Data Protection Officer

As a member of Munich Re, the MedNet Group is a leading Third-Party Administrator (TPA) serving the healthcare and insurance sectors across the MEA region. We are looking for an experienced Data Protection Officer (DPO) who will be responsible for overseeing and promoting compliance with applicable data protection and privacy laws, regulations and Munich Re Group requirements across the MedNet Group. The DPO acts as the independent subject matter expert for data protection matters and provides advice, guidance and oversight to management, employees and business functions on the lawful, fair and secure processing of personal data.

The role reports directly to the Chief Compliance Officer and maintains a functional reporting line to the Munich Re Data Protection Team and will from time-to-time report to the Munich Re Regional Head of Legal and Compliance for DP related issues. The DPO supports the development, implementation and continuous improvement of the MedNet Group data protection framework and serves as the central point of contact for data protection regulators, data subjects and Munich Re Group stakeholders on privacy-related matters.

Your Role:

·       Maintain and enhance the Data Protection Framework, policies and procedures, ensuring compliance with applicable data protection laws and regulatory requirements across all MedNet jurisdictions, with timely reporting to management and relevant governance committees.

·       Deliver the annual Data Protection Monitoring Plan, conduct monitoring reviews, identify and report key privacy risks, issue recommendations, and track agreed remediation actions through to closure.

·       Review and advise on Data Protection Impact Assessments (DPIAs) for high-risk processing activities, ensuring assessments are completed prior to implementation and resulting management actions are effectively monitored.

·       Oversee personal data breach and privacy incident management, including timely assessment and documentation, regulatory notifications where required, root cause analysis for significant incidents, and monitoring of corrective actions.

·       Monitor data subject rights requests across relevant entities, ensuring statutory response requirements are met while identifying and escalating significant trends, recurring issues, complaints or regulatory enquiries.

·       Drive data protection training and awareness, including annual mandatory training, targeted awareness sessions for high-risk business functions, and initiatives designed to strengthen employees’ privacy awareness.

·       Provide privacy oversight for third-party risk assessments, outsourcing, data-sharing arrangements and cross-border transfers, ensuring compliance with applicable local laws and Munich Re Group transfer requirements and escalating non-compliant arrangements.

·       Support regulatory inspections, audits reporting and requests, engage effectively with Munich Re Data Protection and Regional Legal & Compliance teams, monitor legislative developments maintain privacy metrics and management reporting, and drive continuous improvement and maturity of the privacy programme.