Data Protection Officer

About the role

Mobilink Microfinance Bank Limited is looking for a visionary Data Protection Officer to lead its enterprise‑wide privacy and data protection programme. Reporting to the Chief Information Security Officer, the DPO will design governance, architecture and operational processes to meet regulatory and best‑practice requirements.

Key responsibilities

• Develop and own the bank‑wide privacy strategy aligned with SBP regulations and international standards.
• Establish a centralized Data Protection Office, defining charter, structure and reporting lines.
• Lead Privacy Impact Assessments (PIA) and Data Protection Impact Assessments (DPIA) for new systems and products.
• Maintain up‑to‑date Records of Processing Activities (RoPA) and enforce data minimisation, retention and disposal policies.
• Collaborate with IT, SOC and Information Security teams to embed privacy‑by‑design and privacy‑by‑default in system architecture.
• Oversee deployment, configuration and monitoring of Data Loss Prevention (DLP) solutions across endpoints, email, file storage and networks.
• Evaluate third‑party vendors for privacy risks and ensure contractual clauses meet regulatory requirements.
• Manage privacy incidents and breach response plans.

Required profile

• Strong knowledge of SBP’s IT Governance Framework, Cybersecurity Framework, Pakistan’s Personal Data Protection Bill, ISO/IEC 27001, PCI DSS and GDPR.
• Experience establishing data protection governance structures in a financial institution.
• Proven ability to lead cross‑functional teams and liaise with regulators.

Required skills

• Data Loss Prevention (DLP) solutions
• Data Classification and tagging
• Privacy Impact Assessments (PIA) and Data Protection Impact Assessments (DPIA)
• Records of Processing Activities (RoPA) management