Job Purpose:

Under the general direction of the Principal/CEO, the Data Protection Officer is responsible for the ensuring that the College/Institution operates in accordance with the Data Protection Act 2020. The incumbent is also responsible for directing and coordinating all aspects relating to the implementation of data protection/privacy policies and procedures within the College/Institution. The incumbent will play a critical role in safeguarding the privacy rights of individuals for whom data is held or processed by the College/Institution and will ensure that sensitive data is protected. The incumbent will also be responsible for assessing any breaches in the policies/systems/processes and develop risk mitigation strategies.

Key Outputs:

• Annual Work Plan prepared
• Data Protection Act implemented and monitored
• Internal controls developed and adhered to;
• Data Protection processes and strategy developed, implemented and monitored;
• Data protection impact assessments conducted;
• Breaches identified and notifications prepared;
• Reports prepared and submitted;
• Adherence/compliance with standards monitored;
• Governance  and accountability mechanisms evaluated and recommendations provided;
• Continuous improvement strategies developed and implemented;
• Risks identified and risk mitigation strategies developed and implemented/monitored
• Technical advice provided;
• Staff/Student Sensitization sessions conducted.

Key Responsibility Areas:

Technical/ Professional Responsibilities

• Directs and manages the development of security measures and a privacy governance framework to manage data use in compliance with the Data Protection Act, including developing templates for data collection, and assisting with data mapping.
• Develops standards for processing of personal data in compliance with the data protection standards and the Data Protection Act and good practice;
• Ensures that any contravention of the data protection standards or any provisions of the Data Protection Act by the College is dealt with in accordance with the

Management Responsibilities:

• Liaises with the OIC on issues relating to the processing of data, and to consult, where appropriate, with regard to any other matter;
• Consults with the Office of the Information Commissioner (OIC) to resolve any doubt about how the provisions of the Data Protection Act and any Regulations made thereunder are to be applied;
• Provide regular updates to the Principal/CEO and the Executive Team on data protection activities, compliance status and emerging privacy risks.
• Monitors changes to local privacy laws and makes recommendations where necessary.
• Keeps abreast of Jamaica Data Protection laws and regulations, and industry best practices and international laws including the European Union's General Data Protection Regulations (GDPR), Electronic Privacy Act and other international data protection laws;
• Provides responses to comments and queries from data subjects in relation to the processing of personal data;

Other:

Performs any other related duties as assigned by the Principal/CEO

Performance Standards: 

• External regulations (Data Protection Act) and internal controls adhered to within accordance with legislative framework;
• Data Protection framework      and strategy developed and implemented   within accordance with legislative framework;
• Data protection impact assessments conducted within agreed timeframes;
• Breaches identified and notifications prepared within agreed timeframes;
• Reports prepared and submitted within agreed timeframes;
• Continuous monitoring conducted within accordance with legislative framework;
• Adherence/compliance with standards monitored within accordance with legislative framework;
• Governance and accountability mechanisms evaluated and recommendations made;
• Research and analysis conducted and findings documented within accordance with legislative framework;
• Continuous improvement strategies developed and implemented within accordance with legislative framework;