Executive Head of Privacy Job Safaricom

Job description

Legal Jobs, Safaricom Jobs. Executive Head of Privacy leads data protection and digital risk, requires a relevant Bachelor’s degree, 12–15+ years privacy experience (5+ in senior leadership), and telecom/fintech background. Full-time role in Nairobi.

Job Summary

Reporting to the Group Chief Risk Officer, the Executive Head of Privacy is accountable for shaping, governing, and advancing Safaricom’s enterprise wide Privacy, Data Protection, and Responsible Data Use strategy, frameworks, controls, and capabilities. The role provides strategic leadership in anticipating, identifying, and mitigating privacy risks, ensuring lawful and ethical data handling, safeguarding customer information, and embedding trust by design across Safaricom’s converged Telco–FinTech ecosystem, including M PESA, digital services, platforms, applications, networks, customer analytics, APIs, and partner ecosystems.

The role leads Safaricom’s Customer Privacy and Data Protection agenda across data governance, data minimisation, privacy by design, consent management, customer rights enablement, data lifecycle management, cross border data transfers, breach management, regulatory engagement, data ethics, and privacy assurance reviews. It ensures deployment of a unified Privacy Management System anchored in global standards and frameworks such as the Kenya Data Protection Act (DPA 2019), GDPR equivalent practices, ISO/IEC 27701, OECD Privacy Guidelines, GSMA Mobile Privacy Principles, and global digital trust benchmarks.

The Executive Head of Privacy partners extensively with M PESA/Financial Services, Technology, Digital, Enterprise, Consumer, Data Engineering, Networks, Legal, Risk, Compliance, Procurement, Supply Chain, Corporate Affairs, HR, Internal Audit, and external regulators (ODPC, CBK, CAK) to embed privacy resilience, strengthen data handling controls by design, and ensure robust privacy assurance across Safaricom’s rapidly evolving digital environment.

The role champions customer trust, ethical data stewardship, transparency, and responsible innovation, enabling a culture where engineers, product teams, analysts, data scientists, marketers, and ecosystem partners design and operate privacy compliant products, respect customer choices, and proactively identify and mitigate privacy risks. Through advanced privacy risk analytics, data flow mapping, consent and preference governance, third party privacy due diligence, privacy impact assessments (PIAs/DPIAs), and continuous assurance, the Executive Head of Privacy ensures Safaricom operates as one of Africa’s most trusted, privacy conscious, and ethically grounded digital enterprises.

The Executive Head of Privacy is strategically accountable for

• Privacy Strategy & Governance: Defining and governing Safaricom’s enterprise wide Privacy, Data Protection, and Data Governance strategy, policies, standards, and operating frameworks, ensuring alignment with DPA 2019, global privacy principles, and evolving regulatory expectations in digital, financial, and telecom sectors.
• Data Protection Risk Intelligence, Monitoring & Response: Driving privacy risk assessments, data flow visibility, metadata governance, monitoring of high risk processing activities, incident detection, breach response, and regulatory notifications to prevent, detect, and mitigate privacy and data misuse risks across Safaricom’s digital ecosystem.
• Privacy-by-Design, Secure Data Use & Ethical Engineering: Embedding privacy by design into technology, product development, analytics, AI/ML models, customer interfaces, APIs, and ecosystem integrations through PIAs/DPIAs, data minimisation, pseudonymisation, access governance, purpose limitation, and ethical design frameworks.
• Responsible AI Governance: Define and enforce enterprise-wide AI governance frameworks to ensure safe, ethical, and compliant use of AI across Safaricom’s digital and data ecosystem.
• Data Minimisation, Consent, Rights Management & Lifecycle Controls: Strengthening customer consent governance, transparency mechanisms, rights management (access, erasure, portability, objection), data retention and deletion controls, and lawful bases for processing, ensuring compliant, accurate, and accountable use of customer information.
• Sensitive Data & Digital Trust Safeguards: Ensuring protection of sensitive and financial data, including M PESA processing data, behavioural data, identity attributes, and metadata, applying strong privacy controls, confidentiality safeguards, and aligned practices with AML, cybersecurity, and fraud prevention teams.
• Ecosystem Privacy Assurance (M PESA, Digital, Partners, APIs): Strengthening privacy assurance for M PESA services, merchant/agent ecosystems, API partners, fintech integrations, cloud environments, cross border data flows, and digital service providers, ensuring robust contractual privacy obligations, oversight, and compliance testing.
• Privacy Compliance Reporting, Assurance & Regulatory Readiness: Delivering privacy dashboards, KRIs, heatmaps, DPIA outcomes, breach metrics, and Board/ELT reporting; ensuring readiness for ODPC audits, CBK reviews (for financial data), Internal Audit assurance, and alignment with Enterprise Risk & Compliance frameworks.
• Privacy Culture, Capability & Technology Transformation: Building enterprise wide privacy awareness, responsible data use behaviours, leadership engagement, and capability uplift across squads and functions; scaling privacy technology, automation, data classification tools, consent systems, discovery platforms, and AI driven privacy analytics.
• Privacy Advocacy & Ecosystem Engagement: Champion privacy and data ethics through proactive stakeholder engagement, regulatory collaboration, and enterprise-wide awareness.
• Group Subsidiary Oversight, Enablement & Governance: Provide Group-level oversight and strategic enablement to subsidiaries by defining minimum risk standards, frameworks, and reporting requirements while supporting local market execution through advisory partnership, capability uplift, and risk-by-design embedding. Ensure consistent application of Group policies, effective aggregation of risk exposures and emerging themes across markets, and timely escalation of material issues to the CRO and Board. Balance strong governance with commercial enablement by partnering with subsidiary leadership to proactively identify, assess, and mitigate risks in a way that supports sustainable growth and regulatory compliance across the Safaricom Group.
• Risk, Governance & Control Ownership: Embed and maintain effective risk, governance, compliance, and control practices within the function by proactively identifying and mitigating operational, regulatory, financial, people, technology, and reputational risks. Ensure adherence to internal policies, regulatory requirements, audit actions, and enterprise governance frameworks while driving accountability, ethical practices, and a strong controls environment across all areas of responsibility.
• Anchored in Safaricom’s purpose of Transforming Lives, the Executive Head of Privacy ensures Safaricom operates with uncompromising data protection standards, customer trust, and responsible innovation. By safeguarding customer information, enabling ethical data use, and reinforcing transparency at every touchpoint, the role strengthens Safaricom’s position as Africa’s most trusted and future ready digital enterprise.

Responsibilities

Health and Safety

• Uphold the company code of conduct, policies and procedures, ensuring integrity and accountability in every aspect of your work.
• All employees have a responsibility to adhere to safety, health, and wellbeing policies, guidelines and procedures in all actions and decisions. 
  Key accountabilities and decision ownership:

Privacy Strategy, Governance & Accountability

• Define and maintain the enterprise privacy strategy, policy suite, standards and baselines, aligned to Kenya’s DPA 2019 (rights, lawful bases, DPIAs, cross border rules).
• Operate a privacy governance model (committees, charters, decision rights) with clear DPO/DPIA ownership and Board/ExCo reporting.
• Implement and continually improve a PIMS under ISO/IEC 27701:2025 (stand alone management system), integrating with existing ISMS where helpful. 
• Adopt ISO/IEC 29100 privacy principles/roles as a common language across squads and vendors. 
• Map policies to GSMA Mobile Privacy Principles to ensure consistent mobile first customer protections. 
• Maintain privacy risk appetite, KRIs, and exception management, with time bound remediation and independent challenge.

Privacy by Design & Ethical Data Use

• Bake privacy by design checkpoints into lifecycle gates (ideation → design → build → release), with DPIAs/PIAs for high risk processing. 
• Apply ISO/IEC 27701 guidance to define controller/processor responsibilities, data minimisation, purpose limitation, and accountability evidence. 
• Use ISO/IEC 29100 principles to evaluate fairness, transparency, individual participation, and accountability in AI/ML use cases. 
• Adopt GSMA Mobile Privacy Design patterns for consent UX, notice, and in app privacy controls on mobile channels. 
• Publish ethical data use guardrails (e.g., no dark patterns, PETs where feasible, children’s data safeguards) and review them quarterly.
• Implement model cards and data ethics reviews for high impact algorithms affecting eligibility, pricing, or customer outcomes.

Responsible AI Governance

• Define and implement AI governance frameworks covering ethics, privacy, explainability, and accountability
• Establish enterprise-wide policies and standards for responsible AI development and deployment
• Ensure compliance with data protection laws (e.g., DPA 2019) and emerging global AI regulations
• Oversee AI use cases across the business to ensure alignment with privacy, fairness, and ethical standards
• Embed privacy-by-design and responsible AI principles into AI/ML lifecycle (design, development, deployment)
• Conduct AI risk assessments including bias, misuse, model transparency, and data protection risks
• Partner with Technology, Data, and AI teams to embed governance into MLOps and AI Factory processes
• Provide oversight and reporting to leadership on AI-related risks, controls, and regulatory exposure

Data Subject Rights, Consent & Lifecycle Management

• Standardise lawful basis and consent frameworks (opt in/opt out logic, proof of consent, preference centres) across web, app, USSD, and agent channels per DPA 2019 and General Regulations. 
• Industrialise DSARs (access, rectification, erasure, portability, objection) with SLA metrics and audit trails. 
• Implement retention & deletion schedules with defensible holds for disputes/regulatory obligations; monitor deletion job success. 
• Deploy data discovery, classification, and lineage for personal/sensitive data across on prem/cloud, billing, M PESA, and analytics stacks. 
• Govern children’s data and vulnerable segments (age gating, enhanced notices, limited profiling) as per ODPC expectations. 
• Maintain cross border transfer inventories (mechanisms, third country risk) and contractual safeguards.

Privacy Risk Intelligence, Monitoring & Breach Response

• Run a privacy risk register with heatmaps/KRIs; integrate with ERM and Security risk processes. 
• Monitor high risk processing activities (special categories, large scale profiling, location data) and trigger DPIAs where thresholds are met. 
• Establish privacy incident & breach playbooks (evidence capture, containment, harm assessment, customer comms) aligned to Section 43 breach notification obligations and ODPC’s portal. 
• Track time to detect, time to notify (ODPC/subjects) and post incident lessons; maintain full audit trails. 
• Define privacy metrics for logging/telemetry completeness supporting investigations and regulatory disclosure. 
• Coordinate joint response with Security/AML/Fraud where incidents intersect (e.g., identity theft), ensuring least necessary data is shared.

Ecosystem & Third Party Privacy Assurance (Agents, Merchants, Partners, Cloud)

• Implement privacy due diligence and risk tiering for vendors, agents, merchants, fintech partners, and cross border processors. 
• Mandate controller/processor clauses (purpose, security, sub processing limits, breach notice, audit rights, return/delete at exit). 
• Run periodic assurance (sampling, walkthroughs, evidence reviews) for high risk processors, record corrective actions and SLAs. 
• Validate mobile app SDKs/APIs for data minimisation and transparency per GSMA mobile privacy guidance. 
• Maintain an ecosystem processing inventory (what data, where, why, for how long, cross border) with ISO 27701 role mappings (controller vs. processor). 
• Run exit/transition controls to ensure secure return/erasure and revocation of access.

Sensitive, Financial & M PESA Data Safeguards

• Classify sensitive/financial PII and enforce stricter access, masking/pseudonymisation, and logging; align to DPA’s sensitive data notions. 
• Enforce purpose limitation and guardrails for analytics on financial movement/behavioural data. 
• Assure consent/notice for features like location, contact lists, device identifiers on mobile; follow GSMA principles. 
• Coordinate with AML/Fraud/Security to balance detection versus privacy (data minimisation, PETs, role based access). 
• Apply data subject rights (portability/erasure constraints) with clear exceptions where lawful (e.g., AML retention). 
• Verify downstream disclosures (e.g., to banks, PSPs) have lawful basis and proportionality.

Compliance Reporting, Audit Readiness & Regulatory Engagement

• Produce Board/ExCo privacy dashboards (DPIA volumes, DSAR SLAs, breaches, ecosystem risks, training coverage). 
• Maintain regulatory readiness for ODPC (audits, inquiries, responses), and coordinate with CBK/CAK where scopes intersect (financial/telecom data). 
• Align with Internal Audit on annual privacy assurance; close findings within SLA; prevent repeats. 
• Operate quality assurance over notices, consents, DSAR outputs, breach files, and cross border documentation. 
• Keep policy/standards current with legislative updates and OECD privacy guidance (principles, risk based accountability, breach notification concepts). 
• Document regulator communications and commitments; track to closure.

Privacy Advocacy & Ecosystem Engagement

• Lead engagement with regulators (ODPC, CBK) on data protection, privacy, and AI-related topics
• Represent Safaricom in industry forums and working groups on privacy and digital trust
• Build strong relationships with internal stakeholders across Technology, Commercial, Legal, and Risk
• Drive enterprise-wide awareness and culture on privacy, data ethics, and responsible data use
• Influence policy development and regulatory direction on emerging privacy and AI issues
• Provide strategic advisory to leadership on stakeholder expectations and regulatory positioning
• Develop thought leadership on privacy, digital trust, and responsible innovation
• Position Safaricom as a trusted, privacy-conscious digital ecosystem player

Privacy Culture, Capability & Technology Transformation

• Define a capability framework; hire and develop talent (privacy engineers, DPIA specialists, consent UX, data governance, incident response). 
• Roll out role based training for product, data, engineering, marketing, care, and ecosystem partners, measure completion and effectiveness. 
• Deploy privacy tech (consent & preference platforms, discovery/classification, data lineage, deletion/orchestration, PETs, redaction tools). 
• Establish RACI & playbooks for DPIAs, DSARs, breaches, cross border transfers; rehearse with simulations. 
• Drive continuous improvement sprints (consent UX, DSAR cycle time, deletion automation, false positive reduction in breach triage). 
• Participate in GSMA/OECD privacy communities; bring back best practices and benchmark insights.

Stakeholder Management

• Serve as the primary liaison between the Chief Corporate Risk Officer and all Privacy relevant internal and external stakeholders, ensuring timely, transparent, and insight driven communication on data protection risks, emerging privacy issues, regulatory obligations, customer rights trends, data ethics concerns, and developments impacting Safaricom’s Telco–FinTech platforms.
• Build and sustain trusted relationships with Privacy and Data Protection regulators, including the Office of the Data Protection Commissioner (ODPC), CAK, CBK (for financial data scopes), regional privacy authorities, global privacy networks, industry taskforces, and standard setting organisations (ISO/IEC 27701, ISO/IEC 29100, GSMA Mobile Privacy) — positioning Safaricom as a responsible, transparent, and privacy mature digital enterprise. 
• Engage proactively with global and regional privacy forums, digital trust alliances, mobile privacy working groups, cross border data flow policy networks, and cloud privacy governance bodies to benchmark maturity, anticipate regulatory shifts, understand emerging privacy risks (AI/ML, IoT, digital ID), and embed international best practice into Safaricom’s privacy management system. 
• Collaborate cross functionally with M PESA/Financial Services, Technology, Digital, Enterprise, Consumer, Networks, Data Engineering, Legal, Risk, Compliance, Procurement, Supply Chain, Finance, Strategy, Corporate Affairs, HR, and Internal Audit to embed privacy by design, responsible data practices, transparency, and lawful processing into systems, products, data flows, algorithms, and customer journeys. 
• Leverage insights from DPIAs, privacy risk assessments, data flow mapping, consent analytics, DSAR patterns, breach investigations, partner privacy assessments, and behavioural data use indicators to refine privacy strategy, strengthen internal controls, elevate design choices, influence senior leadership decisions, and protect Safaricom’s digital trust and reputation. 
• Represent Safaricom in national, regional, and global privacy, digital rights, and data protection platforms, including privacy summits, regulator roundtables, mobile industry privacy forums