Executive Head of Privacy – Safaricom
Job Purpose
To shape, govern, and advance Safaricom’s enterprise-wide Privacy, Data Protection, and Responsible Data Use strategy, frameworks, controls, and capabilities—providing strategic leadership to anticipate, mitigate privacy risks, ensure ethical data handling, and embed trust by design across Safaricom’s converged Telco-FinTech ecosystem.
Roles & Responsibilities
-
Privacy Strategy & Governance: Define and govern enterprise-wide privacy strategies, policies, and standards aligned with the Kenya Data Protection Act (DPA 2019), global privacy principles, and sector-specific regulatory expectations.
-
Privacy-by-Design & Responsible AI: Embed privacy by design and responsible AI governance into technology lifecycles, product development, data analytics, and MLOps processes through DPIAs, ethical design frameworks, and model cards.
-
Data Rights, Consent & Lifecycle Management: Standardize lawful basis and consent frameworks across channels, industrialize Data Subject Access Requests (DSARs), and govern data retention, deletion schedules, and cross-border transfers.
-
Risk Intelligence & Breach Response: Run privacy risk registers, monitor high-risk processing activities, maintain incident and breach playbooks aligned with Section 43 notification obligations, and coordinate joint incident responses.
-
Ecosystem & Third-Party Privacy Assurance: Implement privacy due diligence, contract terms (controller/processor clauses), and periodic assurance for vendors, agents, merchants, and fintech partners.
-
Regulatory Engagement & Compliance: Manage relationships and compliance readiness with regulators such as the ODPC, CBK, and CAK, producing executive dashboards and ensuring audit readiness.
-
Group Subsidiary Oversight: Define minimum group risk standards, provide advisory support, and aggregate subsidiary risk exposures for board reporting while balancing governance with commercial enablement.
Qualifications
-
Bachelor’s Degree in Law, Information Technology, Data Science, Cybersecurity, Risk, Business, or a related field (Postgraduate qualification strongly preferred).
-
At least one advanced privacy credential: CIPP/E, CIPP/US, CIPP/A, CIPM, CIPT, CDPSE, ISO 27701/27001 Lead Implementer/Auditor, or CISM/CISSP.
-
Active membership in good standing with a recognized professional body.
Skills, Experience & Competences
-
12 to 15+ years of experience in Privacy, Data Protection, Information Governance, or Digital Risk, with a minimum of 5 years in a senior leadership role.
-
Extensive background within telecommunications, fintech, banking, digital platforms, or tech-driven environments.
-
Deep expertise in the DPA 2019, ODPC framework, GDPR-equivalent standards, Privacy by Design, and third-party risk management.
-
Exceptional strategic, influencing, communication, and stakeholder management skills to advise the CEO, CRO, ExCo, and Board Committees.