Executive Head of Privacy leads data protection and digital risk, requires a relevant Bachelor’s degree, 12–15+ years privacy experience (5+ in senior leadership), and telecom/fintech background. Full-time role in Nairobi.
Job Summary
Reporting to the Group Chief Risk Officer, the
Executive Head of Privacy is accountable for shaping, governing, and advancing
Safaricom’s enterprise wide Privacy, Data Protection, and Responsible Data Use
strategy, frameworks, controls, and capabilities. The role provides strategic
leadership in anticipating, identifying, and mitigating privacy risks, ensuring
lawful and ethical data handling, safeguarding customer information, and
embedding trust by design across Safaricom’s converged Telco–FinTech ecosystem,
including M PESA, digital services, platforms, applications, networks, customer
analytics, APIs, and partner ecosystems.
The role leads Safaricom’s
Customer Privacy and Data Protection agenda across data governance, data
minimisation, privacy by design, consent management, customer rights
enablement, data lifecycle management, cross border data transfers, breach
management, regulatory engagement, data ethics, and privacy assurance reviews.
It ensures deployment of a unified Privacy Management System anchored in global
standards and frameworks such as the Kenya Data Protection Act (DPA 2019), GDPR
equivalent practices, ISO/IEC 27701, OECD Privacy Guidelines, GSMA Mobile
Privacy Principles, and global digital trust benchmarks.
The Executive Head of Privacy
partners extensively with M PESA/Financial Services, Technology, Digital,
Enterprise, Consumer, Data Engineering, Networks, Legal, Risk, Compliance,
Procurement, Supply Chain, Corporate Affairs, HR, Internal Audit, and external
regulators (ODPC, CBK, CAK) to embed privacy resilience, strengthen data
handling controls by design, and ensure robust privacy assurance across
Safaricom’s rapidly evolving digital environment.
The role champions customer
trust, ethical data stewardship, transparency, and responsible innovation,
enabling a culture where engineers, product teams, analysts, data scientists,
marketers, and ecosystem partners design and operate privacy compliant products,
respect customer choices, and proactively identify and mitigate privacy risks.
Through advanced privacy risk analytics, data flow mapping, consent and
preference governance, third party privacy due diligence, privacy impact
assessments (PIAs/DPIAs), and continuous assurance, the Executive Head of
Privacy ensures Safaricom operates as one of Africa’s most trusted, privacy
conscious, and ethically grounded digital enterprises.
The Executive Head of Privacy
is strategically accountable for:
Privacy
Strategy & Governance: Defining and governing Safaricom’s enterprise wide
Privacy, Data Protection, and Data Governance strategy, policies, standards,
and operating frameworks, ensuring alignment with DPA 2019, global privacy
principles, and evolving regulatory expectations in digital, financial, and
telecom sectors.
Data
Protection Risk Intelligence, Monitoring & Response: Driving privacy risk
assessments, data flow visibility, metadata governance, monitoring of high risk
processing activities, incident detection, breach response, and regulatory
notifications to prevent, detect, and mitigate privacy and data misuse risks
across Safaricom’s digital ecosystem.
Privacy-by-Design,
Secure Data Use & Ethical Engineering: Embedding privacy by design into
technology, product development, analytics, AI/ML models, customer interfaces,
APIs, and ecosystem integrations through PIAs/DPIAs, data minimisation,
pseudonymisation, access governance, purpose limitation, and ethical design
frameworks.
Responsible
AI Governance: Define and enforce enterprise-wide AI governance frameworks to
ensure safe, ethical, and compliant use of AI across Safaricom’s digital and
data ecosystem.
Data
Minimisation, Consent, Rights Management & Lifecycle Controls:
Strengthening customer consent governance, transparency mechanisms, rights
management (access, erasure, portability, objection), data retention and
deletion controls, and lawful bases for processing, ensuring compliant,
accurate, and accountable use of customer information.
Sensitive
Data & Digital Trust Safeguards: Ensuring protection of sensitive and
financial data, including M PESA processing data, behavioural data, identity
attributes, and metadata, applying strong privacy controls, confidentiality
safeguards, and aligned practices with AML, cybersecurity, and fraud prevention
teams.
Ecosystem
Privacy Assurance (M PESA, Digital, Partners, APIs): Strengthening privacy
assurance for M PESA services, merchant/agent ecosystems, API partners, fintech
integrations, cloud environments, cross border data flows, and digital service
providers, ensuring robust contractual privacy obligations, oversight, and
compliance testing.
Privacy
Compliance Reporting, Assurance & Regulatory Readiness: Delivering privacy
dashboards, KRIs, heatmaps, DPIA outcomes, breach metrics, and Board/ELT
reporting; ensuring readiness for ODPC audits, CBK reviews (for financial
data), Internal Audit assurance, and alignment with Enterprise Risk &
Compliance frameworks.
Privacy
Culture, Capability & Technology Transformation: Building enterprise wide
privacy awareness, responsible data use behaviours, leadership engagement, and
capability uplift across squads and functions; scaling privacy technology,
automation, data classification tools, consent systems, discovery platforms,
and AI driven privacy analytics.
Privacy
Advocacy & Ecosystem Engagement: Champion privacy and data ethics through
proactive stakeholder engagement, regulatory collaboration, and enterprise-wide
awareness.
Group
Subsidiary Oversight, Enablement & Governance: Provide Group-level
oversight and strategic enablement to subsidiaries by defining minimum risk
standards, frameworks, and reporting requirements while supporting local market
execution through advisory partnership, capability uplift, and risk-by-design
embedding. Ensure consistent application of Group policies, effective
aggregation of risk exposures and emerging themes across markets, and timely
escalation of material issues to the CRO and Board. Balance strong governance
with commercial enablement by partnering with subsidiary leadership to
proactively identify, assess, and mitigate risks in a way that supports
sustainable growth and regulatory compliance across the Safaricom Group.
Risk,
Governance & Control Ownership: Embed and maintain effective risk,
governance, compliance, and control practices within the function by
proactively identifying and mitigating operational, regulatory, financial,
people, technology, and reputational risks. Ensure adherence to internal
policies, regulatory requirements, audit actions, and enterprise governance
frameworks while driving accountability, ethical practices, and a strong
controls environment across all areas of responsibility.
Anchored
in Safaricom’s purpose of Transforming Lives, the Executive Head of Privacy
ensures Safaricom operates with uncompromising data protection standards,
customer trust, and responsible innovation. By safeguarding customer
information, enabling ethical data use, and reinforcing transparency at every
touchpoint, the role strengthens Safaricom’s position as Africa’s most trusted
and future ready digital enterprise.
Responsibilities
Health
and Safety
Uphold
the company code of conduct, policies and procedures, ensuring integrity and
accountability in every aspect of your work.
All
employees have a responsibility to adhere to safety, health, and wellbeing
policies, guidelines and procedures in all actions and decisions.
Key accountabilities and decision ownership:
Privacy
Strategy, Governance & Accountability
Define
and maintain the enterprise privacy strategy, policy suite, standards and
baselines, aligned to Kenya’s DPA 2019 (rights, lawful bases, DPIAs, cross
border rules).
Operate a
privacy governance model (committees, charters, decision rights) with clear
DPO/DPIA ownership and Board/ExCo reporting.
Implement
and continually improve a PIMS under ISO/IEC 27701:2025 (stand alone management
system), integrating with existing ISMS where helpful.
Adopt
ISO/IEC 29100 privacy principles/roles as a common language across squads and
vendors.
Map
policies to GSMA Mobile Privacy Principles to ensure consistent mobile first
customer protections.
Maintain
privacy risk appetite, KRIs, and exception management, with time bound
remediation and independent challenge.
Privacy
by Design & Ethical Data Use
Bake
privacy by design checkpoints into lifecycle gates (ideation → design → build →
release), with DPIAs/PIAs for high risk processing.
Apply
ISO/IEC 27701 guidance to define controller/processor responsibilities, data
minimisation, purpose limitation, and accountability evidence.
Use
ISO/IEC 29100 principles to evaluate fairness, transparency, individual
participation, and accountability in AI/ML use cases.
Adopt
GSMA Mobile Privacy Design patterns for consent UX, notice, and in app privacy
controls on mobile channels.
Publish
ethical data use guardrails (e.g., no dark patterns, PETs where feasible,
children’s data safeguards) and review them quarterly.
Implement
model cards and data ethics reviews for high impact algorithms affecting
eligibility, pricing, or customer outcomes.
Responsible
AI Governance
Define
and implement AI governance frameworks covering ethics, privacy,
explainability, and accountability
Establish
enterprise-wide policies and standards for responsible AI development and
deployment
Ensure
compliance with data protection laws (e.g., DPA 2019) and emerging global AI
regulations
Oversee
AI use cases across the business to ensure alignment with privacy, fairness,
and ethical standards
Embed
privacy-by-design and responsible AI principles into AI/ML lifecycle (design,
development, deployment)
Conduct
AI risk assessments including bias, misuse, model transparency, and data
protection risks
Partner
with Technology, Data, and AI teams to embed governance into MLOps and AI
Factory processes
Provide
oversight and reporting to leadership on AI-related risks, controls, and
regulatory exposure
Data
Subject Rights, Consent & Lifecycle Management
Standardise
lawful basis and consent frameworks (opt in/opt out logic, proof of consent,
preference centres) across web, app, USSD, and agent channels per DPA 2019 and
General Regulations.
Industrialise
DSARs (access, rectification, erasure, portability, objection) with SLA metrics
and audit trails.
Implement
retention & deletion schedules with defensible holds for
disputes/regulatory obligations; monitor deletion job success.
Deploy
data discovery, classification, and lineage for personal/sensitive data across
on prem/cloud, billing, M PESA, and analytics stacks.
Govern
children’s data and vulnerable segments (age gating, enhanced notices, limited
profiling) as per ODPC expectations.
Maintain
cross border transfer inventories (mechanisms, third country risk) and
contractual safeguards.
Privacy
Risk Intelligence, Monitoring & Breach Response
Run a
privacy risk register with heatmaps/KRIs; integrate with ERM and Security risk
processes.
Monitor
high risk processing activities (special categories, large scale profiling,
location data) and trigger DPIAs where thresholds are met.
Establish
privacy incident & breach playbooks (evidence capture, containment, harm
assessment, customer comms) aligned to Section 43 breach notification
obligations and ODPC’s portal.
Track
time to detect, time to notify (ODPC/subjects) and post incident lessons;
maintain full audit trails.
Define
privacy metrics for logging/telemetry completeness supporting investigations
and regulatory disclosure.
Coordinate
joint response with Security/AML/Fraud where incidents intersect (e.g.,
identity theft), ensuring least necessary data is shared.
Ecosystem
& Third Party Privacy Assurance (Agents, Merchants, Partners, Cloud)
Implement
privacy due diligence and risk tiering for vendors, agents, merchants, fintech
partners, and cross border processors.
Mandate
controller/processor clauses (purpose, security, sub processing limits, breach
notice, audit rights, return/delete at exit).
Run
periodic assurance (sampling, walkthroughs, evidence reviews) for high risk
processors, record corrective actions and SLAs.
Validate
mobile app SDKs/APIs for data minimisation and transparency per GSMA mobile
privacy guidance.
Maintain
an ecosystem processing inventory (what data, where, why, for how long, cross
border) with ISO 27701 role mappings (controller vs. processor).
Run
exit/transition controls to ensure secure return/erasure and revocation of
access.
Sensitive,
Financial & M PESA Data Safeguards
Classify
sensitive/financial PII and enforce stricter access, masking/pseudonymisation,
and logging; align to DPA’s sensitive data notions.
Enforce
purpose limitation and guardrails for analytics on financial
movement/behavioural data.
Assure
consent/notice for features like location, contact lists, device identifiers on
mobile; follow GSMA principles.
Coordinate
with AML/Fraud/Security to balance detection versus privacy (data minimisation,
PETs, role based access).
Apply
data subject rights (portability/erasure constraints) with clear exceptions
where lawful (e.g., AML retention).
Verify
downstream disclosures (e.g., to banks, PSPs) have lawful basis and
proportionality.
Compliance
Reporting, Audit Readiness & Regulatory Engagement
Produce
Board/ExCo privacy dashboards (DPIA volumes, DSAR SLAs, breaches, ecosystem
risks, training coverage).
Maintain
regulatory readiness for ODPC (audits, inquiries, responses), and coordinate
with CBK/CAK where scopes intersect (financial/telecom data).
Align
with Internal Audit on annual privacy assurance; close findings within SLA;
prevent repeats.
Operate
quality assurance over notices, consents, DSAR outputs, breach files, and cross
border documentation.
Keep
policy/standards current with legislative updates and OECD privacy guidance
(principles, risk based accountability, breach notification concepts).
Document
regulator communications and commitments; track to closure.
Privacy
Advocacy & Ecosystem Engagement
Lead
engagement with regulators (ODPC, CBK) on data protection, privacy, and
AI-related topics
Represent
Safaricom in industry forums and working groups on privacy and digital trust
Build
strong relationships with internal stakeholders across Technology, Commercial,
Legal, and Risk
Drive
enterprise-wide awareness and culture on privacy, data ethics, and responsible
data use
Influence
policy development and regulatory direction on emerging privacy and AI issues
Provide
strategic advisory to leadership on stakeholder expectations and regulatory
positioning
Develop
thought leadership on privacy, digital trust, and responsible innovation
Position
Safaricom as a trusted, privacy-conscious digital ecosystem player
Privacy
Culture, Capability & Technology Transformation
Define a
capability framework; hire and develop talent (privacy engineers, DPIA
specialists, consent UX, data governance, incident response).
Roll out
role based training for product, data, engineering, marketing, care, and
ecosystem partners, measure completion and effectiveness.
Deploy
privacy tech (consent & preference platforms, discovery/classification,
data lineage, deletion/orchestration, PETs, redaction tools).
Establish
RACI & playbooks for DPIAs, DSARs, breaches, cross border transfers;
rehearse with simulations.
Drive
continuous improvement sprints (consent UX, DSAR cycle time, deletion
automation, false positive reduction in breach triage).
Participate
in GSMA/OECD privacy communities; bring back best practices and benchmark
insights.
Stakeholder
Management
Serve as
the primary liaison between the Chief Corporate Risk Officer and all Privacy
relevant internal and external stakeholders, ensuring timely, transparent, and
insight driven communication on data protection risks, emerging privacy issues,
regulatory obligations, customer rights trends, data ethics concerns, and
developments impacting Safaricom’s Telco–FinTech platforms.
Build and
sustain trusted relationships with Privacy and Data Protection regulators,
including the Office of the Data Protection Commissioner (ODPC), CAK, CBK (for
financial data scopes), regional privacy authorities, global privacy networks,
industry taskforces, and standard setting organisations (ISO/IEC 27701, ISO/IEC
29100, GSMA Mobile Privacy) — positioning Safaricom as a responsible,
transparent, and privacy mature digital enterprise.
Engage
proactively with global and regional privacy forums, digital trust alliances,
mobile privacy working groups, cross border data flow policy networks, and
cloud privacy governance bodies to benchmark maturity, anticipate regulatory
shifts, understand emerging privacy risks (AI/ML, IoT, digital ID), and embed
international best practice into Safaricom’s privacy management system.
Collaborate
cross functionally with M PESA/Financial Services, Technology, Digital,
Enterprise, Consumer, Networks, Data Engineering, Legal, Risk, Compliance,
Procurement, Supply Chain, Finance, Strategy, Corporate Affairs, HR, and
Internal Audit to embed privacy by design, responsible data practices,
transparency, and lawful processing into systems, products, data flows,
algorithms, and customer journeys.
Leverage
insights from DPIAs, privacy risk assessments, data flow mapping, consent
analytics, DSAR patterns, breach investigations, partner privacy assessments,
and behavioural data use indicators to refine privacy strategy, strengthen
internal controls, elevate design choices, influence senior leadership
decisions, and protect Safaricom’s digital trust and reputation.
Represent
Safaricom in national, regional, and global privacy, digital rights, and data
protection platforms, including privacy summits, regulator roundtables, mobile
industry privacy forums, cloud privacy conferences, and digital ethics panels —
advocating for user trust, fairness, accountability, and ethical
innovation.
Act as a
strategic advisor to internal and external assurance partners, ensuring that
privacy insights, systemic risks, DPIA outcomes, data ethics considerations,
and control recommendations are contextualised to Safaricom’s data
architecture, digital platforms, regulatory expectations, and long term
business strategy.
Leadership
and Talent Development
Provide
strategic and inspiring leadership to the Privacy department ensuring delivery
of high quality privacy assurance, DPIA oversight, rights enablement
excellence, responsible data use guidance, and effective privacy governance
across Safaricom entities and partner ecosystems.
Design
and evolve the enterprise Privacy Operating Model and governance structures,
ensuring balanced expertise across privacy engineering, DPIAs, consent
governance, data minimisation, privacy risk analytics, data protection incident
response, third party privacy assurance, ethical AI/ML governance, and
regulatory engagement.
Build
deep specialist capability in privacy impact assessments, data protection law
(DPA 2019), global privacy standards (ISO/IEC 27701, ISO/IEC 29100), GSMA
mobile privacy principles, data governance, privacy engineering (PETs,
pseudonymisation, data masking), breach response management, and responsible
data use design — through targeted hiring, certifications, coaching, labs, and
continuous learning.
Develop a
Privacy Excellence Framework, including privacy playbooks, consent standards,
notice templates, rights request handling guides, DPIA/PIA methodologies,
breach response workflows, partner privacy due diligence blueprints, and
privacy KPIs/KRIs — ensuring consistency, accountability, and operational
excellence.
Embed
OKRs and a performance driven culture across the Privacy function, aligning
incentives to reduced privacy incidents, improved DSAR turnaround, stronger
consent governance, lower data minimisation gaps, better DPIA outcomes, and
measurable uplift in privacy maturity.
Champion
ethical leadership, transparency, confidentiality, independence, and sound
regulatory judgement, ensuring privacy advisory and investigations uphold
Safaricom’s values, legal obligations, individual rights, and global privacy
principles.
Drive
cross functional collaboration across all Three Lines of Defence, ensuring
Privacy works seamlessly with 1st line (business units, product teams, data
teams), 2nd line (Risk, Compliance, DPO), and 3rd line (Internal Audit) to
manage privacy risks, resolve findings, and ensure regulatory readiness for
major digital platform and data innovation initiatives.
Lead
change management for major privacy, regulatory, or technology shifts, ensuring
enterprise readiness through updated policies, privacy notices, DPIAs,
training, change enablement materials, simulations, and targeted briefings for
leadership, developers, analysts, and ecosystem partners.
Foster a
culture of continuous privacy improvement and innovation, championing the
adoption of privacy enhancing technologies (PETs), automated DSAR workflows,
data discovery and classification tools, consent management platforms, breach
response automation, and data ethics practices, strengthening digital trust and
institutional resilience.
Group
Subsidiary Oversight, Enablement & Governance
Define
and maintain minimum Group risk standards and governance frameworks applicable
across subsidiaries.
Provide
advisory support and capability uplift to subsidiary teams to embed
risk-by-design within local operations and commercial initiatives.
Aggregate
and analyze subsidiary risk exposures, trends, and emerging themes for
Group-level visibility and Board reporting.
Monitor
adherence to Group policies and escalate material deviations or systemic risks
appropriately.
Support
subsidiaries in regulatory engagement and assurance activities to ensure
consistent application of Group risk expectations.
Balance
governance with commercial enablement by partnering with local leadership to
manage risks in a manner that supports sustainable growth and market
competitiveness.
Core competencies, knowledge and
experience:
Customer
Obsession
Deepen
team connection to our customers and communities.
Foster
authentic relationships with customers and partners that build trust.
Explicitly
take customer-centric decisions and take personal ownership to achieve results.
Simplify
processes through digitalization and promote a digital mindset and digital
first customer experience.
Stay
focused on the big priorities, know when to make meaningful trade-offs and
demonstrate brilliant execution.
Purpose
Create an
inspiring vision for your team to drive strategy and performance.
Show
ambition and courage, empowering others to go beyond the plan.
Bold and
challenge teams to reimagine how things are done.
Prompt
new thinking and ideas by asking “what if” questions.
Use
knowledge of the external environment (customers, partners, competition,
external bodies) to identify and act on opportunities for growth at pace.
Innovation
Create
psychological safety so everyone can have an impact.
Fuel
innovative ideas from others and test them to enable growth.
Explore
successes and failures with curiosity and resilience; fearlessly recognizing
lessons learned.
Share
your ongoing learning and personal purpose with others.
Learn
fast from digital adoption, using learnings to drive simplicity, scale and
efficiency.
Collaboration
Articulate
your team’s role in making our strategy happen, prioritizing and aligning
resources with current and future needs.
Actively
collaborate to break silos and hold your team accountable to do the same.
Develop
others to make the most of their talents and coach them to take ownership to
get things done.
Create an
inclusive environment ensuring the safety and wellbeing of others.
Live our
Purpose and demonstrate the highest Standard of integrity.
Qualifications
Bachelor’s
degree in Law, Information Technology, Data Science, Cybersecurity, Risk,
Business, or related field
Postgraduate
qualification (LLM, MSc Data Protection, MBA, Cybersecurity, Digital
Governance, or Risk Management) strongly preferred
At least
one advanced privacy credential:
o CIPP/E, CIPP/US, or CIPP/A (Certified Information
Privacy Professional)
o CIPM (Certified Information Privacy Manager)
o CIPT (Certified Information Privacy Technologist)
o CDPSE (Certified Data Privacy Solutions Engineer)
o ISO 27701 / ISO 27001 Lead Implementer or Lead Auditor
o CISM / CISSP (advantageous in tech-heavy environments)
Deep
expertise in:
o Kenya Data Protection Act (DPA 2019)
o ODPC regulatory framework
o GDPR-equivalent global privacy standards
o Cross-border data transfer compliance
o Privacy by Design & Default frameworks
o Data governance & lifecycle management
o Consent management & preference governance
o Data minimization & purpose limitation controls
o Privacy Impact Assessments (PIAs/DPIAs)
o Third-party privacy risk management
o Data subject rights (DSARs) operationalization
o Breach management & regulatory notification
processes
Strong
understanding of:
o AI & analytics governance (Responsible AI, data
ethics)
o API ecosystems & embedded finance risks
o Cloud data architecture & digital platforms
o Customer analytics & marketing data risk
o Telco data, mobile money data, and digital identity
risks
12–15+
years in Privacy, Data Protection, Information Governance, or Digital Risk
Minimum
5+ years in senior leadership role
Experience
within telecommunications, fintech, banking, digital platforms, or tech-driven
environments
Experience
engaging directly with regulators (ODPC exposure strongly preferred)
Proven
experience leading privacy transformation or enterprise privacy uplift programs
Experience
embedding privacy in product lifecycle environments
Proven
expertise leading enterprise wide Privacy and Data Protection programmes or
Centres of Excellence, including oversight of privacy governance frameworks,
Privacy Impact Assessments (PIAs/DPIAs), consent management, data lifecycle
controls, cross border data governance, breach management, and privacy risk
analytics, aligned to global standards such as ISO/IEC 27701 (PIMS) and ISO/IEC
29100 (privacy principles).
Proven
ability to advise CEO, CRO, ExCo, and Board Committees, translating complex
privacy, data ethics, and regulatory risks into clear business implications,
strategic opportunities, and corrective action recommendations aligned to
corporate risk appetite and market expectations.
Demonstrated
experience engaging with regulators (ODPC, CBK for financial data governance,
CAK for telecom/consumer protections), industry bodies, external auditors, and
global privacy networks (ISO, GSMA, OECD) on data protection, digital rights,
and responsible data use matters.
Member in
good standing of a recognized professional body is required.
High
ethical standards, integrity, confidentiality, and independence, essential for
stewarding enterprise privacy, defending customer rights, and making objective,
principle based decisions free from commercial pressure.
Exceptional
influencing, communication, and relationship building skills, able to simplify
complex privacy, regulatory, and technical concepts into clear, business
aligned language for senior stakeholders.
Strong
strategic systems thinker, capable of connecting privacy risks to customer
trust, market reputation, regulatory expectations, operational resilience,
digital innovation safety, and long term enterprise sustainability.
Demonstrated
resilience, courage, and sound judgement under pressure, critical during
regulatory reviews, high profile data breach events, complex DPIAs, rights
handling escalations, and public trust impacting scenarios.
Commitment
to capability building, privacy culture uplift, and continuous improvement,
fostering a high performance, future ready, and digitally responsible
organisation.
