Data Protection Officer

Job description

Be a part of something BIG! Say HELLO to BIG Possibilities with Singtel GBS KL (Sudong MY Sdn Bhd)! Singtel is Asia's leading communications technology group, our presence spans across 21 countries in Asia, Australia, and Africa. We thrive on innovation, digital transformation, and harnessing next-generation technology to create a more sustainable and digital future. Now, we are bringing this energy to Kuala Lumpur with the launch of our brand-new Shared Services Centre! Reporting to the GBS KL Site Lead , the Sudong Data Protection Officer (DPO) is responsible for providing independent oversight, governance, and monitoring of Sudong's compliance with the Malaysia Personal Data Protection Act 2010 (PDPA) and other applicable data protection and privacy requirements. The DPO serves as the focal point for data protection matters within Sudong, ensuring that personal data is processed in accordance with legal, regulatory, and organisational requirements. The DPO operates independently in overseeing Sudong's privacy compliance and will work closely with the Singtel Group DPO and other Group Privacy Offices on matters relating to the personal data of Singtel and other Group entities. In addition, the DPO oversees Sudong's compliance with its data protection obligations when Global Business Services (GBS) processes personal data on behalf of Singtel and other Group entities, ensuring appropriate governance, policies, controls, and risk management measures are in place to safeguard personal data and support regulatory compliance. Make an Impact by: 1. Privacy Governance & Compliance Oversee and monitor Sudong's compliance with MY PDPA and applicable privacy requirements. Develop, maintain and roll out privacy policies, procedures and guidance across GBS. Advise Sudong management and business functions on privacy requirements and risks. Monitor regulatory developments and recommend updates to policies, processes and controls. Escalate material privacy risks and compliance gaps to Sudong management. 2. Data Protection Impact Assessments (DPIA) Establish and manage the DPIA process for Sudong. Advise and support business functions in conducting DPIAs where required. Review new projects, systems and processing activities for privacy risks. Recommend appropriate measures to mitigate identified privacy risks. Promote Privacy by Design across GBS. 3. Personal Data Breach Management Establish and oversee Sudong's personal data breach management process. Coordinate the assessment, investigation and management of privacy incidents. Maintain Sudong's Personal Data Breach Register. Coordinate notifications to the Malaysia Personal Data Protection Commissioner and affected individuals where required. Promptly escalate incidents involving personal data processed on behalf of Singtel or other Group entities to the relevant DPO/Privacy Office. Monitor corrective and preventive actions arising from incidents. 4. Data Subject Rights Oversee requests relating to Sudong-owned personal data, including access, correction, withdrawal of consent and other applicable rights. Ensure requests are handled in accordance with MY PDPA requirements and prescribed timelines. 5. Third-Party Privacy Risk Conduct or oversee privacy assessments for vendors handling Sudong personal data. Ensure appropriate privacy requirements and contractual safeguards are incorporated into vendor arrangements. Monitor significant third-party privacy risks and follow up on remediation. 6. Compliance Monitoring Conduct periodic privacy compliance reviews across GBS. Monitor adherence to MY PDPA, internal policies and privacy controls. Identify compliance gaps and recommend corrective actions. Track remediation and report significant issues to Sudong management. 7. Training & Awareness Develop and deliver MY PDPA training for GBS staff. Establish privacy onboarding and refresher training requirements. Promote privacy awareness through eLearning, newsletters, posters, screensavers and other awareness activities. Provide practical guidance to staff on the appropriate handling of personal data. 8. GBS Data Processor Oversight Where GBS processes personal data on behalf of Singtel or other Group entities, the Sudong DPO will: Monitor Sudong's compliance with its Data Processor obligations. Ensure applicable privacy, security, retention and incident reporting requirements are implemented within GBS. Coordinate with the relevant Group DPO/Privacy Office where required. Support DPIAs, compliance reviews, investigations and assurance activities relating to GBS processing. Ensure privacy incidents involving Group data are promptly escalated to the relevant Data Controller. 9. Regulatory Engagement Act as Sudong's key contact for the Malaysia Personal Data Protection Commissioner on privacy matters. Support regulatory enquiries, investigations and compliance activities. Ensure required DPO information and regulatory records are maintained and updated. Qualifications Bachelor's degree in Law, Information Technology, Information Security, Risk Management, Compliance, Business Administration, or a related discipline. Professional certifications in data privacy, information security, risk, or compliance are preferred, such as: Certified Information Privacy Professional (CIPP/A, CIPP/E or equivalent) Certified Information Privacy Manager (CIPM) Certified Information Systems Security Professional (CISSP) Certified Information Security Manager (CISM) Other relevant privacy, governance, risk, or compliance certifications. Experience & Knowledge Strong working knowledge of the Malaysia Personal Data Protection Act 2010 (PDPA) and other applicable data protection and privacy requirements. Relevant experience in data privacy, compliance, risk management, legal, information security, governance, or a related field. Experience or knowledge in conducting Data Protection Impact Assessments (DPIAs), managing data breaches, performing privacy compliance reviews, and assessing third-party privacy risks. Practical understanding of privacy governance frameworks, data lifecycle management, and privacy-by-design principles. Experience working in a shared services, global business services, multinational, or regulated environment is an advantage. Competencies Ability to maintain sufficient independence, authority, and autonomy to effectively discharge the responsibilities of the DPO role. Direct access to Sudong senior management to provide independent advice and escalate privacy matters where necessary. Ability to independently identify, assess, raise, and escalate privacy risks, compliance concerns, and recommendations. Strong stakeholder management, influencing, and communication skills, with the ability to engage effectively across all levels of the organisation. Ability to work collaboratively across Human Resources, Information Technology, Operations, Procurement, Security, Risk, Legal, and other GBS functions. Proficiency in both Bahasa Malaysia and English, with strong verbal and written communication skills. Ability to balance regulatory compliance requirements with business objectives while maintaining an independent oversight role. Regulatory & Independence Requirements Meet all applicable Malaysian regulatory requirements relating to residency, accessibility, and contactability for an appointed DPO. Avoid holding responsibilities or decision-making authority that could create an actual, potential, or perceived conflict of interest with the independent oversight responsibilities of the DPO. Be empowered to provide objective advice, challenge practices where necessary, and report privacy risks directly to senior management without undue influence. Your Career Growth Starts Here. Apply Now!