Data Privacy Manager at Grant Thornton – Makati City | Jobyssey

Key Responsibilities

Privacy Program Governance
• Support the design, implementation, and continuous improvement of the GCS’ privacy compliance framework in the Philippines.
• Assist in establishing governance mechanisms, standards, policies, procedures, and controls related to personal data processing that align to GTA requirements
• Monitor ongoing compliance with relevant privacy laws, regulations, and organizational requirements.
• Provide guidance to business teams on privacy compliance obligations and best practices.
• Creation and update of Records of Processing Activities (ROPAs) for both GCS and global privacy operations.
• Ensure that GTA incident reporting policy is implemented in GCS operations and assist in implementation of technologies supporting incident reporting and processing globally.
• Coordinate and attend meetings, emailing internal contacts for information as directed.
• Supporting Privacy review of products and services, creating review templates and identifying areas for more effective review.

Regulatory Compliance
• Serve as the local privacy compliance resource for Philippine data protection matters.
• Support compliance with the Philippine Data Privacy Act of 2012 and applicable implementing regulations.
• Coordinate privacy registrations, regulatory submissions, and documentation requirements with relevant authorities when required.
• Monitor legislative, regulatory and case law developments and recommend updates to internal processes and controls.
• Consolidate requirements of, enforce and audit against privacy frameworks like DCPP, GDPR, CCPA, NIST, ISO (27001, 27559, 29100, 27701, 27559, DORA, EU AI Act, EU-US DPF)

Privacy Risk Management
• Conduct privacy risk assessments and support Privacy Impact Assessments (PIAs).
• Supporting Privacy review of products and services, creating review templates and identifying areas for more effective review.
• Identify privacy risks associated with business processes, projects, systems, and third-party engagements.
• Recommend mitigation controls and monitor remediation activities.
• Maintain privacy risk registers and compliance documentation.

Incident Management
• Support the investigation, assessment, and management of privacy incidents and data breaches.
• Coordinate with Legal, Information Security, Risk, Compliance, and business stakeholders during incident response activities.
• Assist in determining notification requirements and regulatory reporting obligations.
• Maintain records of privacy incidents and corrective actions.

Global Privacy Operations Support
• Report to the Global Privacy Team and support
o strategic privacy initiatives.
o cross-border privacy compliance activities and global privacy governance programs.
o privacy assessments, audits, reporting, and compliance monitoring activities.
o privacy maturity across the organization.

Third-Party and Vendor Privacy Management
• Review vendor privacy practices and support privacy due diligence activities.
• Assist in evaluating data processing agreements and privacy-related contractual requirements.
• Monitor privacy compliance obligations of third-party service providers.

Training and Awareness
• Develop and deliver privacy awareness programs and training sessions.
• Promote a strong culture of data protection and responsible information handling.
• Create targeted training for employees, leaders, and stakeholders on privacy-related matters.

Audit and Compliance Support
• Support internal and external audits involving privacy compliance requirements.
• Assist with evidence gathering, control testing, and remediation activities.
• Prepare privacy KPI metrics, governance reports, and management updates.

Qualifications

Education
• Bachelor’s degree in law, Information Technology, Information Security, Business Administration, Risk Management, Compliance, Human Resources, or a related field.
• Postgraduate qualification in Data Privacy, Law, Compliance, Risk Management, or Information Security is an advantage.

Experience
• Extensive experience in implementing data privacy processes in global organizations to include implementation of privacy by design, risk management and compliance support.
• Bachelor's degree or equivalent (computer science, data science, IT)
• 5+ years’ experience implementing privacy enhancing technologies in data lakes, software, IT infrastructure and applications.
• Certifications (e.g., CISSP, CISM, or CISA preferred)
• AI product development experience.
• Project planning experience (PMP or similar certification).
• Experience in professional services organizations.
• Excellent verbal and written communication skills.
• Travel percentage: 5% (may be occasional travel if required)

Preferred Certifications
One or more of the following certifications is highly preferred:
• Certified Information Privacy Professional (CIPP/A, CIPP/E, or CIPP/US)
• Certified Information Privacy Manager (CIPM)
• Certified Information Privacy Technologist (CIPT)
• ISO 27701 Lead Implementer or Lead Auditor
• Certified Information Systems Security Professional (CISSP)
• Data Privacy Competency certification from the National Privacy Commission (NPC)

Key Competencies
Technical Competencies
• Privacy compliance and governance
• Data Protection Impact Assessments (DPIAs)
• Privacy incident management
• Regulatory compliance
• Third-party risk management
• Privacy by Design principles
• Data lifecycle management
• Records management

Behavioral Competencies
• Strong stakeholder management
• Analytical and problem-solving capability
• Excellent communication and presentation skills
• High professional integrity and confidentiality
• Ability to influence across functions and geographies
• Strong project management and organizational skills

Success Measures
Within the first 12 months, the successful candidate will:
• Support the establishment and maturation of the Philippines privacy compliance framework.
• Improve visibility and governance of personal data processing activities.
• Strengthen privacy risk assessment and monitoring capabilities.
• Enhance privacy awareness across business teams.
• Contribute to global privacy initiatives and cross-border compliance programs.
• Establish effective partnerships with Risk, Legal, Compliance, Information Security, HR, and Operations teams.

Explore more jobs