Data Protection Officer

Role Overview:

CGSI Malaysia is seeking a qualified and experienced Data Protection Officer (DPO) to lead the organization's compliance with the Malaysia Personal Data Protection Act 2010 (PDPA) and all related regulations and guidelines. The appointed DPO will serve as the company's focal point for privacy governance, data protection risk management, regulatory engagement and training initiatives across business units.

Key Responsibilities:

1. Regulatory Compliance

• Ensure CGSI Malaysia's policies, systems and processes comply with the PDPA (including 2024 amendments) and relevant codes of practice.
• Act as the liaison officer with the Department of Personal Data Protection (JPDP).
• Maintain and update the Data User registration and statutory records.

2. Governance and Advisory

• Advise senior management and employees on PDPA obligations, including legal bases for processing, retention, cross-border transfers, etc.
• Interpret and implement JPDP guidelines, sectoral codes and emerging privacy frameworks.

3. Operational Execution

• Lead the development and maintenance of data protection policies, SOPs, privacy notices, RoPAs (Record of Processing Activities), DPIAs (Data Protection Impact Assessments) and consent mechanisms.
• Monitor compliance through internal audits, gap assessments and controls testing.

4. Training & Awareness

• Plan and conduct training, workshops and awareness programmes to build a privacy-conscious culture across the organization.

5. Incident Response

• Lead investigation and reporting of data breach incidents in accordance with Section 12B PDPA and DBN Guidelines, alongside CGSI Data Breach Management Plan.
• Coordinate with internal stakeholders to ensure containment, notification and remediation.

6. Data Governance

• Establish and maintain data governance frameworks, policies, procedures, standards and processes in accordance with group, regulatory or legislative requirements.
• Work with stakeholders and IT to identify, design, setup critical data elements though tools such as business glossary, data lineage, data catalog, data quality practices.
• Evaluate, implement, integrate and inter-operate data governance solutions with stakeholders according to data landscape, roadmap, and stakeholder requirements.
• Review and recommend data access and sharing requests.
• Prepare data governance and quality metrics, KPI dashboards for executive updates.

7. Information Security

• The Data Protection Officer may be required to support the Head of Information Security & Data Governance in matters related to Information Security, as deemed necessary.

Skills & Qualifications:

• At least 5 years of relevant experience in data protection, information security, compliance, legal, audit, or risk management.
• Minimum 2 years in a role with data privacy accountability (DPO, privacy officer, risk manager, etc.).
• Experience in regulated sectors such as financial services or securities industry is preferred.
• Strong working knowledge of Malaysia PDPA 2010, its 2024 amendments and JPDP guidelines.
• Familiarity with international privacy laws (e.g., GDPR, PIPL, Singapore PDPA) is a plus.
• Fluent in English and Bahasa Malaysia (written and spoken).
• Strong analytical, documentation and stakeholder communication skills.

Educational Qualification(s):

• Bachelor's degree in law, Information Security, IT, Compliance, Risk Management or a related field.
• Professional Certifications At least one (or more) of the following is strongly preferred:
• Certified Information Privacy Manager (CIPM)
• Certified Information Privacy Professional/Asia (CIPP/A) or /E
• EXIN PDPP (Privacy & Data Protection Practitioner)
• IAPP AIGP (for AI-related privacy governance)
• ISO/IEC 27701 Lead Implementer or Lead Auditor
• Recognized Malaysia DPO Certification Programmes (e.g. from DPEX Network, Malaysia HR Forum)

Personal Attributes:

• High integrity, independence and ability to exercise sound judgment.
• Ability to manage cross-functional privacy risks.
• Demonstrated leadership in compliance or governance environments.
• Strong interpersonal and presentation skills with ability to train others.

Only shortlisted candidates will be contacted.

Job summary

CGSI Malaysia seeks a Data Protection Officer to lead PDPA compliance and drive privacy, risk, and training initiatives across the organization.

Key selling points

• One of the leading Stockbroking Company
• Personal Growth and Career Progression
• Collaborative Culture and Environment