Technical Knowledge Required for this role:

• Expert knowledge of the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) and its Executive Regulations.

• Strong working knowledge of CBUAE requirements applicable to Licensed Financial Institutions, including the Consumer Protection Regulation and Standards (data protection, consent and market conduct provisions).

• Knowledge of additional data protection frameworks is considered an advantage, in particular DIFC Data Protection Law No. 5 of 2020, ADGM Data Protection Regulations, EU GDPR and UK GDPR.

• Proven ability to design and operationalize privacy governance artefacts: policies, SOPs, RoPA, DPIA, transfer assessments, RACI matrices, KPI / KRI frameworks and control libraries.

• Practical experience with privacy management platforms (OneTrust) and GRC tools (Archer).

• Understanding of information security principles, data lifecycle management and IT / banking systems landscape.

• Excellent English drafting skills, with the ability to translate regulatory requirements into clear operational procedures for business users; Arabic is an advantage.

• Professional certification preferred: CIPP/E, CIPM, CIPT, CDPO, CISA, CISM or equivalent.

• Strong stakeholder management, influencing and presentation skills at Senior Management level.

• Minimum of 8 years of relevant experience in data protection, privacy governance, regulatory compliance or risk management, of which at least 3 years in a senior or managerial capacity.

• Experience gained within banking, financial services or another highly regulated industry, preferably in the UAE or wider GCC market.

• Demonstrated track record of building or running an enterprise privacy programme covering RoPA, DPIA, data subject rights, breach management and third-party governance.

• Experience of direct engagement with regulators, internal audit, external auditors and external consultants on privacy and data protection matters.

• Bachelor’s degree in Law, Information Security, Risk Management, Information Technology or a related discipline; a postgraduate qualification is an advantage.