Data Privacy Attorney, Hygiene (1 Year Contract) at RB

Summary
RB's internal Data Privacy Compliance Programme is aimed at maintaining and enhancing privacy by design within its business. The Data Privacy Attorney will play an important role in ensuring ongoing Data Privacy compliance in South Africa for the RB Hygiene Business Unit ("Hygiene"). The role requires strong data protection and privacy expertise and ability to advise and provide guidance on data protection issues to the business in South Africa; implementation of Protection of Personal Information Act ("POPIA") within the organisation; work with the business on ensuring RB is compliant and drive accountability within the business to take increased ownership of Data Privacy compliance; to support and advise the business on Data Privacy related projects; and to take ownership and accountability of the Data Privacy compliance programme. Data Privacy Attorney, will be part of the Hygiene Compliance function

Key Responsibilities

• Manage and implement the Data Privacy Compliance Programme in the organisation;
• Draw on expert knowledge of data protection and privacy to provide high-quality and timely legal advice on compliance to Heads of Privacy, Privacy Champions and other stakeholders in South Africa;
• Provide project support and lead on privacy and data protection;
• Enhance Privacy Network by building strong relationships with Heads of Privacy, Privacy Champions and the business;
• Cooperate with Hygiene Legal and Compliance function, Group Privacy Office, Digital team and IS/Cyber Security team;
• Advise on and structure digital, e-commerce, marketing and other projects with data protection implication including mapping data flows, advising on information privacy practices, implementation of appropriate technical and organizational measures;
• Enhance privacy by design within business practices;
• Update personal data processing register on One Trust through conducting regular meetings with Privacy Champions and the business, launching and approving Privacy Impact Assessments and, if required, Legitimate Impact Assessments for new processing activities, assisting the business in completing the Privacy Impact Assessment questionnaires and other internal privacy forms (PIAs, DPIAs, PIFs, DIAs etc);
• Provide expert input into Privacy Impact Assessments, Legitimate Impact Assessments and data mapping, and identify risks and register them on One Trust;
• Ensure that the risks identified during Privacy Impact Assessments are properly and timely remediated through the coordination with Heads of Privacy, Group Privacy Office and IS/Cyber Security team on introducing required technical and organizational measures;
• Support the business on Data Subject Access Requests and ensure that DSAR Process is followed by the business. Cooperate with Group Privacy Office in responding to DSARs;
• Advise on the management and resolution of incidents involving personal data. Cooperate with Group Privacy Office on resolving data breaches, and ensure that Data Breach Process is followed by the business;
• Draft and negotiate data protection agreements and update a register of vendors which process personal data;
• Ensure all personal data is collected and processed on a lawful basis and that it is properly registered;
• Prepare, update, translate and communicate policies, procedures and notices, and keep appropriate records;
• Work with Group Privacy Office to execute Intra Group Data Protection agreements;
• Foster a culture of data protection by providing POPIA related trainings to the business (e.g., training on supporting POPIA related projects, training on Data Breach and DSAR processes, trainings on key roles and responsibilities of Privacy Champions, data privacy impact assessments);
• Support Group Privacy Office, Heads of Privacy and Privacy Champions on the enforcement of the data retention policy and regularly conduct clean up days;
• Share best practices and knowledge with Hygiene Legal and Compliance team and Group Privacy Office;
• Timely follow up with the Privacy Champions and business on POPI ongoing activities;
• Keep abreast of local legal developments, including any POPI derogations, interpretation and implementation of new requirements, if any;
• Conduct/Review POPI gap risk assessments, create and implement mitigation plan;
• Support Hygiene in fulfilling other ongoing data privacy obligations;
• Perform other activities defined by the Head of Legal and Compliance, Africa;
• Respond to internal and external privacy and data protection inquiries.

Key Requirements

• A flexible and an admitted Attorney with a recognised Legal qualification;
• 3+ years of experience legal experience supporting and advising business on privacy and data protection related concerns;
• Strong data protection knowledge and expertise in POPIA and global privacy standards including but not limited to the EU General Data Protection Regulation to advise on data protection matters;
• Strong project management skills;
• Experience in a similar type of role in a multinational business and of working on a multidisciplinary role;
• Experience of promoting a data privacy culture of awareness and understanding;
• Comfortable working in a company experiencing rapid growth