Senior Data Privacy Consultant

About the role

Acuative is seeking a Senior Data Privacy Consultant to join the Personal Data Protection (PDP) function of a leading research university in Saudi Arabia. The consultant will work hands‑on with the Data Protection Officer (DPO) team, managing day‑to‑day privacy operations and enhancing compliance with the Saudi Personal Data Protection Law (PDPL) and SDAIA regulations.

Key responsibilities

• Identify and build Records of Processing Activities (RoPAs) through stakeholder workshops and obtain sign‑off from business unit heads and the DPO.
• Develop and apply a gating methodology for Data Protection Impact Assessments (DPIAs), conduct DPIAs on high‑risk activities, and record risks in the GRC platform.
• Manage third‑party privacy risk by tiering data processors, assessing high‑risk processors, and updating Data Processing Agreements (DPAs) with appropriate contractual clauses.
• Support the DPO in end‑to‑end data breach management, including containment, root‑cause analysis, and regulatory notifications.
• Run a Privacy Hub‑and‑Spoke model: appoint and train Privacy Champions, provide SME support, and ensure knowledge transfer.
• Handle Data Subject Rights (DSR) requests from intake to closure, identifying and fixing workflow bottlenecks.
• Conduct data minimization reviews, update privacy notices, and advise on retention policies.

Required profile

• Proven experience in operational data privacy roles, preferably within higher‑education or research environments.
• Strong understanding of PDPL, SDAIA regulations, and international data‑protection frameworks.
• Excellent stakeholder management and workshop‑facilitation skills.
• Ability to work independently and coach internal privacy champions.

Required skills