Position Title: Data Protection Officer

Reports to: IT Specialist

Type of position: Full time

Location: University of Global Health Equity (UGHE), Butaro campus with travels to Kigali, Rwanda

Position overview

The University of Global Health Equity is seeking a qualified Data Protection Officer (DPO) to ensure our organization’s compliance with data protection laws and regulations in Rwanda and globally. The DPO will be responsible for overseeing data protection strategy and coordinate the required implementation to ensure compliance with the regulatory bodies in Rwanda and other relevant regulations. This role requires a combination of legal and technical knowledge related to data protection and privacy.

Roles and responsibilities 

The tasks for the Data Protection Officer will include but not limited to: 

• Compliance Monitoring: Monitor compliance with the GoR policies, along with other national and international data protection and privacy laws and policies. This includes IT standards compliance and managing all aspects of data protection ranging from data processing to data transfer and storage.
• Policy & Strategy Development and Implementation: Develop, implement, and maintain comprehensive data protection policies and procedures to ensure the ethical and legal handling of sensitive data.
• Training and Awareness: Conduct training sessions and awareness programs for staff at all levels on compliance requirements and data protection practices.
• Data Protection Impact Assessments: Carry out Data Protection Impact Assessments (DPIA) for all projects and systems that process personal data, ensuring that any risks are identified and mitigated, vulnerability management
• Incident Management: Act as the point of contact between UGHE and data protection authorities. Coordinate and communicate with regulatory authorities on data protection matters. Managing data breaches and data security incidents in accordance with legal requirements and best practices.
• Preservation and Security of Physical Documents: Develop and implement policies and procedures for the preservation and security of physical documents containing personal or sensitive information. Ensure physical documents are stored securely and access is restricted to authorized personnel only. Conduct regular audits of physical document storage areas to identify and address security vulnerabilities. Implement measures to protect physical documents from loss, theft, or damage, including the use of secure storage solutions and access controls. Coordinate with the IT department to ensure that digital and physical document management systems are integrated and compliant with data protection regulations.
• Auditing and Reporting: Regularly audit data protection measures and processes, report on data protection practices and compliance to senior management.
• Advisory Role: Advise on and review contracts or agreements where data privacy issues arise, including agreements with third parties that handle the university’s data.

Qualifications 

• Education: Bachelor’s degree in Law, Information Security, Computer Science, or a related field. A master’s degree or relevant professional qualifications (e.g., CISSP – Certified Information Systems Security Professional, CIPP – Certified Information Privacy Professional) is preferred.

Experience:

• Minimum of 5 years of experience in data protection or a related field, with a proven track record of handling comprehensive compliance programs.
• Knowledge of Laws and Regulations: Extensive knowledge of GDPR and other relevant Rwandan and international data protection laws.

Skills:

• Strong analytical and problem-solving skills,
• excellent communication skills,
• proficient in stakeholder management,
• Able to handle confidential and sensitive information discreetly.