Data Protection Analyst

About the role

Family Bank is hiring a full-time Data Protection Analyst in Nairobi to strengthen its data protection function. The role provides technical, operational, administrative and research support while building internal capacity for compliance, risk mitigation and audit preparedness, so that safeguards, access controls and data governance align with the Data Protection Act, 2019 and internal security standards. The position reports to the Senior Data Protection Officer.

Key responsibilities

• Support the Data Protection and Privacy Framework, records of processing activities (ROPA), and the documentation and updating of data protection policies and standards
• Help implement privacy by design and maintain registers of personal data processing and data inventories
• Assist with DLP implementation, access controls, privilege management and authentication safeguards, and report control weaknesses
• Support Data Protection Impact Assessments (DPIAs), data mapping, privacy risk assessments and third-party privacy reviews
• Support data subject rights requests, track DSAR responses, investigate and document data breaches and escalate incidents to the Senior Data Protection Officer
• Deliver data protection awareness training, prepare privacy communications and newsletters, and monitor compliance with consent and retention requirements
• Prepare reports and dashboards on the bank's data protection posture, support internal audits and vendor privacy assessments, and track remediation of privacy risks

Required profile

• Bachelor's degree in information technology, computer science, information security, network security, business information systems or a related field
• Certification or training in data protection or privacy (e.g. CIPM, CIPT, ISO Privacy modules)
• Information security certifications such as CISSP, CISM, Network+ or CCNP are an added advantage
• 2-4 years of experience in data protection, information security, IT risk, compliance or data governance roles
• Experience with DLP or information security compliance and data governance; exposure to banking systems or regulated financial services is an added advantage

Required skills

• Data protection and privacy governance
• Privacy risk assessment and DPIAs
• Data breach and incident management
• Information security and privacy controls
• Data governance and records management

To apply, candidates must submit their application online through the recruiter's website; the deadline is 30 October 2026.