Regulatory Affairs & Data Protection Officer

About the role

The Regulatory Affairs & Data Protection Officer is responsible for coordinating Hayy Jameel’s regulatory affairs and compliance framework across government relations, statutory licensing and data protection. The role acts as a central point of coordination with government and regulatory authorities, maintains organisational licences, permits and statutory records, monitors regulatory obligations, and supports compliance with the Saudi Personal Data Protection Law (PDPL) and its Implementing Regulations.

The role is designed with two distinct pillars – Government Relations & Regulatory Affairs and Data Protection & Privacy Compliance – with the data protection responsibilities operating with the appropriate independence, functional escalation and access to Art Jameel KSA Senior Leadership. The final DPO governance, functional reporting and escalation arrangements will be validated with the current Art Jameel / KSA DPO Lead before appointment.

Key Responsibilities

1. Government Relations & Regulatory Affairs

• Serve as the primary liaison with relevant government authorities, ministries and regulatory bodies.
• Build and maintain effective working relationships with public authorities and coordinate official correspondence, submissions and meetings.
• Coordinate with Art Jameel departments and relevant ALJ Entities and  functions to facilitate government-related processes, statutory approvals and regulatory compliance.
• Advise internal teams on government processes, regulatory requirements and approval pathways to support operational planning.
• Manage statutory licences, permits, registrations and approvals required for Hayy Jameel’s operations, public programmes, events, exhibitions, screenings, performances, festivals, workshops and commercial activities.
• Manage and coordinate Commercial Registration (CR), National Address, authorised signatories, Chamber of Commerce and other corporate regulatory records where applicable.
• Coordinate GEA, municipal and operational licences, including Civil Defence, Municipality, Food & Beverage and other relevant approvals.
• Coordinate government approvals relating to temporary structures, filming, signage, import/export and other operational activities where required.
• Manage organisational government portal accounts and electronic services relevant to the role. Employee/HR government processes, including operational ownership of Qiwa, remain with HR.
• Coordinate government inspections, track findings and corrective actions, and escalate material regulatory risks to the Head of Operations.

2. Data Protection & Privacy Compliance

• Monitor Hayy Jameel’s compliance with the Saudi PDPL, its Implementing Regulations and applicable data protection requirements.
• Act as the internal point of coordination for data protection matters and, subject to the agreed governance structure, liaise with SDAIA and the KSA DPO as required.
• Monitor regulatory guidance and changes relating to personal data protection and communicate relevant requirements to departments.
• Coordinate and oversee Data Privacy Impact Assessment (DPIA) processes and maintain appropriate assessment records and recommendations.
• Maintain and update the Record of Processing Activities (RoPA) for Hayy Jameel and support departments in keeping processing information accurate.
• Monitor that consent management and Data Processing Agreements are in place where required.
• Support appropriate safeguards for personal and sensitive data in coordination with Legal, IT and relevant data-owning departments.
• Coordinate data subject rights requests and complaints in accordance with the PDPL and agreed internal procedures.
• Support personal data breach response procedures, including escalation, documentation and regulatory notification where required under the agreed DPO governance framework.
• Provide independent advice and recommendations on personal data protection matters and escalate material privacy risks through the designated DPO reporting line.

3. Compliance Governance, Monitoring & Reporting

• Maintain a master regulatory and statutory compliance calendar covering licences, permits, inspections, certifications, privacy obligations and renewal deadlines.
• Maintain appropriate compliance registers and a central repository of regulatory documentation, ensuring records are accurate, current and audit ready.
• Monitor regulatory changes across the role’s remit and advise management on operational impacts, risks and required actions.
• Conduct periodic compliance reviews, identify potential regulatory risks and coordinate corrective actions with responsible departments.
• Prepare periodic compliance reporting covering licensing status, outstanding approvals, inspection findings, data protection obligations, risks and corrective actions.
• Support mobilisation of new programmes, operational initiatives, commercial activities and partnerships by identifying regulatory and compliance requirements at planning stage.

4. Data Protection Awareness & Organisational Support

• Coordinate data protection awareness, training and knowledge transfer across Art Jameel.
• Work with the current Art Jameel / KSA DPO Lead and designated internal subject-matter experts to build and maintain data protection capability.
• Partner with Audience and other data-owning teams while maintaining the independence required for compliance oversight.
• Support the development and review of internal policies, procedures and guidance relating to regulatory and data protection compliance.

5. Role Boundaries, DPO Governance & Independence.

• Operational departments remain accountable for the lawful and appropriate processing of personal data within their activities; this role provides independent oversight, advice, monitoring and coordination. 
• The Officer must not be assigned responsibilities that create a conflict with the independent monitoring of data protection compliance. 
• Independence: In carrying out DPO responsibilities, the Officer shall maintain the independence required to provide objective advice and oversight on PDPL and data protection matters. 
• Escalation: Material data protection risks and non-compliance may be escalated directly to Art Jameel KSA Senior Leadership/DD and the current Art Jameel/KSA DPO Lead. 
• Access: The Officer shall have appropriate access to relevant systems, information and internal stakeholders necessary to fulfil the DPO responsibilities. 
• The role does not own HR employee-processing activities or HR government platforms; these remain with the HR team. 
• The final DPO functional reporting, escalation and regulatory liaison arrangements will be validated with the current Art Jameel/KSA DPO Lead before appointment.

Job Requirements

Education & Experience

• Bachelor’s degree in Law, Business Administration, Public Administration, Data Governance, Compliance, Information Security or a related discipline.
• Typically 3-5+ years’ relevant experience across Government Relations, Regulatory Compliance, Data Protection, Legal, Corporate Affairs or a related field.
• Strong experience in at least one of the two core areas: (a) Saudi Government Relations / regulatory affairs, or (b) data protection / privacy / compliance, with demonstrable ability to develop capability in the other.
• Experience working with Saudi government authorities and regulatory frameworks is strongly preferred.
• Knowledge of the Saudi PDPL and its Implementing Regulations is required or must be developed to the standard required for the role.
• Data protection certification (e.g., CIPP/E, CIPM, CDPO or equivalent) is advantageous.

Skills & Competencies

• Strong understanding of regulatory compliance, governance and risk management.
• Excellent stakeholder management and relationship-building skills.
• Strong analytical judgement, problem-solving and attention to detail.
• Ability to maintain confidentiality, exercise integrity and provide independent compliance advice.
• Ability to manage multiple statutory deadlines and coordinate across departments.
• Excellent written and verbal communication skills in Arabic and English.
• Ability to work independently and escalate material compliance risks appropriately.

Technical & System Proficiency

• Experience with Saudi government electronic platforms relevant to organisational licensing and regulatory affairs.
• Experience maintaining compliance registers, regulatory records and digital document management systems.
• Working knowledge of privacy governance tools and records, including RoPA, DPIAs, consent management and data protection documentation.
• High proficiency in Microsoft Office Suite and Google Workspace.

Conditions of Work & Benefits

• This is a full-time, permanent position based at Hayy Jameel in Jeddah, KSA. 
• Comprehensive full health and dental insurance package. 
• 25 days of annual leave. 
• 2 designated Training days per year for professional development. 
• 3 dedicated ‘Revive’ wellness days across the year.