Data Governance and Privacy Manager

Let's Write Africa's Story Together!

Old Mutual is a firm believer in the African opportunity and our diverse talent reflects this.

The Data Governance and Privacy Manager is responsible for establishing, leading, and maintaining independent 2nd line oversight of data governance, data risk, data quality and privacy compliance across OMI.

This role ensures that OMI manages data as a strategic and regulatory compliant asset. The incumbent provides independent challenge to 1st line operational teams (IT, Data Architecture, Engineering, Underwriting, Claims and Operations) while ensuring full alignment with SA regulatory mandates and requirements (e.g. POPIA).

• Develop, maintain and embed the Data Risk Management Framework, policy and standards, aligned to the Old Mutual Group enterprise risk framework.
• Define the data risk taxonomy (data quality, data privacy, data lineage, retention, data access, AI/model data, third-party data).
• Propose data risk appetite statements, key risk indicators (KRIs) and tolerance thresholds for approval by the risk committees.
• Provide independent oversight of the implementation and effectiveness of data governance policies, standards, procedures and control frameworks.
• Ensure that data risks are appropriately integrated into enterprise risk registers, technology risk assessments, operational risk assessments and relevant business risk management processes.
• Maintain a forward-looking view of emerging data risks arising from business strategy, digital transformation, acquisitions, technology changes, outsourcing and new data use cases.

• Conduct independent reviews and risk assessments of material data processes, systems, business initiatives, third-party vendor data sharing agreements and change programmes.
• Review and challenge first-line risk and control self-assessments (RCSAs) for data-related risks across underwriting, claims, finance, actuarial and IT.
• Oversee and challenge Data Protection Impact Assessments (DPIAs) for all new business initiatives products, and technology implementations.
• Evaluate the design and operating effectiveness of data controls, including preventive, detective and corrective controls.
• Identify systemic weaknesses, recurring control failures and risk concentrations across business units, applications, data domains and third parties.
• Review material data incidents, breaches, quality failures and reporting inaccuracies to assess root causes, control weaknesses and the adequacy of management responses.
• Track data risk events, incidents and breaches through root-cause analysis to closure of remediation actions.

• Assess whether appropriate controls exist to ensure data is accurate, complete, consistent, valid, timely, unique and fit for its intended purpose.
• Oversee the risk management practices supporting data lineage, traceability, reconciliation and data transformation across source systems, operational platforms, data warehouses and reporting environments.
• Monitor material data quality issues, recurring exceptions, unresolved defects and the effectiveness of corrective actions.
• Provide oversight of data migration and conversion risks, including reconciliation, completeness validation, record integrity and business sign-off.
• Assess the reliability of critical management information and regulatory submissions where data deficiencies could affect decision-making, financial soundness or regulatory compliance.

• Provide independent oversight of data protection and privacy risks in collaboration with the Information Officer, Privacy, Legal, Compliance and Information Security functions.
• Assess whether appropriate controls are in place to protect personal, sensitive, confidential and commercially critical information throughout its lifecycle.
• Oversee risk management arrangements relating to data classification, access restrictions, encryption, masking, anonymisation, secure transfer, retention and secure disposal.
• Assess risks associated with unauthorised access, disclosure, loss, alteration, misuse or inappropriate sharing of data.
• Challenge weaknesses in data access governance, including excessive privileges, inappropriate access, segregation-of-duties conflicts and inadequate periodic access reviews.
• Assess risks arising from the processing and sharing of policyholder, claimant, beneficiary, employee and other personal information.
• Provide risk oversight of cross-border data transfers, outsourced processing, data sharing arrangements and the use of external service providers.
• Monitor material data privacy and confidentiality incidents, ensuring that root causes, control weaknesses and corrective actions are addressed by accountable First Line owners.
• Support the relevant control functions in assessing compliance with applicable data protection and privacy obligations, including POPIA.

• Establish risk-based criteria for identifying and prioritising critical data assets, datasets, data flows and business processes.
• Evaluate whether critical data assets are adequately protected against loss, corruption, unauthorised modification and unavailability.
• Assess data resilience arrangements, including backup integrity, recoverability, restoration testing and dependency on critical data platforms.
• Assess the risks arising from legacy systems, fragmented data environments, shadow data stores, uncontrolled data extracts and unmanaged copies of sensitive information.

• Provide oversight of data risks associated with outsourced services, cloud platforms, administrators, service providers, business partners and other external parties.
• Assess whether third-party arrangements provide appropriate protection for confidentiality, integrity, availability and lawful processing of organisational data.
• Challenge the adequacy of data-related due diligence, contractual safeguards, audit rights, subcontracting arrangements, incident notification obligations and exit provisions.
• Assess risks associated with external data hosting, offshore processing, concentration of critical data services and dependency on key providers.
• Monitor material third-party data risks and remediation commitments in collaboration with Third-Party Risk Management and Procurement.
• Provide independent challenge on the adequacy of controls governing the return, transfer, retention and secure destruction of data when contracts terminate or services change. 

• Maintain oversight of data-related risk findings, incidents, control deficiencies and agreed management actions.
• Challenge remediation plans for completeness, practicality, accountable ownership, milestones and sustainable resolution.
• Validate the adequacy of evidence provided by First Line management to demonstrate that agreed actions have been completed.
• Monitor overdue actions, repeated findings, management risk acceptance and residual exposure.
• Escalate ineffective remediation, recurring failures and unresolved material risks to the appropriate governance forums.
• Collaborate with Internal Audit, Compliance and other assurance providers to support coordinated assurance and reduce duplication of effort.

• Bachelor’s degree in information systems, Data Management, Computer Science, Risk Management, Information Security, Statistics, Business or a related discipline.
• A relevant postgraduate qualification in Risk Management, Information Systems, Data Governance or a related field would be advantageous.

• Risk and governance: CISA, CRISC, CGEIT, COBIT 2019 would be advantageous.
• Data Management: Certified Data Management Professional (CDMP), CIPP/E or CIPM

• At least 6–8 years of relevant experience in data risk, IT risk, information governance, data governance, information security, technology risk or a related discipline.
• Strong understanding of data management principles, data quality, metadata, lineage, ownership and lifecycle controls.
• Experience assessing privacy, information security, data access, data integrity and data availability risks.
• Exposure to AI governance, model risk or automated decision-making risk would be advantageous.

• Execution
• Collaboration (Relating)
• Innovation (Perspective)
• Leading with Influence
• Personal Mastery (Learning)
• Strategic

• TA Interview: This will be a discussion with our Senior Talent Acquisition Specialist to give you an understanding of our business, our culture & values and more context on the role. It will also allow us the opportunity to get to know you more and ensure OMI can meet your career aspirations.
• Panel Interview: This will be with 2 members of the Senior Leadership of the Hiring Team and 1 member of the HC Senior Team.
• Technical & Psychometric Assessments: These will depend on the role and will sometimes happen concurrently with Vetting through an external service provider, as well as Internal Verification.
• Final Feedback.

https://www.oldmutual.co.za/about/old-mutual-insure/ 

Please note that, unfortunately, we cannot accept any applications after the closing date

The appointment will be made from the designated group in line with the Employment Equity Plan of Old Mutual South Africa and the specific business unit in question.

The Old Mutual Story!