Data Privacy Senior Analyst

Description :

Senior Analyst, Data Privacy Reporting to Director, Data Privacy within client GTO Information Security group, this role will serve as the Senior Analyst, Data Privacy for the GTO Privacy Office, and thus requires a very strong understanding and interest in data privacy specifically, and IT security / cybersecurity in general. The role focuses on assessing the appropriate use of personal information in projects & vendor agreements and providing subject matter expertise on privacy and data protection to business stakeholders to ensure incorporation of privacy-by-design into all required business processes, critical projects and initiatives. The resource in this role will primarily perform review and advisory duties, including conducting Privacy Impact Assessments on projects, conducting Vendor Due Diligence on new and existing vendors, leading data inventorying efforts, and collaborating with business units to identify solutions to minimize data privacy risks. This resource will also assist in developing the privacy program via creating / updating data security policies, authoring guidelines and playbooks to document Privacy Program processes and requirements, and improve the Privacy risk register and associated metrics / KPI reporting for assessing overall privacy compliance wellness. Duties include :

• Assess and manage review process of Privacy Impact Assessments (PIAs) and Data Protection Impact Assessments (DPIAs), analyzing responses to identify risks involving the collection, access, use, protection, storage and destruction of personal and / or sensitive information. Communicate data privacy related risks and develop and advise on the implementation of risk mitigation plans.
• Assess and manage data privacy area in vendor management process, which includes conducting Vendor Due Diligence (VDD) assessments of vendors, analyzing their responses to highlight privacy issues, and proposing steps to reduce risk to client . Partner with Security team to help identify security risks for further analysis.
• Lead data inventorying, data processing, business process documentation projects with data owners across the organization, and other efforts to maintain proper Records of Processing Activities (RoPAs)
• Collaborate with the Privacy Program Manager in applicable parts of issuing and managing vendor and third-party service provider questionnaires, creating status reports, providing content for Privacy Program documentation, and completing consumer rights requests (DSARs, DNS’s, etc.)
• Work closely with the Legal Privacy team to gather global regulatory and legal requirements, document them, and translate them to business unit and region-specific guidelines and standards for allowed technology and business processes
• Act as a subject matter expert in day-to-day privacy operational matters, providing data privacy and data protection expertise. This includes working closely with internal stakeholders in various corporate functions and lines of business to analyze and respond to their privacy-related issues and questions.
• Lead meetings and regularly liaise with product and business teams to ensure the Privacy Office remains abreast on new projects / products and that privacy-by-design principles being followed for them
• Enforce data privacy standards in advanced technology projects and the development of connected products, websites, and mobile apps.
• Oversee the maintenance of the overall picture of data collection and processing practices for employee and consumer data. This includes documenting data inventories, data maps, and data flows.
• Support the development of privacy policies and procedures for the Privacy Office
• Support the Director, Data Privacy in client enterprise Data Governance Committee in governance activities surrounding consumer data. This includes leading working groups concerning the management and use of consumer data and analytics.
• Collaborates with client GTO Security team on activities involving PII such as potential breach incidents, vendor transmission of PII, or company-wide risk assessments. Qualifications :

Minimum

Preferred

Additional Qualifications : (Not required or preferred, a plus)