The DPO will act as the trusted advisor on privacy and data governance within the Technology Department and across business units, ensuring that privacy and security are embedded in all NMG products, platforms, and processes.

Key Responsibilities

Governance, Compliance and Policy

• Develop, implement, and maintain NMG’s data protection and privacy framework across Kenya, Uganda, and Tanzania. Monitor compliance with applicable data protection legislation, corporate policies, and global best practices. Serve as the primary contact point for Data Protection Authorities in all three markets. Maintain and update the organization’s Record of Processing Activities. Conduct regular data protection impact assessments and recommend mitigating actions. Lead internal and external audits to assess compliance with data protection requirements. Draft, review, and update privacy policies, cookie policies, data-sharing agreements, and retention schedules.

Advisory and Awareness

• Advise management and staff on data protection obligations and best practices.
• Train and sensitize employees across all levels on data privacy, consent, and safe data handling.
• Embed privacy-by-design principles in new digital products, apps, and data systems.
• Provide expert advice on data breaches, including notification requirements and incident handling

Incident and Risk Management

• Manage and investigate data breaches or privacy incidents, coordinating response and mitigation. Liaise with cybersecurity and legal teams to ensure coordinated incident resolution. Develop and maintain a data breach response plan and report key incidents to the CIO and Group Executive. Conduct regular privacy risk assessments and ensure remediation of identified issues

Cross-Functional & Regional Collaboration

• Collaborate with legal, IT security, data analytics, product development, and editorial teams to ensure compliance across NMG platforms. Harmonize privacy practices and data governance standards across NMG’s regional subsidiaries. Support digital transformation initiatives by ensuring ethical and compliant use of audience data for personalization, advertising, and analytics.

Qualifications Experience & skills:

Education:

• Bachelor’s degree in Law, Computer Science, Information Systems, Data Science, or related field.
• Certification in Data Protection / Privacy (e.g., CIPP/E, CIPM, CDPO-K, or ISO 27701 Lead Implementer) is strongly preferred.

Experience:

• At least 3-5 years of relevant experience, with a minimum of 3 years in a data protection, compliance, or information security role.
• Proven experience implementing data protection programs in multi-country or media/digital environments.
• Familiarity with regional and international data protection frameworks (Kenya, Uganda, Tanzania, GDPR).
• Understanding of IT systems, cloud platforms, cybersecurity principles, and data analytics environments