Executive Head of Privacy

Reporting to the Group Chief Risk Officer, the Executive Head of Privacy is accountable for shaping, governing, and advancing Safaricom’s enterprise wide Privacy, Data Protection, and Responsible Data Use strategy, frameworks, controls, and capabilities. The role provides strategic leadership in anticipating, identifying, and mitigating privacy risks, ensuring lawful and ethical data handling, safeguarding customer information, and embedding trust by design across Safaricom’s converged Telco–FinTech ecosystem, including M PESA, digital services, platforms, applications, networks, customer analytics, APIs, and partner ecosystems.

The role leads Safaricom’s Customer Privacy and Data Protection agenda across data governance, data minimisation, privacy by design, consent management, customer rights enablement, data lifecycle management, cross border data transfers, breach management, regulatory engagement, data ethics, and privacy assurance reviews. It ensures deployment of a unified Privacy Management System anchored in global standards and frameworks such as the Kenya Data Protection Act (DPA 2019), GDPR equivalent practices, ISO/IEC 27701, OECD Privacy Guidelines, GSMA Mobile Privacy Principles, and global digital trust benchmarks.

The Executive Head of Privacy partners extensively with M PESA/Financial Services, Technology, Digital, Enterprise, Consumer, Data Engineering, Networks, Legal, Risk, Compliance, Procurement, Supply Chain, Corporate Affairs, HR, Internal Audit, and external regulators (ODPC, CBK, CAK) to embed privacy resilience, strengthen data handling controls by design, and ensure robust privacy assurance across Safaricom’s rapidly evolving digital environment.

The role champions customer trust, ethical data stewardship, transparency, and responsible innovation, enabling a culture where engineers, product teams, analysts, data scientists, marketers, and ecosystem partners design and operate privacy compliant products, respect customer choices, and proactively identify and mitigate privacy risks. Through advanced privacy risk analytics, data flow mapping, consent and preference governance, third party privacy due diligence, privacy impact assessments (PIAs/DPIAs), and continuous assurance, the Executive Head of Privacy ensures Safaricom operates as one of Africa’s most trusted, privacy conscious, and ethically grounded digital enterprises.

The Executive Head of Privacy is strategically accountable for:

• Privacy Strategy & Governance: Defining and governing Safaricom’s enterprise wide Privacy, Data Protection, and Data Governance strategy, policies, standards, and operating frameworks, ensuring alignment with DPA 2019, global privacy principles, and evolving regulatory expectations in digital, financial, and telecom sectors.
• Data Protection Risk Intelligence, Monitoring & Response: Driving privacy risk assessments, data flow visibility, metadata governance, monitoring of high risk processing activities, incident detection, breach response, and regulatory notifications to prevent, detect, and mitigate privacy and data misuse risks across Safaricom’s digital ecosystem.
• Privacy-by-Design, Secure Data Use & Ethical Engineering: Embedding privacy by design into technology, product development, analytics, AI/ML models, customer interfaces, APIs, and ecosystem integrations through PIAs/DPIAs, data minimisation, pseudonymisation, access governance, purpose limitation, and ethical design frameworks.
• Responsible AI Governance: Define and enforce enterprise-wide AI governance frameworks to ensure safe, ethical, and compliant use of AI across Safaricom’s digital and data ecosystem.
• Data Minimisation, Consent, Rights Management & Lifecycle Controls: Strengthening customer consent governance, transparency mechanisms, rights management (access, erasure, portability, objection), data retention and deletion controls, and lawful bases for processing, ensuring compliant, accurate, and accountable use of customer information.
• Sensitive Data & Digital Trust Safeguards: Ensuring protection of sensitive and financial data, including M PESA processing data, behavioural data, identity attributes, and metadata, applying strong privacy controls, confidentiality safeguards, and aligned practices with AML, cybersecurity, and fraud prevention teams.
• Ecosystem Privacy Assurance (M PESA, Digital, Partners, APIs): Strengthening privacy assurance for M PESA services, merchant/agent ecosystems, API partners, fintech integrations, cloud environments, cross border data flows, and digital service providers, ensuring robust contractual privacy obligations, oversight, and compliance testing.
• Privacy Compliance Reporting, Assurance & Regulatory Readiness: Delivering privacy dashboards, KRIs, heatmaps, DPIA outcomes, breach metrics, and Board/ELT reporting; ensuring readiness for ODPC audits, CBK reviews (for financial data), Internal Audit assurance, and alignment with Enterprise Risk & Compliance frameworks.
• Privacy Culture, Capability & Technology Transformation: Building enterprise wide privacy awareness, responsible data use behaviours, leadership engagement, and capability uplift across squads and functions; scaling privacy technology, automation, data classification tools, consent systems, discovery platforms, and AI driven privacy analytics.
• Privacy Advocacy & Ecosystem Engagement: Champion privacy and data ethics through proactive stakeholder engagement, regulatory collaboration, and enterprise-wide awareness.
• Group Subsidiary Oversight, Enablement & Governance: Provide Group-level oversight and strategic enablement to subsidiaries by defining minimum risk standards, frameworks, and reporting requirements while supporting local market execution through advisory partnership, capability uplift, and risk-by-design embedding. Ensure consistent application of Group policies, effective aggregation of risk exposures and emerging themes across markets, and timely escalation of material issues to the CRO and Board. Balance strong governance with commercial enablement by partnering with subsidiary leadership to proactively identify, assess, and mitigate risks in a way that supports sustainable growth and regulatory compliance across the Safaricom Group.
• Risk, Governance & Control Ownership: Embed and maintain effective risk, governance, compliance, and control practices within the function by proactively identifying and mitigating operational, regulatory, financial, people, technology, and reputational risks. Ensure adherence to internal policies, regulatory requirements, audit actions, and enterprise governance frameworks while driving accountability, ethical practices, and a strong controls environment across all areas of responsibility.

Anchored in Safaricom’s purpose of Transforming Lives, the Executive Head of Privacy ensures Safaricom operates with uncompromising data protection standards, customer trust, and responsible innovation. By safeguarding customer information, enabling ethical data use, and reinforcing transparency at every touchpoint, the role strengthens Safaricom’s position as Africa’s most trusted and future ready digital enterprise.

• Bachelor’s degree in Law, Information Technology, Data Science, Cybersecurity, Risk, Business, or related field
• Postgraduate qualification (LLM, MSc Data Protection, MBA, Cybersecurity, Digital Governance, or Risk Management) strongly preferred
• At least one advanced privacy credential:
  o    CIPP/E, CIPP/US, or CIPP/A (Certified Information Privacy Professional)
  o    CIPM (Certified Information Privacy Manager)
  o    CIPT (Certified Information Privacy Technologist)
  o    CDPSE (Certified Data Privacy Solutions Engineer)
  o    ISO 27701 / ISO 27001 Lead Implementer or Lead Auditor
  o    CISM / CISSP (advantageous in tech-heavy environments)
• Deep expertise in:
  o    Kenya Data Protection Act (DPA 2019)
  o    ODPC regulatory framework
  o    GDPR-equivalent global privacy standards
  o    Cross-border data transfer compliance
  o    Privacy by Design & Default frameworks
  o    Data governance & lifecycle management
  o    Consent management & preference governance
  o    Data minimization & purpose limitation controls
  o    Privacy Impact Assessments (PIAs/DPIAs)
  o    Third-party privacy risk management
  o    Data subject rights (DSARs) operationalization
  o    Breach management & regulatory notification processes
• Strong understanding of:
  o    AI & analytics governance (Responsible AI, data ethics)
  o    API ecosystems & embedded finance risks
  o    Cloud data architecture & digital platforms
  o    Customer analytics & marketing data risk
  o    Telco data, mobile money data, and digital identity risks
• 12–15+ years in Privacy, Data Protection, Information Governance, or Digital Risk
• Minimum 5+ years in senior leadership role
• Experience within telecommunications, fintech, banking, digital platforms, or tech-driven environments
• Experience engaging directly with regulators (ODPC exposure strongly preferred)
• Proven experience leading privacy transformation or enterprise privacy uplift programs
• Experience embedding privacy in product lifecycle environments
• Proven expertise leading enterprise wide Privacy and Data Protection programmes or Centres of Excellence, including oversight of privacy governance frameworks, Privacy Impact Assessments (PIAs/DPIAs), consent management, data lifecycle controls, cross border data governance, breach management, and privacy risk analytics, aligned to global standards such as ISO/IEC 27701 (PIMS) and ISO/IEC 29100 (privacy principles).
• Proven ability to advise CEO, CRO, ExCo, and Board Committees, translating complex privacy, data ethics, and regulatory risks into clear business implications, strategic opportunities, and corrective action recommendations aligned to corporate risk appetite and market expectations.
• Demonstrated experience engaging with regulators (ODPC, CBK for financial data governance, CAK for telecom/consumer protections), industry bodies, external auditors, and global privacy networks (ISO, GSMA, OECD) on data protection, digital rights, and responsible data use matters.
• Member in good standing of a recognized professional body is required. 
• High ethical standards, integrity, confidentiality, and independence, essential for stewarding enterprise privacy, defending customer rights, and making objective, principle based decisions free from commercial pressure.
• Exceptional influencing, communication, and relationship building skills, able to simplify complex privacy, regulatory, and technical concepts into clear, business aligned language for senior stakeholders.
• Strong strategic systems thinker, capable of connecting privacy risks to customer trust, market reputation, regulatory expectations, operational resilience, digital innovation safety, and long term enterprise sustainability.
• Demonstrated resilience, courage, and sound judgement under pressure, critical during regulatory reviews, high profile data breach events, complex DPIAs, rights handling escalations, and public trust impacting scenarios.
• Commitment to capability building, privacy culture uplift, and continuous improvement, fostering a high performance, future ready, and digitally responsible organisation.

How to apply

If you feel that you are up to the challenge and possess the necessary qualification and experience, kindly click on the apply button. Remember to attach your resume

Health and Safety

• Uphold the company code of conduct, policies and procedures, ensuring integrity and accountability in every aspect of your work.
• All employees have a responsibility to adhere to safety, health, and wellbeing policies, guidelines and procedures in all actions and decisions. 

Key accountabilities and decision ownership:

Privacy Strategy, Governance & Accountability

• Define and maintain the enterprise privacy strategy, policy suite, standards and baselines, aligned to Kenya’s DPA 2019 (rights, lawful bases, DPIAs, cross border rules).
• Operate a privacy governance model (committees, charters, decision rights) with clear DPO/DPIA ownership and Board/ExCo reporting.
• Implement and continually improve a PIMS under ISO/IEC 27701:2025 (stand alone management system), integrating with existing ISMS where helpful. 
• Adopt ISO/IEC 29100 privacy principles/roles as a common language across squads and vendors. 
• Map policies to GSMA Mobile Privacy Principles to ensure consistent mobile first customer protections. 
• Maintain privacy risk appetite, KRIs, and exception management, with time bound remediation and independent challenge. 

Privacy by Design & Ethical Data Use

• Bake privacy by design checkpoints into lifecycle gates (ideation → design → build → release), with DPIAs/PIAs for high risk processing. 
• Apply ISO/IEC 27701 guidance to define controller/processor responsibilities, data minimisation, purpose limitation, and accountability evidence. 
• Use ISO/IEC 29100 principles to evaluate fairness, transparency, individual participation, and accountability in AI/ML use cases. 
• Adopt GSMA Mobile Privacy Design patterns for consent UX, notice, and in app privacy controls on mobile channels. 
• Publish ethical data use guardrails (e.g., no dark patterns, PETs where feasible, children’s data safeguards) and review them quarterly.
• Implement model cards and data ethics reviews for high impact algorithms affecting eligibility, pricing, or customer outcomes. 

Responsible AI Governance

• Define and implement AI governance frameworks covering ethics, privacy, explainability, and accountability
• Establish enterprise-wide policies and standards for responsible AI development and deployment
• Ensure compliance with data protection laws (