Group Data Protection Officer (Nairobi)

About the role

A leading hospitality organization operating across East Africa is looking for an experienced Group Data Protection Officer (DPO) based in Nairobi. The DPO will oversee data privacy and compliance across its hotels, lodges, travel services and regional corporate functions, ensuring personal data of guests, employees, suppliers and partners is handled in line with regional data protection laws and international standards.

Key responsibilities

• Ensure business units comply with the Kenya DPA (2019), Tanzanian PDPA (2022), Rwandan Law No. 058/2021 and applicable international standards.
• Lead and support Data Protection Impact Assessments (DPIAs) for guest management systems, booking platforms, digital tools, loyalty programs and high-risk processing.
• Develop and enforce data protection policies, SOPs and privacy guidelines for guest check-ins, reservations, CCTV, payments and marketing.
• Oversee data subject rights requests (DSARs) and respond to them securely and in time.
• Act as the main contact with regulators (ODPC, PDPC, NCSA) and coordinate audits, inspections and compliance submissions.
• Lead data breach response, notify regulators and affected individuals, and drive corrective actions.
• Maintain Records of Processing Activities (ROPA) and data flow maps for hotel systems and third-party providers (PMS, POS, CRM, booking engines).
• Deliver data privacy training to hotel staff, front office, reservations, marketing, HR and management.

Required profile

• Bachelor's degree in Law, Information Security, Computer Science or a related field; specialized training or a postgraduate qualification in Data Protection is an advantage.
• Experience in data protection, compliance, information security or regulatory roles, preferably in hospitality, travel or services.
• Demonstrated experience with DPIAs, DSARs and data privacy programs.
• Strong risk management, analytical and documentation skills, and good communication and stakeholder engagement skills.

Required skills

• Knowledge of Kenya DPA, Tanzanian PDPA, Rwandan Law No. 058/2021, GDPR and ISO 27701.
• Desirable: knowledge of hospitality systems (PMS, POS, booking engines, CRM) and data flows in hotel operations.

The vacancy is advertised by Summit Recruitment & Search, a recruitment agency in Kenya. Applicants are contacted directly; those who do not hear back within two weeks are not shortlisted for this role.