Data Protection Officer

Job Profile

Local Data Protection Officer (M/F/d)

**Department**:
Risk

**Reports To**:
Head of Data Protection - GDPO

**Location**:
Germany or Austria

**Direct Reports**:
None

**Contract Type**:
Permanent

Job Role

The Data Protection Function is an element of the operational Risk Framework within the global Risk department in OVF.

The local DPO is in charge of driving the further development, management and maintenance of the organizational-wide Data Protection framework in Germany and/or Austria; executing and implementing appropriate controls and mitigating DP risks for the organization; promoting a strong culture of data protection compliance across the local territory.

He/She could support the Group Privacy Officer by providing guidance and approval for emerging business initiatives, guidance with DP related policies for the business; and overall Data Protection related matters.

Company Vision, Priorities and Values

Opel Vauxhall Finance’s vision is to meet the mobility needs of our customers through financial services solutions for the Opel and Vauxhall brands.

Our Strategic Priorities focus on the development of our people, performance delivery, penetration, efficiency, customer loyalty and protection - maintaining strong risk management and compliance practices.

We promote a collaborative culture of people who actively contribute with integrity. We are agile, open minded and adaptive to deliver at pace, with customers at the heart of all we do.

Location

Germany (Potsdam/Russesslheim/other city) or Austria

Reports to

Head of Data Protection - Group Privacy Officer

Direct reports

N/A

Main objectives and responsibilities

**Knowledge & Education**:
Develop and maintain a thorough and complete understanding in which the business operates and the resulting Data Protection risks associated with the business and activities
Stay informed and ahead of new and emerging risks from business and Data Protection related developments and support the assessment of their impact on the organizational-wide Data Protection Program;
Enhance and maintain current knowledge of GDPR and of applicable local Data Protection related laws, rules, regulations, guidance to support the promotion to organizational adaptation and compliance regarding Data Protection
Stay informed of industry and regulatory GDPR related developments, trends and issues

**Further Development & Execution**:
Perform independent, risk-based Data Protection risk assessments; manage the assessment process and support implementation of appropriate action plans to remediate any gaps
Manage matters relating to data breaches
Review and advise on DPIA’s
Manage Data Protection requirements of the Vendor Management process for third parties
Manage oversight and support maintenance of the OVF Record of Processing Activities (ROPA), to understand where and how OVF processes personal data, including assessment of lawfulness, its accounting of the processes, systems, databases and third parties involved with processing personal data.
Participate in projects and efforts, as required. Provide project management support and assist with key strategic projects and regulatory change initiatives as needed
Manage the implementation, enhancement, maintenance and performance of a Data Protection Control Framework
Develop and maintain Data Protection related policies, procedures and training materials
Manage the execution of Data Protection training and awareness activities
Provide a monthly DP reporting as well as a regular Management reporting including participation on relevant committees
Develop and maintain a sound understanding of internal business products and processes

Within a formal appointment as Data Protection Officer (DPO) pursuant Art. 39 General Data Protection Regulation (GDPR):
To inform and advise the controller or processor and the employees who carry out processing of their obligations pursuant to this regulation and to other local data protection provisions
To monitor compliance with this regulation and other local data protection provisions and with the policies of the controller or processor in relation to the protection of personal data, including the assignment of responsibilities, awareness-raising and training of staff involved in processing operations, and the related audits
To provide advice when requested as regards the data protection impact assessment and monitor its performance pursuant to Art. 35
To cooperate with the supervisory authority
To act as the contact point for the supervisory authority on issues relating to processing, including the prior consultation referred to in Art. 36, and to consult, where appropriate, with regard to any other matter

Qualifications &
Experience

Master’s degree in Law (or Economics/IT) or related field required
Sound knowledge of the General Data Protection Regulation (GDPR) and other Data Protection related Laws and Regulations
5 + years of Data Protection related experience as Da