Data Compliance Manager

Job description

液化空气集团早在1916年就进入中国，70年代开始向中国提供空分设备，经过多年的稳步发展，目前在中国设有近120家工厂，遍布40多个城市，拥有约5000名员工。集团在华主要经营范围包括工业及医用气体的运营，家庭健康服务，工程与制造业务，以及全球市场与技术和上海创新园从事的创新业务。公司业务已覆盖中国主要的沿海工业区域，并继续向中部、南部和西部地区拓展。 液化空气通过创造卓越绩效和履行责任追求盈利性增长和长期可持续发展，并保持在中国的行业领先地位。依托于集团的长期战略与全球资源，公司聚焦能源、环境、高科技和健康等领域，以迎接挑战并创造新的市场机遇。凭借专业团队的全力支持，公司致力于为客户提供可信赖的服务与高附加值解决方案，同时履行企业社会责任。 The Data Compliance Manager provides vital operational and strategic support to ensure the company’s data compliance framework adheres to the Cybersecurity Law (CSL), Data Security Law (DSL), Personal Information Protection Law (PIPL), and other data compliance related regulations. Operating in a supervisory, advisory, and operational capacity, this role helps bridge the gap between legal requirements and business execution by guiding functional teams on technical and organizational measures. While a formal Data Protection Officer (DPO) provides independent oversight, the Compliance Manager's role is broader in daily scope, focusing on actively implementing the compliance program, mitigating legal and reputational risks, and assisting the primary DPO in ensuring the organization meets its statutory obligations. 您将如何贡献和成长？ Compliance Framework & Audit Execution - Framework Implementation: Assist in maintaining and executing the China data compliance framework, ensuring alignment with CSL, DSL, PIPL, rules, and national standards. - Compliance Audits: Support the execution of the compliance audit. - Regulatory Intelligence: Track evolving Chinese data laws and standards, assessing and communicating practical impacts to the primary DPO and functional teams. Regulatory Compliance & Reporting - Data Lifecycle Management: Manage the inventory and records of "Key Data" and Personal Information (PI) processing activities. Track data flows and processing changes. - CBDT Assessment: Organize and perform the Key Data CBDT Security Assessment and update the report to authority within specific terms as regulated or immediately upon significant changes to data flows or IT systems. - Industrial Internet Compliance: Lead the coordination of Industrial Internet Grading Conformity Assessments as required by Shanghai and MIIT authorities, ensuring valid certification for all relevant sites. - Annual Data Security Risk Assessment: Organize and execute the annual data security risk assessment required for Key Data processors. - Privacy Impact Assessments (PIPIA/DPIA): Organize and perform PIPIAs to monitor high-risk PI processing activities, ensuring privacy-by-design principles are applied. - Ad-hoc data compliance requirements from the authority follow up . Operational Assessments & Project Review - LPS Follow-up: Lead Multi-Level Protection Scheme (MLPS) assessments for in-scope systems. - Project Risk Evaluation (DRMT): Perform data compliance risk evaluations on all new IT projects involving China business or data (Data Risk Management Tool review). Provide advisory recommendations based on compliance status. - Incident Response: Assist the legal team and primary DPO in managing data compliance incidents, taking immediate remedial actions, and preparing mandatory notifications to the relevant departments and affected individuals. Advisory, Coordination & Stakeholder Management - Cross-Functional Coordination: Act as the liaison between the compliance team and D&IT, legal, HR, and business teams to articulate regulatory requirements and ensure technical measures are implemented effectively. - Stakeholder Support: Serve as a secondary point of contact for external regulatory authorities and data subjects exercising their rights, such as data deletion or access requests. Culture & Knowledge Management - Training & Awareness: Conduct regular data compliance training and promote a "Compliance-by-Default" culture to prevent human error across the organization. - Records Management: Maintain a central repository of compliance records, PIPIA reports, and audit results. 您是合适的人选么？ - At least 5 years of relevant experience in IT compliance or IT audit field in China. 3-5 years of experience combining technical understanding (IT/OT security, architecture) with legal compliance. Experience with complex data compliance projects (e.g., CBDT assessment, MLPS) is preferred. - Experience in an international ecosystem/company with contacts accross several countries, ability to interract at senior management level - Deep familiarity with China’s data compliance regulatory framework (CSL, DSL, PIPL and related regulations) and an understanding of information security principles. Holding the certification of CISA, CISSP, Legal Professional Qualification is preferred - Strong communication skills to act as a liaison between departments and translate complex legal rules into practical business/IT requirements. - Project management skills with coordination of teams across diverse departments 关于液化空气集团 液化空气集团 —— 全球工业与健康领域气体、技术和服务的 领导者之一 ，业务遍及78个国家/地区，员工约64,500 人，为380多万名客户与患者提供服务。氧气、氮气和氢气是生命、物质及能源不可或缺的小分子。它们象征着液化空气的科学疆域，自集团1902年成立以来，始终位于其业务的核心。 多样化造就了我们的业绩 在液化空气，我们致力于建立一个多元化和包容性的工作场所，拥抱来自全球的员工、客户、患者、社区利益相关者和文化的多样性。 我们欢迎并考虑所有合格申请人的申请，无论他们的背景如何。我们坚信，多元化的组织为人们提供了展示个人和集体才能的机会，它有助于培养我们的创新能力，通过践行我们的基本原则、为我们的成功而努力并在不断变化的世界中创造一个有吸引力的环境。