Role Objectives:

Lead Breadfast’s enterprise-wide data privacy strategy and programme, and serve as the company’s designated Data Protection Officer before the Personal Data Protection Center (PDPC). The role ensures that all processing of personal data – of millions of customers, 10,000+ employees and DAs , suppliers and partners – complies with Egypt’s Personal Data Protection Law No. 151 of 2020 (PDPL) and its Executive Regulations, and that privacy is treated as a source of customer trust and a business enabler. The Head of Data Privacy sets the privacy governance framework, advises the CEO, Executive Committee and Board, builds and leads the privacy function.

Roles & Responsibilities:

Privacy Strategy, Governance & Leadership

Define and own the company-wide data privacy strategy, policy framework and multi-year roadmap, approved by the Executive Committee.

Establish privacy governance: Privacy Steering Committee, RACI per function, policy hierarchy, and a Privacy Champions network across all departments and sites.

Advise the CEO, ExCom and Board on privacy risk, regulatory exposure and the privacy implications of strategic initiatives (new business lines, M&A, market expansion, partnerships).

Build, lead and develop the privacy team; set budget, capability plan and success measures for the function.

Regulatory Compliance & PDPC Relationship

• Act as the registered Group DPO and primary point of contact with the PDPC; maintain registrations, licences and permits required under the PDPL for Breadfast as data controller and processor.
• Lead the company-wide PDPL compliance programme and close gaps within the regulatory grace period of the Executive Regulations.
• Monitor the PDPL, Executive Regulations, PDPC decisions and adjacent regulations (e.g., Central Bank of Egypt requirements for payments/fintech, consumer protection, e-commerce and cybercrime laws) and translate them into business requirements.
• Represent Breadfast in PDPC inspections, inquiries and industry forums.
• Enterprise Data Mapping & Records of Processing
• Own the enterprise Record of Processing Activities (RoPA) across all functions and systems: customer app and website, CRM, marketing and loyalty, payments, ERP, HRIS/payroll, WMS/TMS, rider apps and telematics, CCTV and biometrics.
• Maintain data classification, with controls for sensitive personal data ( Biometrics, health/medical records, financial data, national ID data, criminal record certificates)

Privacy by Design, Risk & Impact Assessments

• Embed privacy-by-design and by-default in the product and tech lifecycle; privacy sign-off before launch of new features, systems and data uses.
• Set the DPIA methodology and ensure DPIAs for high-risk processing: customer profiling and personalization, AI/ML models, marketing analytics, rider GPS tracking, workplace CCTV, biometric attendance, credit/BNPL or payments features.
• Maintain the enterprise privacy risk register, integrated into Breadfast’s Enterprise Risk Management framework.

Customer Trust, Marketing & Data Use

• Ensure lawful basis, clear notices and consent management for customers across app, web, calls, and marketing channels (SMS, push, email, WhatsApp), including direct marketing consent rules under the PDPL.
• Govern data sharing with partners, advertisers and analytics providers; set rules for anonymization and pseudonymization of data used for analytics and AI.
• Own customer-facing privacy policy and cookie/tracking practices.
• 3.6 Employee & Workforce Privacy
• Partner with People & Culture on privacy for the full employee lifecycle – recruitment, onboarding, background checks, payroll, social insurance, medical data, pictures, performance and offboarding.
• Ensure fit-for-purpose privacy notices and training for the front-liners teams, blue-collar and outsourced workforce (clear Arabic, practical formats).

Third-Party, Vendor & Cross-Border Data Management

• Set the third-party privacy risk framework: due diligence, data processing agreements, audits and offboarding for all processors (cloud and SaaS vendors, 3PLs, rider and manpower agencies, payment providers, marketing agencies).
• Govern cross-border data transfers in line with PDPL conditions and PDPC licensing/approval requirements.
• Data Subject Rights & Complaints
• Own the enterprise process for data subject requests (access, correction, erasure, objection, consent withdrawal) for customers, employees and partners, within statutory deadlines.
• Oversee privacy complaints and escalations, in coordination with Customer Experience, P&C and Legal.

Breach Management & Information Security Partnership

• Own the personal data breach response plan; jointly lead incident response with the CISO/Information Security.
• Decide on and lead notification to the PDPC and affected data subjects within the legal timeframe (72 hours to the PDPC under the PDPL).
• Partner with the CISO on technical and organizational security measures, retention schedules and secure disposal across offices, sites and devices.
• Awareness, Culture & Assurance
• Design the enterprise privacy training and awareness programme, tailored by audience (ExCom, tech and product, marketing, customer service, operations, frontline workforce).
• Run a compliance monitoring and assurance plan; support Internal Audit and external audits; report privacy KPIs quarterly to ExCom and the Audit & Risk Committee.
• Required Education, Knowledge, And Skills:

Education

• Bachelor’s degree in Law, Information Systems, Computer Science or Business Administration.
• Master’s degree / LLM in technology, data or privacy law is a strong plus.
• Mandatory Regulatory Requirement (Egypt PDPL)
• Registered in the PDPC’s DPO Registry, at the highest category/level (Category A / Lead level), given the volume and sensitivity of the personal data Breadfast processes – or able to obtain it before appointment.
• Passed the PDPC-approved DPO examination required for registration.
• Keeps registration valid; it lasts two years and must be renewed.
• Supporting International Certifications (preferred, not a substitute for PDPC registration)
• IAPP, ISC2, PECB or ISO-accredited
• IAPP CIPP/E and CIPM; CIPT or FIP a plus.
• ISO/IEC 27701 or ISO/IEC 27001 Lead Implementer/Auditor; CISA, CISM or CDPSE advantageous.
• The PDPC may take relevant certifications into account when assigning a DPO’s registration category.

Experience

• 12+ years in data protection, information security, compliance or technology law, including 5+ years leading a privacy programme or function.
• Proven track record building an enterprise privacy programme end-to-end (governance, RoPA, DPIAs, DSRs, breach response, vendor management) in a large organisation.
• Experience in consumer-facing digital businesses – e-commerce, quick-commerce, retail/FMCG, telecom or fintech – with large customer databases and a large frontline workforce.
• Hands-on experience with Egypt PDPL compliance; strong GDPR experience; GCC privacy laws (Saudi PDPL, UAE PDPL) a plus.
• Experience presenting to Executive Committees and Boards, and dealing directly with regulators.