Role Description We are seeking a Data Privacy Officer with expertise in GDPR, information security policies, compliance, and risk management. The ideal candidate has a strong understanding of data processing, operations, IT infrastructure, and information security, along with excellent communication, reporting, and documentation skills to support the organization's data protection initiatives. Requirements - Knowledge of Information Security Policies and Compliance Regulations - GDPR - Internal LTVplus Information Security Policies - Risk Management - Strong understanding of data processing and management of Operations, IT infrastructure, and information security - Excellent communication and leadership skills to effectively guide the organization in data protection matters - Knowledge in Reporting and Analysis - Great attention to detail and strong documentation skills Responsibilities - Compliance Monitoring - Monitor compliance with data protection laws (e.g., GDPR, local privacy regulations) - Ensure alignment with ISO 27001:2022 controls related to data privacy and security - Data Protection Impact Assessments (DPIAs) - Advise and support teams in conducting DPIAs where necessary - Review new projects, systems, and processes for potential data risks - Policies and Documentation - Help maintain and update the company’s Data Privacy Policy and related SOPs - Work with the ISMS team to ensure documentation meets audit and legal requirements - Incident Management - Maintain a data breach response plan in line with GDPR requirements - Lead investigations of data breaches and ensure timely notification to relevant supervisory authorities and affected individuals when required - Data Subject Rights Management - Ensure the company has effective processes in place to respond to requests from individuals exercising their rights under GDPR, such as the right to access, rectification, and deletion of personal data - Oversee the fulfillment of data subject requests within the mandated timeframes - Liaison with Supervisory Authorities - Act as the main point of contact between the company and data protection supervisory authorities - Handle requests and queries related to data protection, including from data subjects - Policy Development and Maintenance - Develop, implement, and update the company’s data protection policies, procedures, and guidelines to ensure they remain current with GDPR and other data protection regulations - Ensure these policies are effectively communicated and enforced across the organization - Record Keeping and Documentation - Oversee the handling of data subject access requests (DSARs) - Maintain logs and records related to personal data processing activities - Contractual and Third-Party Compliance - Review and negotiate data protection clauses in contracts with third-party vendors and partners to ensure GDPR compliance - Conduct regular assessments of third-party data processors to ensure they adhere to GDPR requirements - Risk Management - Identify, evaluate, and manage data protection risks associated with the company’s operations - Work with the IT and security teams to implement measures to mitigate identified risks, including the implementation of encryption, anonymization, and pseudonymization where appropriate - Reporting and Analysis - Provide reports and analysis of the current LTVplus standing in terms of information security posture Tech Checklist – Gotta Have It! - A reliable computer (preferably younger than 3 years) and a stable high-speed internet connection - Experience working with Marketplace platforms such as Amazon, eBay, Etsy, Walmart, and Google Shopping Actions, et al. - A quiet, cozy workspace to handle calls and chats like a pro