Data Protection Officer (GMG/SEG 2)

Summary

Under the general supervision of the Regional Director, the Data Protection Officer (DPO) is responsible for overseeing the protection and management of all data within the South East Regional Health Authority. The DPO will ensure compliance with data protection laws and regulations, implement data protection policies and procedures, and advise the relevant parties on all data protection matters. Reporting to the Regional Director, the DPO will play a key role in safeguarding the region's data assets.

Responsibilities

• Technical/Professional:

  • • Review and update the region's data protection policies, ensuring alignment with current laws and regulations.
  • • Develop and maintain a data inventory to capture all personal data held by the South East Regional Health Authority.
  • • Carry out privacy impact assessments for all new projects involving the processing of personal data.
  • • Develop and implement procedures for the secure collection, storage, and disposal of personal data.
  • • Conduct regular reviews of data protection policies and practices to identify areas for improvement.
  • • Create and deliver data protection training programs to educate staff on their responsibilities and obligations.
  • • Monitor and assess the effectiveness of data protection controls and make recommendations for enhancements.
  • • Develop and maintain a data breach response plan, including clear procedures for notifying affected individuals and authorities.
  • • Collaborate with IT and other relevant departments to ensure data protection measures are integrated into systems and processes.
  • • Conduct regular audits to ensure compliance with data protection laws and regulations, including data subject rights.
  • • Respond to data subject requests within the required timeframes, including access, rectification, and erasure requests.
  • • Monitor and review data processor agreements to ensure compliance with data protection rules.
  • • Stay updated on emerging data protection trends, legal developments, and best practices.
  • • Provide advice and guidance on cross-border data transfers and cloud-based service providers.
  • • Develop and implement privacy-by-design principles in the region’s data processing activities.
  • • Conduct privacy impact assessments for international data transfers.
  • • Liaise with external legal counsel as needed to address complex data protection matters.
  • • Develop and maintain records of data protection activities, including data processing agreements and data breach incidents.
  • • Collaborate with stakeholders to develop data protection requirements for new IT systems and applications.
  • • Regularly review and update consent forms and privacy notices to ensure compliance with applicable regulations.
  • • Assist in the development and implementation of data retention and deletion policies.
  • • Conduct periodic privacy audits to identify potential gaps and risks in data protection practices.
  • • Assist in developing incident response procedures and conduct post-incident reviews.
  • • Provide data protection-related advice and support to other business units within the region.
  • • Ensure that the region's data protection practices align with industry standards and best practices.

• Management/Administrative:

  • • Participates in the development and implementation of annual operational plans in keeping with the Strategic Business Plan.
  • • Participates in the development of the annual budget and ensures that expenditure is kept within budget.
  • • Reviews and recommends amendments to policies and strategies based on the impact of implementation and ensures their alignment with the region’s strategic objectives and best practices.
  • • Implements appropriate communication mechanisms for the dissemination of policy to all relevant stakeholders.
  • • Ensures that the work of the unit is documented
  • • Develops individual Work Plan.
  • • Prepares and submits activity reports as required.

• Human Resources:

  • • Maintains a system that fosters a culture of teamwork, employee empowerment and commitment to the region’s goals.
  • • Fosters an atmosphere of trust and high ethical and confidential standards.

• Other:

  • • Performs all other related duties and functions as may be required from time to time.

Required Skills

• Core:

  • • Knowledge of data protection laws, regulations, and best practices.
  • • Excellent verbal and written communication skills, with the ability to effectively communicate complex information to stakeholders at all levels.
  • • Strong analytical and problem-solving skills to identify and address data protection risks and gaps.
  • • Ability to work independently and collaboratively as part of cross-functional teams.
  • • Strong organizational and time management skills to manage multiple projects and priorities simultaneously.
  • • Attention to detail and a high level of accuracy in evaluating and interpreting data protection requirements.
  • • Strong ethical standards and ability to handle sensitive and confidential information with discretion.
  • • Proactive and adaptable approach to keep up with evolving data protection landscape.
  • • Ability to build and maintain positive relationships with stakeholders, both internal and external.
  • • Continuous learning mindset to stay updated with changing data protection practices and technologies.
  • • Strong customer service orientation, with the ability to act as a trusted advisor to employees and management.
  • • Problem-solving skills with the ability to provide strategic advice and guidance on complex data protection issues.

• Technical:

  • • Knowledge of data protection frameworks.
  • • Familiarity with information security principles and practices.
  • • Understanding of data privacy impact assessments and their application.
  • • Experience in developing and implementing data protection policies and procedures.
  • • Knowledge of technology-related aspects of data protection, such as data encryption and anonymization.
  • • Understanding of incident response and data breach management protocols.
  • • Proficiency in data management systems and tools.
  • • Familiarity with data protection training and awareness programs.
  • • Experience in conducting data protection audits and assessments.
  • • Understanding of the legal and regulatory environment about data protection in the Health Sector.
  • • Knowledge of data governance principles and practices.
  • • Proficiency in data protection risk assessment and management techniques.

Qualifications

• • Bachelor's degree in business administration, law, IT, or cybersecurity or a related field.
• • Three (3) years of relevant work experience in data protection or a similar role.

Additional Information and Instructions

• Special Conditions Associated with the Job:

  • • Work will be conducted in an office outfitted with standard office equipment and specialized software.
  • • Duties may also be performed in environments that contain dust, noise, and other hazards.
  • • The environment is fast-paced with ongoing interactions with critical stakeholders.
  • • The role involves meeting tight deadlines, which may result in high levels of pressure at times.
  • • May be required to travel locally and internationally to attend conferences, seminars, and meetings.

Applications with curricula vitae are to be submitted to: South East Regional Health Authority The Director Human Resource Management & Industrial Relations South East Regional Health Authority The Towers, 2nd Floor 25 Dominica Drive Kingston 5​ All applications should be submitted via email to employment@serha.gov.jm or recruitmentserha2023@gmail.com. The deadline for submission is Wednesday, July 2, 2025 ​​​🔑 Please include the job title in the subject line of your email. We thank all applicants for their interest. However, only those shortlisted will be contacted.

Share This Job