Data Protection Officer

**DATA PROTECTION OFFICER (BASED IN ANY OCBA HUB)**:

ES
Full Time
General Direction

**GENERAL CONTEXT**

Médecins Sans Frontières/Doctors Without Borders (MSF) is a medical humanitarian organization that provides medical assistance to people affected by conflict, epidemics, disasters, or exclusion from healthcare.

**CONTEXT AND OBJECTIVES**

MSF OCBA collects and processes personal information from our patients, our staff, our donors and other partners and collaborators. All individuals have a right to privacy, and to know that their data is handled and stored safely, confidentially and without risk of this data being abused. MSF OCBA has the ethical and legal obligation to assure data protection and privacy, particularly for those most vulnerable to for instance persecution, stigmatization, or targeted violence.

The DPO position will
- Advise and inform the organization about all questions, issues and matters related to the protection of personal data within the framework of the General Data Protection Regulation (GDPR), LOPDGDD and other emerging data protection laws and regulations.
- Support MSF OCBA’s compliance with the GDPR, LOPDGDD and other relevant privacy laws and guidelines.
- Promote a culture of personal data protection and privacy across all areas of the organization.
- Serve as the main point of contact within the organization for staff members, regulators, and relevant public authorities on issues related to data protection.

The Data Protection Officer (DPO) is part of the General Management Department and reports to the Governance, Risk, Compliance and Data Protection Manager (GRC).

**MAIN RESPONSIBILITIES**

**Implementation of data protection**
- Develop and maintain data protection documentation, policies and procedures and assure that they are consistently applied throughout the organisation.
- Ensure all vital processes, procedures, and guidelines follow with GDPR, LOPDGDD and other relevant laws, in collaboration with departments and stakeholders, and support with implementation thereof.
- Maintain the register of all data processing activities (ROPA) of the organisation.
- Proactively advise and assist departments and teams with data protection requirements for new processes and initiatives that involve the processing of personal data, and conduct Data Protection Impact Assessments when required.
- Support and advise on a variety of questions from the organization regarding the protection of personal data, where necessary with the help of external experts.
- Support departments with selection of service providers and preparing data processing agreements.
- Provide assistance to internal projects on data protection measures, in collaboration with Projects & IT department, and coordinating with legal consultants for technical and legal matters.
- Collaborate closely with the Information Security team on issues where data protection and information security overlap and complement each other.

**Compliance and incidents**
- Review GDPR compliance on regular basis, and regularly report to General Direction and other stakeholders on the status of implementation of required data protection measures.
- Identify and recommend on any non-compliance issues or risks, including keeping the risk inventory, and advise General Direction and MT on any relevant major issues, risks or priorities.
- Keep track of and inform the organisation about relevant developments in the domain of privacy and data protection.
- If necessary, raise awareness and escalate (possible) infringements of data protection law with higher-level management.
- Manage data security incidents and (alleged) personal data breaches, and timely inform and recommend to General Direction regarding best way of action (including information to relevant National and International Official Authorities).

**External representation**
- Be the registered point of contact for authorities in case of complaints and breaches.
- Participate in the Information Security Committee.

**Training and awareness**
- Deliver training across all departments to staff members who are involved in data handling or processing and educate employees on important data compliance requirements.
- Maintain the Data Protection online space on Sharepoint.

**International collaboration and alignment**
- Collaborate with the MSF International Privacy Coordination Office (IPCO) and DPOs of other MSF entities to coordinate alignment of policies, and on data protection and privacy issues around shared assets and services such as SITS, Tembo, Homere, Epicentre, GEO, etc.

**Supervision Mobile Support Technician**
- Supervise the Mobile Support Technician on Personal Data Protection that is supporting our operations with implementation of key data protection measures in our project countries.
- Support the MST Personal Data Protection on planning, priorities and developing solutions for data protection challenges identified in our project countries and operational