Reports To: Manager - Ethics and Data Privacy
Division: Risk and Compliance
Mission:
- To provide the company advisory service regarding the drafting, legality, structuring, fiscal efficiency and compliance of contractual arrangements.
Description:
- Collaborate with relevant teams to develop and implement strategies to ensure MTNN's compliance with all relevant privacy laws and regulations.
- Continuously track new and emerging privacy laws, regulations, and standards (e.g., GDPR, CCPA, NDPA) that impact MTNN's operations.
- Review internal projects, processes, products, services, and vendor relationships requiring data privacy impact assessments (DPIAs). Consult with business units (e.g., Marketing, IT, Network, Sales, HR), advise on privacy risks, compliance gaps, and mitigation strategies.
- Review and advise on data privacy related agreements/clauses with vendors, partners, and MTN Group entities.
- Review documentation supporting data processing activities (data flow maps, records of processing, consent mechanisms) for compliance validity and alignment with privacy laws and principles.
- Support the implementation of data privacy strategies to prevent breaches and regulatory sanctions by ensuring new products/services, marketing campaigns, and internal processes embed Privacy by Design & Default (PbD) principles.
- Provide insights and recommendations on the privacy implications of commercial transactions, data monetization initiatives, marketing campaigns and partnerships to internal stakeholders.
- Advise and provide support on fulfilling data subject rights obligations (access, erasure, portability etc.).
- Support the implementation, and maintenance of data privacy policies, standards, and procedures (e.g., Data Retention Policy, Breach Response Plan, Cookie Policy).
- Prepare weekly and periodic reports on privacy compliance status, key risks, data subject request metrics, breach incidents (if any), audit findings, and data privacy program maturity.
- Assist in performing thorough Data Privacy Due Diligence on potential vendors, partners, acquisition targets (M&A), and new technologies. Assess their data handling practices, security posture, compliance history, and alignment with relevant laws. Conduct data protection training and develop awareness programs to educate employees on data protection best practices
Education:
- Fluent in English First Degree in Law
Experience:
3-7 years’ experience in an area of specialization; with experience in supervising others
- Experience working in a medium organization
- Data privacy risk management experience. At least 2 (two) years
- Knowledge of telecommunications will be an advantage.
- Technical data privacy and/or legal qualification will be an advantage
- Knowledge and experience of data privacy and governance frameworks, methodologies and emerging practice in the context of the telecommunications industry
- In depth experience and understanding of the Nigerian legal framework