Data Governance Team Head

Mô tả công việc
Mức độ phù hợp và xếp hạng của bạn so với ứng viên khác như thế nào?
Lead the design, implementation and continuous improvement of the Company's Data Governance and Personal Data Protection framework, ensuring compliance with Vietnam's data and privacy regulations and Shinhan Finance Group's requirements, and act as the Company's central contact point with competent authorities on data protection matters.
1. Data Governance Framework & Policy Management
• Develop, implement, and continuously update the Company's Data Governance framework, Personal Data Protection (PDP) policies, guidelines, and procedures across all business units, in line with local regulations and Group requirements.
• Establish and maintain the personal data processing register, data inventory and data classification standards, and define the roles of data owners and data stewards.
• Coordinate with Information Communications Technology (ICT) Division on data architecture, access control, retention, and data lifecycle requirements.
• Monitor legislative and regulatory developments on data and privacy, assess their impact and propose timely updates to internal policies and processes.
2. Personal Data Protection Compliance & Impact Assessments
• Ensure that the collection, processing, storage and sharing of personal data are conducted on appropriate legal bases and with valid consent, in compliance with the Personal Data Protection Law (PDPL) and its implementing regulations.
• Lead the preparation, documentation and archival of Data Processing Impact Assessment (DPIA) dossiers and Cross-Border Personal Data Transfer Impact Assessment dossiers in accordance with statutory requirements.
• Manage the official submission, updates and reporting of such dossiers to the competent authority (including the Department of Cyber Security and High-Tech Crime Prevention - A05, Ministry of Public Security) within statutory timelines.
• Review new products, processes, systems, and projects from a data protection perspective (privacy by design and by default).
3. Data Subject Rights Management
• Establish standard operating procedures (SOPs) to receive, verify and resolve data subject requests (including access, correction, deletion, consent withdrawal, data portability and objection) within statutory timelines.
• Coordinate with relevant divisions and departments to ensure requests are fulfilled accurately and maintain records and tracking of all requests and responses.
• Escalate complex or high-risk requests and complaints to the Head of Compliance Department and relevant stakeholders in a timely manner.
4. Incident Response & Breach Notification
• Lead the handling mechanism for personal data security incidents and investigate data breaches in coordination with ICT and other relevant units.
• Coordinate timely mandatory notifications to competent authorities and affected data subjects and ensure that incident records are properly maintained.
• Monitor root-cause analysis and remediation actions and recommend preventive measures to avoid recurrence.
5. Third-Party & Group Data Oversight
• Review Data Processing Agreements (DPAs), data sharing arrangements and vendor contracts to ensure alignment with the Company's data governance requirements.
• Conduct due diligence and periodic reviews of third-party processors, cloud service providers and partners, and monitor remediation of identified gaps.
• Support compliance of data sharing and cross-border data transfers with Shinhan Finance Group and other affiliates.
6. Data Governance Monitoring & Internal Control
• Perform monitoring, control reviews and testing to assess the effectiveness of data governance and data protection controls, and to identify data-related compliance risks.
• Support gap analysis and remediation actions to address regulatory or policy gaps in data governance and data protection.
• Monitor remediation of audit findings, regulatory observations and control weaknesses related to data governance and data protection.
• Coordinate with Internal Audit, ICT, and relevant stakeholders on data-related matters.
7. Regulatory Liaison, Audit & Reporting
• Act as the designated contact point for communications, inquiries, audits, and inspections by competent state authorities on data protection matters.
• Coordinate internal, external, and regulatory audits and reviews related to data governance and data protection.
• Prepare and submit periodic and ad-hoc data governance and data protection reports to regulators, management and Group Compliance as required.
• Timely escalate significant data protection issues, breaches and emerging risks to the line manager and relevant stakeholders.
8. Training & Enhancing Awareness
• Design and deliver data protection and data governance training programs to promote enterprise-wide awareness, including mandatory training for employees.
• Develop and update training materials and awareness initiatives, and act as the trusted advisor to Business, HR, Marketing, Legal, ICT and other departments on data-related matters.
9. Other tasks
• Other tasks as assigned by Head of Legal & Compliance from time to time.