Vice President

Job Purpose

Data Protection Officer ("DPO") is to ensure Prasarana's Group compliance with Malaysia's Personal Data Protection Act 2010 (PDPA) and other relevant data protection laws which may be applicable by developing and enforcing data protection policies/procedures, overseeing personal data processing activities, managing data breaches and data subject requests, conducting staff training and audits, performing risk assessments, provide advise, highlight and raise to the Management implications, risks and exposures and co-liaising with regulatory authorities with the DPO to ensure lawful, secure, and ethical handling of personal data across the Prasarana's Group in carrying out its business activities to ensure that the interest and benefit of the Company are secured and safeguarded at all times.

Key Accountabilities

Compliance Monitoring and Enforcement

• Oversee the implementation of data protection policies and procedures across the organization.
• Conduct regular checks and audits to ensure compliance with PDPA 2010 and other relevant data protection laws (e.g., GDPR, if applicable).
• Maintain a Record of Processing Activities (ROPA) and ensure all data processing activities are legally compliant.

Data Protection Risk Management

• Conduct regular Data Protection Impact Assessments (DPIAs) for new projects, systems, or processes involving personal data.
• Identify potential privacy risks and propose mitigation strategies to minimize risks to data subjects and the organization.

Data Breach Management

• Oversee and manage data breach incidents, ensuring timely identification, containment, investigation, and reporting of breaches.
• Work with relevant stakeholders to assess the breach's impact and ensure that corrective actions are taken promptly.
• Report serious breaches to the Department of Personal Data Protection (JPDP) as required by the PDPA.

Training and Awareness

• Develop and deliver training programs on data protection laws, organizational policies, and best practices for employees.
• Ensure all new employees understand their data protection obligations and responsibilities within the organization.
• Raise awareness about data protection risks and the importance of safeguarding personal data across all departments.

Managing Data Subject Rights

• Oversee the process of responding to Data Subject Access Requests (DSARs), such as requests for access to personal data, corrections, or deletion.
• Ensure that data subject requests are processed timely and accurately, in line with the PDPA's requirements.

Policy Development and Review

• Lead the development and revision of data protection policies and standard operating procedures (SOPs).
• Ensure that the policies are aligned with local and international legal standards and reflect changes in regulatory requirements.

Third-Party Data Management

• Ensure third-party contracts involving personal data processing comply with data protection laws.
• Conduct regular reviews of third-party data practices and vendor management to ensure they meet the organization's data protection standards.

Internal Auditing and Reporting

• Conduct regular audits of data protection practices to assess adherence to internal policies and external regulations.
• Prepare regular compliance reports for senior management, outlining areas of concern, compliance status, and recommended actions.

Cross-Functional Collaboration

• Work closely with Group Digital Division, Legal & General Counsel Department, HR, Marketing, and other departments to integrate data protection principles into business processes, ensuring personal data is handled securely across the organization.
• Advise on data protection aspects in new projects, marketing campaigns, or technology implementations.

Regulatory Liaison

• Co-liaising with the DPO as the main point of contact with regulatory authorities, such as the Department of Personal Data Protection (JPDP).
• Ensure the organization is up-to-date with any changes in data protection laws and communicate these changes to relevant stakeholders.

Qualifications, Skills & Knowledge

• Bachelor's Degree in Law, IT, Business, Data Governance, or equivalent.
• Minimum 10 years of working experience with 5 years of experience in data protection roles or compliance.
• In depth knowledge of PDPA 2010 and other relevant local and international data protection laws (e.g., GDPR, HIPAA 0 plus points) and ability to interpret and apply legal and regulatory requirements to business operations.
• Strong capability to identify, assess, and mitigate privacy risks through data.