Personal Data Protection Specialist

Job Purpose responsible for ensuring the organization’s full compliance with the Saudi Personal Data Protection Law (PDPL) and related data privacy regulations. The role supports the Data Management Office in developing, implementing, and monitoring personal data protection policies, procedures, and controls across clinical, operational, and administrative domains. This position plays a critical role in safeguarding patient, employee, and stakeholder personal data, mitigating privacy risks, and promoting a culture of ethical and compliant data handling within the healthcare organization

Roles and Responsibilities

Key Accountabilities Areas Key Activities Organizational Accountabilities:

• Ensure work is performed based on approved policies, processes, procedures, and instructions

• Identify opportunities for continuous improvement of systems, processes and practices considering leading practices, cost reduction and productivity improvement

• Ensure day-to-day activities are properly performed in line with policies and procedures

• Follow-up on escalated cases/issues of subordinates to ensure they are closed efficiently and in a timely manner.

• Support the organization’s data protection and privacy strategy in alignment with PDPL and NDMO frameworks.

• Ensure compliance with Saudi PDPL, NDMO Data Governance Framework, and MOH data privacy requirements.

• Promote privacy-by-design and privacy-by-default principles across healthcare systems and processes.

• Support organizational readiness for regulatory, accreditation, and compliance audits related to personal data protection.

• Collaborate with internal stakeholders to embed data protection requirements into operations, systems, and policies.

• Contribute to the continuous improvement of data protection controls and risk mitigation measures.

Functional Accountabilities:

PDPL Compliance & Governance:

• Interpret and implement PDPL requirements across the organization.

• Develop, review, and maintain data protection policies, procedures, and guidelines. 2

• Support compliance with data subject rights (access, correction, deletion, consent management). • Maintain records of processing activities (RoPA) for personal data.

• Data Privacy Risk Management:

• Conduct data privacy impact assessments (DPIAs) for new systems, projects, and processes.

• Identify, assess, and mitigate personal data protection risks.

• Support incident response and breach management in coordination with IT, Legal, and Compliance teams.

Monitoring, Audits & Reporting:

• Monitor compliance with data protection controls and internal policies.

• Prepare compliance reports, dashboards, and documentation for management review.

• Support internal and external audits related to data privacy and personal data protection.

Awareness & Training:

• Develop and deliver data protection awareness and training programs for staff.

• Act as a subject matter expert for data privacy inquiries and guidance.

• Promote a culture of accountability and ethical data handling.

• Stakeholder Collaboration:

• Work closely with IT to ensure secure data handling, access controls, and encryption measures.

• Coordinate with Legal on contracts, data sharing agreements, and consent requirements.

• Collaborate with Clinical, HIM, HR, and Operations teams to ensure compliance across data domains.

Job Qualifications and Requirements Knowledge and Experience

• 5–8 years of experience in data quality, data governance, compliance, or data management, preferably in the healthcare sector.

• Strong knowledge of Saudi PDPL, NDMO Data Governance Framework, and healthcare data regulations.

• Familiarity with CBAHI / JCI data-related standards and reporting requirements.

• Experience working with healthcare information systems (HIS, EMR, ERP, data warehouses).

• Proficiency in data analysis and reporting tools such as SQL, Excel, Power BI, or data quality tools. • Strong analytical, documentation, and problem-solving skills.

• Excellent communication and stakeholder management abilities. Education and Certifications

• Bachelor’s degree in Law, Information Systems, Health Informatics, Data Management, Cybersecurity, or a related field (required)

• Certified Information Privacy Professional (CIPP/E or CIPP/US) or equivalent (highly desirable).

• CDPSE (Certified Data Privacy Solutions Engineer) or similar privacy-related certification (preferred).

• PDPL / NDMO compliance training or certification (preferred).

• Continuous professional development in data privacy and healthcare compliance is required.

Skills

• Proven expertise in healthcare and government sectors, with strategic planning capabilities.

• Strong skills in communication, mediation, and conflict resolution.

• Deep understanding of data compliance, regulations, and policies.

• Excellent administrative and organizational skills.

• Good communication skills in Arabic and English (verbal and written).

• Strong proficiency in Microsoft Office (Word, Excel, PowerPoint, Outlook).

• Ability to prepare clear reports, meeting minutes, and maintain accurate records. Attitude

• Strong Work Ethic

• Dependability and Responsibility

• Possessing a Positive Attitude

• Adaptability

• Honesty and Integrity

• Self-Motivated

• Motivated to Grow and Learn

• Strong Self-Confidence Conditions