Senior Manager - Data Protection and AI Legal

About the job

Established in 2004, Dubai Holding is a global investment company with investments in more than 34 countries and a combined workforce of nearly 45,000 individuals. In line with the vision of Dubai’s leadership and economic diversification strategy, Dubai Holding companies have nurtured sectors, irrevocably transforming Dubai’s socio-economic landscape and positioning Dubai as a diversified, globally integrated economy.

Dubai Holding is committed to the diversification of Dubai’s non-oil economy. Our portfolio, valued at over AED 284+ billion, spans 10 sectors, including real estate, hospitality, leisure & entertainment, ICT, design, education, media, retail, manufacturing & logistics, and science.

For the Good of Tomorrow

Dubai Holding is looking to hire a Senior Manager, Data Protection & AI Legal at the corporate office. The role holder is responsible for leading data protection compliance for two assigned Dubai Holding verticals, one of which has high data protection risk exposure, ensuring their processing of personal data complies with applicable data protection laws, including the EU General Data Protection Regulation (EU GDPR), the KSA Personal Data Protection Law (KSA PDPL), China’s Personal Information Protection Law (China PIPL) and the EU ePrivacy Directive, and with Dubai Holding’s Global Data Protection Framework.

The role holder is the recognised data protection lead and trusted adviser to the leadership of the assigned verticals, owning the full range of data protection activity across their portfolio, including Records of Processing Activities (ROPAs), Data Protection Impact Assessments (DPIAs), data subject requests (DSRs), data incidents, vendor risk management, transfer impact assessments (TIAs) and in-country risk assessments. They also lead AI governance for the assigned verticals where AI use-cases involve personal data, in line with the Group AI Framework and applicable requirements, including the EU Artificial Intelligence Act (EU AI Act) where relevant, personally reviewing high-risk AI use-cases and acting as the escalation point for AI governance matters within the verticals.

As an integral member of the Data Protection and AI Legal team, the role holder contributes to Group-wide risk identification and mitigation, regulatory-driven projects and the data protection engagement programme, working closely with the Head of Data Protection and AI Legal and the Data Protection Operations team, which runs the Group-wide DSR and ROPA processes.

Key Responsibilities:

Vertical Data Protection Leadership

• Act as the data protection lead for the two assigned verticals, one of which has high data protection risk exposure, serving as the trusted adviser to vertical leadership on all data protection matters.
• Keep vertical leadership teams informed of the data protection risk agenda, the key risks within their vertical and relevant regulatory changes, and agree the actions needed to address them.
• Analyze the processing activities of the assigned verticals, carry out assurance activities and identify areas of risk, planning mitigation in line with the Group’s risk appetite.
• Maintain a holistic view of the data protection risk profile of the assigned verticals, tracking KPIs and escalating material risks to the Head of Data Protection and AI Legal.

Records of Processing & Privacy Assessments

• Own the accuracy and completeness of ROPAs for the assigned verticals, ensuring they reflect current operational processes, and complete their validation and approval in OneTrust in line with the standards set by Data Protection Operations.
• Train process owners on ROPA review and reconfirmation, and facilitate ROPA sign-off with functional executives in line with the Global Data Protection Framework.
• Lead periodic ROPA cleansing reviews for the assigned verticals, identifying gaps so that records reflect the current state of processing.
• Lead and conduct DPIAs, vendor due diligence, transfer impact assessments, in-country risk assessments and AI governance assessments for the assigned verticals, owning the identification and mitigation of associated risks through to closure.
• Act as the escalation point for complex or high-risk data protection matters arising in the assigned verticals, including AI use-cases.

AI Governance

• Lead AI governance for the assigned verticals where AI use-cases involve personal data, providing direction in line with the Group AI Framework and applicable requirements, including the EU AI Act where relevant.
• Lead the review of AI-related projects in the assigned verticals for compliance, carrying out or approving EU AI Act applicability and risk assessments and advising on the technical aspects of processing and data flows of AI use-cases involving personal data.
• Ensure AI use-cases involving personal data are identified and recorded in the ROPAs, and oversee the cross-referencing of associated data protection and AI governance assessments, controls and records.
• Own the design and operation of AI governance controls relating to personal data in the assigned verticals, such as privacy by design checks, data minimisation and supporting documentation, ensuring controls operate effectively, evidence is maintained and issues are resolved or escalated to the Head of Data Protection and AI Legal.

Data Subject Requests & Incident Management

• Own data subject request and data incident outcomes for the assigned verticals, partnering with the Data Protection Operations team, which runs the Group-wide DSR process, to ensure statutory timeframes and requirements are met.
• Act as the vertical point of contact for complex or sensitive DSRs and incidents, advising vertical leadership on risk, notification and remediation.
• Lead process enhancements for the assigned verticals, in alignment with the Head of Data Protection and AI Legal, to move DSR and incident handling towards a mature, automated state.

Policy Compliance & Privacy Culture

• Drive adherence to the Group’s data protection policies and procedures across the assigned verticals, including the Global Data Protection Framework, Privacy by Design, Vendor Risk Management, Cross-Border Data Transfers, Data Subject Request Management, Cookies and Similar Technologies, and Records Management.
• Ensure the assigned verticals comply with the EU ePrivacy Directive and Dubai Holding’s aligned policies and procedures.
• Contribute to the periodic review of policies, procedures, assessment templates and governance practices with the Head of Data Protection and AI Legal, and develop supporting content and training.
• Assess the adoption and effectiveness of policies across the assigned verticals using KPIs and periodic audits such as self-certifications, mystery shopping and audit submissions, and implement process and training improvements to close identified gaps.
• Contribute to initiatives that embed a privacy culture, including training, communications and the Data Protection Champion Network, and shape awareness and training on data protection considerations for AI use-cases.

Team Contribution & Special Projects

• Contribute to Group-wide data protection risk identification and mitigation, operational queries and the data protection engagement programme as an integral member of the Data Protection and AI Legal team.
• Lead assigned workstreams on special projects with the Head of Data Protection and AI Legal, including changes to the portfolio landscape and exposure to new data protection regimes.
• Oversee the completion and sign-off of compliance remediation programmes for the assigned verticals, in line with Group strategy and risk appetite.

Who we are looking for:

• 6 – 8 years of relevant experience in data protection, privacy or a related compliance role, ideally including experience in a financial institution, advisory firm or Big 4 firm.
• Demonstrated experience acting as the data protection lead or adviser for a business, portfolio or region, including DPIAs, vendor risk management and cross-border transfer assessments.
• Demonstrated experience leading or overseeing AI governance or AI-related compliance activities involving personal data.
• Knowledge of Dubai Holding’s organisation structure, business strategy and operational processes, or those of a comparable diversified group, preferred.

Education / Professional Certifications:

• Bachelor’s degree in Law, Investments, Accounting, Finance or a related field.
• Certified Information Privacy Professional (CIPP/E) or equivalent privacy certification (mandatory).
• Certified Information Privacy Manager (CIPM) or equivalent privacy management certification (desirable).
• Artificial Intelligence Governance Professional (AIGP), or working towards it (desirable).

Technical Competencies:

• In-depth knowledge of EU GDPR, KSA PDPL, China PIPL, the EU ePrivacy Directive and other applicable data protection laws.
• Strong knowledge of AI governance requirements relating to personal data processing, including the EU AI Act, privacy by design, legal bases and data minimisation, with the ability to apply them to complex use-cases, assure operational controls and resolve escalated issues.
• Strong knowledge of DPIA, vendor due diligence, transfer impact assessment and in-country risk assessment methodologies.
• Experience maintaining, validating and approving ROPAs in OneTrust or a similar privacy management platform.
• Understanding of control frameworks, such as NIST and ISO, preferred.
• Strong analytical and problem-solving skills, with the ability to assess risk and design proportionate mitigation.
• Fluent English, with excellent written and verbal communication; additional languages advantageous.

Behavioral Competencies

• Works in a disciplined and structured way, holds themselves to high standards of accuracy and timeliness, and instinctively looks for simpler, better ways of working rather than accepting the status quo.
• Applies deep expertise with confidence and sound judgement, exercises discretion on sensitive matters, and takes personal responsibility for keeping knowledge and capability current.
• Builds strong relationships and trust quickly with stakeholders at all levels of the organisation, listens to understand the other party’s position, and influences through reasoning and persuasion rather than authority to secure buy-in and support for the data protection framework, staying calm, constructive and professional when challenged or under pressure.
• Takes personal responsibility for commitments, follows through to completion without prompting, and is open and timely in raising issues rather than allowing them to escalate unseen.
• Expresses complex matters clearly and concisely, including emerging AI-related data protection topics, adapts tone and level of detail to the audience, and listens actively to confirm understanding before responding.
• Works independently and as part of a team, maintaining pace, resilience and quality of output under pressure and competing priorities.

As much as we would be delighted to entertain all applicants, due to the high volumes of applications, only successful applicants will be contacted within 14 business days.