Data Privacy Risk Manager

Role:
The Data Privacy Risk Manager will be responsible for ensuring HSBC meets its obligations under data protection and privacy laws within their particular jurisdiction. He/ She will provide expert advice, guidance and direction and support the necessary standards and controls to enable the Bank, including its employees and relevant third parties, to manage privacy risks and comply with obligations under data protection laws in relation to the processing of personal data.

To establish a culture of privacy within HSBC, the Data Privacy Risk Manager will need to work collaboratively with key senior stakeholders across the business and will be accountable for keeping executives appraised of privacy risks and issues.

The role holder will cover several countries within continental Europe and will assist the DPO in his main duties. The role holder will be responsible for carrying out the following tasks:

- Informing and advising the business and its employees of their data privacy and protection compliance obligations;
- Providing expert guidance, oversight and challenge on all aspects of data protection and privacy risk strategy and compliance focusing efforts on areas that present higher data privacy risks;
- Monitoring compliance with data privacy provisions and with HSBC Group policies relating to the protection of personal data, including the assignment of responsibilities, staff education and awareness training, and ensuring remediation of any related audit findings;
- Reviewing and advising on Data Protection Impact Assessments (DPIAs) and monitoring performance of mitigations, where necessary;
- Deputising for the Data Protection Officer and be the point of liaison with EU regulators in the absence of the HBCE DPO
- Prepare relevant risk reporting to meet both internal and external regulatory requirements
- Advising on, and providing the business with support, to ensure the necessary safeguards and controls are in place to ensure compliance with requirements for international data transfers by identifying all circumstances in which personal data is transferred outside of the relevant jurisdiction;
- Attending HBCE entities forums as an advisor or Member as appropriate; and

Principal Accountabilities: Key activities and decision making areas:
Operational Performance
- Support the implementation of HSBC approved risk appetite into local policies, processes, systems, models and limits.
- Support the design, development and renewal of local data protection and privacy risk policy and minimum standards.
- The role holder will coordinate with the Risk Steward at appropriate times to enable DPO to discharge statutory roles - e.g. supporting on policy setting, reporting.
- Provide advice on privacy requirements to help build privacy by design and privacy by default into processing activities involving personal data.
- Provide advice and guidance on all aspects of data protection and privacy risk including the records required to demonstrate compliance, risk identification, assessment, mitigation, response and reporting.

Typical Targets and Measures:

- Comprehensive procedures and controls are in place to manage Data Privacy and Information Governance within HSBC.
- Data Privacy and Information Governance policies are effectively communicated and adhered to within the jurisdiction.
- Adverse consequences arising due to regulatory issues related to Data Privacy and Information Governance, including changes in law and regulations are properly managed, mitigated and remedial action initiated.
- Key regulatory and policy changes and details of emerging legal and regulatory risks related to Data Privacy and Information Governance are communicated to senior management within HSBC in a timely and concise manner.

Impact on the Business:

- Maintain, support and review procedures to enable customers to exercise their individual rights.
- Under direction of the HBCE DPO, provide SME advice related to Data Privacy and Information Governance, including matters that are complex or have potential for significant legal, financial and / or reputational impact.
- Ensure the company delivers on day-to-day operations through engagement with the Risk Steward such as the fulfilment of DSARs and DPIAs.
- Maintain responsibility, as directed by the HBCE DPO, for the execution of business and operational strategies related to data privacy activities within jurisdiction.
- Provide advice relating to Data Privacy and Information Governance issues involving the relevant jurisdiction, with a particular focus on, and responsibility for, DPO activities including developing strategies to respond to changes in law and regulation.
- Compliance with regulatory requirements.
- Positive customer and stakeholder feedback.
- Effective management and engagement with data process owners and HBCE DPO.
- Timely and proactive guidance and support provided to key stakeholders on the management of personal data.

Customers / Stakeholders:

- Act as