Section Head, Data Privacy, Information Security Department

Job Purpose :

• The Section Head of Data Privacy is responsible for leading and overseeing the Bank’s data privacy governance, compliance, and advisory functions to ensure that personal data and sensitive information are managed in accordance with applicable regulatory, legal, and internal governance requirements.

• The role provides strategic and operational oversight on data privacy risk management, including privacy impact assessments, data protection advisory, privacy-by-design practices, data breach coordination, regulatory engagement, and monitoring of compliance with relevant requirements such as the Personal Data Protection Act, Bank Negara Malaysia’s Risk Management in Technology Policy Document, and other applicable data protection standards.

• The role also acts as the key second line of defense function for data privacy, working closely with Technology, Compliance, Legal, Risk Management, Business Units, and relevant stakeholders to strengthen the Bank’s personal data protection posture and ensure effective implementation of data privacy controls across the bank.

Principal Accountabilities:

• Support the Bank in minimizing potential financial exposure arising from data privacy breaches, regulatory non-compliance, penalties, legal claims, and reputational damage.

• Promote cost-effective implementation of data privacy controls through risk-based prioritization and alignment with regulatory expectations.

• Promote responsible handling of customer and employee personal data in line with applicable privacy requirements and the Bank’s data protection principles.

• Provide advisory support to Business Units and support functions on personal data processing, consent, disclosure, retention, sharing, and protection requirements.

• Strengthen internal awareness and accountability on data privacy obligations to safeguard customer trust and stakeholder confidence.

• Support the Bank’s commitment to ethical, responsible, and transparent use of personal data.

• Promote privacy-conscious practices that protect the interests of customers, employees, vendors, and other stakeholders.

• Lead the development, implementation, and continuous enhancement of the Bank’s data privacy governance framework, including policies, standards, procedures, and guidelines.

• Oversee Data Privacy Impact Assessments (DPIAs), privacy risk assessments, and advisory reviews across systems, applications, business processes, outsourcing arrangements, and digital initiatives.

• Provide independent second line of defence oversight on data privacy risks, control effectiveness, compliance gaps, and remediation activities.

• Advise stakeholders on privacy-by-design principles, data lifecycle management, data classification, retention, sharing, and protection requirements to ensure compliance with regulatory and business objectives.

• Monitor and report compliance with applicable data privacy laws, regulatory requirements, internal policies, and industry standards, while coordinating regulatory engagements, audits, and assurance reviews.

• Lead the management of data privacy incidents and breaches, including assessment, escalation, reporting coordination, remediation, and lessons learned.

• Establish, monitor, and report key risk indicators (KRIs), control metrics, and management dashboards to provide oversight of the Bank’s data privacy risk posture.

• Drive data privacy awareness and capability development across the Bank, while providing leadership, guidance, and performance oversight to the Data Privacy team.

• Undertaking any other responsibilities as assigned by the Supervisor.

Qualifications & Requirements

Educations & Experiences:

• At least 8 to 10 years of relevant working experience in data privacy, data protection, information security, compliance, legal, risk management, or related governance functions, preferably within the banking or financial services industry.

• Graduate degree in Information Technology, Cyber Security, Law, Risk Management, Compliance, Data Governance, Business Administration, or other relevant disciplines.

• Strong working knowledge of the Personal Data Protection Act, relevant amendments, regulatory guidelines, and applicable data privacy requirements in Malaysia.

• Strong understanding of Bank Negara Malaysia’s Risk Management in Technology Policy Document and its relevance to data protection, technology risk, outsourcing, cyber resilience, and information security controls.

• Professional certifications in data privacy, data protection, information security, or risk management would be an added advantage, such as CIPM, ISO/IEC 27701, ISO/IEC 27001, CISA, CRISC, or equivalent.

• Experience in implementing or overseeing privacy governance frameworks, data privacy impact assessments, data breach management, data handling standards, and privacy advisory functions.

• Experience in engaging regulators, auditors, senior management, committees, and cross-functional stakeholders.

• Prior people management or team leadership experience is preferred.

Skills Required

• Strong knowledge of data privacy laws, data protection principles, and regulatory compliance requirements.

• Good understanding of BNM RMiT, PDPA, privacy governance, information security, technology risk, and data governance frameworks.

• Knowledge of privacy-by-design, data minimization, consent management, data retention, data sharing, and third-party data handling requirements.

• Ability to assess privacy risks across systems, applications, business processes, vendors, and outsourcing arrangements.

• Knowledge of data protection controls, including encryption, data loss prevention, access management, masking, logging, monitoring, and secure disposal.

• Strong understanding of data breach assessment, incident escalation, root cause analysis, remediation tracking, and regulatory notification considerations.

• Strong policy development, governance documentation, and control review capabilities.

• Good analytical, problem-solving, and risk assessment skills.

• Strong stakeholder engagement, advisory, communication, and negotiation skills.

• Ability to prepare clear management reports, committee papers, dashboards, and regulatory responses.

• Strong leadership, coaching, planning, and team management skills.

• High level of integrity, confidentiality, professionalism, and sound judgement in handling sensitive information.