Job Summary:
- Mobilink Microfinance Bank Limited seeks a visionary and technically proficient Data Protection Officer (DPO) to lead the bank’s enterprise-wide data protection and privacy program. Reporting directly to the Chief Information Security, the DPO will be responsible for establishing the governance, architecture, and operational execution of the Bank’s privacy and data protection obligations.
Responsibilities:
- Strategic Privacy Program Design & Leadership
- Develop, own, and drive the enterprise privacy and data protection strategy in alignment with SBP’s regulatory expectations and international best practices.
- Establish and operationalize a centralized Data Protection Office, defining its charter, structure, roles, and reporting lines.
- Define a bank-wide data protection operating model, integrating privacy requirements into enterprise risk management and governance frameworks.
- Champion data ethics, responsible data handling, and privacy-by-default principles across the organization.
- 2. Regulatory Compliance & Privacy Risk Managements
- Ensure continuous compliance with:
- o SBP’s Framework on IT Governance and Risk Management,
- o SBP’s Cybersecurity Framework,
- o Pakistan’s Personal Data Protection Bill,
- o ISO/IEC 27001, PCI DSS, and GDPR (where applicable).
- Act as the bank’s focal point or designated secondary liaison with SBP and other relevant regulatory bodies through the Compliance and Legal departments.
- Lead Privacy Impact Assessments (PIAs) and Data Protection Impact Assessments (DPIAs) for new systems, products, and processes.
- Monitor changes in local and global data privacy regulations and proactively adjust compliance strategies.
- 3. Data Governance & Inventorization
- Lead implementation of data classification, tagging, and ownership models across data types and systems.
- Oversee and maintain accurate and up-to-date Records of Processing Activities (RoPAs) in line with SBP and global privacy standards.
- Ensure policies for data minimization, retention, disposal, and lifecycle management are in place and enforced.
- 4. Technology & Data Loss Prevention (DLP) Oversight
- Collaborate with IT, SOC, and Information Security teams to ensure privacy-by-design and privacy-by-default in systems architecture.
- Oversee the deployment, configuration, and monitoring of DLP solutions across all critical data touchpoints—endpoints, email, file storage, and networks.
- Ensure technical controls are aligned with SBP’s cybersecurity baseline controls.
- 5. Vendor, Third-Party & Contractual Privacy Assurance
- Evaluate third-party vendors, partners, and outsourcing arrangements for privacy and data protection risks.
- Ensure Data Processing Agreements (DPAs), SLAs, and contractual clauses reflect regulatory and internal privacy requirements.
- Conduct vendor risk assessments and ensure privacy obligations are embedded in procurement and onboarding processes.
- 6. Privacy Incident Management & Breach Handling
- Develop, maintain, and test the Privacy Incident Response Plan in alignment with SBP’s incident handling guidelines.
- Maintain a personal data breach register and ensure timely notification to SBP and affected stakeholders in case of qualifying breaches.
- Work with SOC, IT, and Legal to coordinate breach response and containment.
- 7. Awareness, Training & Culture Building
- Develop and roll out privacy awareness programs, including mandatory and role-specific training modules for staff.
- Promote a culture of privacy through KPIs, employee engagement campaigns, and executive support.
- Regularly assess training effectiveness and incorporate feedback from business units.
- 8. Reporting & Stakeholder Communication
- Provide periodic updates to senior management and the Board of Directors on the maturity and effectiveness of the data protection program.
- Contribute to internal audits and regulatory examinations, ensuring evidence of compliance is maintained and auditable.
- Generate dashboards and metrics on privacy risks, incident trends, and regulatory compliance status.
Eligibility / Qualification Required:
- Bachelor’s or Master’s degree in Information Security, Law, Cybersecurity, Risk Management, or related field. CDPO, CIPM, CIPP/E, CISA, CISSP, CRISC, ISO/IEC 27001 Lead Implementer, PCI DSS knowledge.
Job Details:
- Department: Information Security
- Job Type: Permanent
- Grade: VP
- Positions: 1
- Locations: Islamabad
- Application Deadline: Jun 19, 2026
How to Apply:
Register or sign in to the Mobilink Microfinance Bank careers portal, select the preferred location when offered, complete the application form, and submit it before the deadline.
Apply online for this position