Reporting to the Group Chief Risk Officer, the Executive Head of Privacy is accountable for shaping, governing, and advancing Safaricom’s enterprise wide Privacy, Data Protection, and Responsible Data Use strategy, frameworks, controls, and capabilities. The role provides strategic leadership in anticipating, identifying, and mitigating privacy risks, ensuring lawful and ethical data handling, safeguarding customer information, and embedding trust by design across Safaricom’s converged Telco–FinTech ecosystem, including M PESA, digital services, platforms, applications, networks, customer analytics, APIs, and partner ecosystems.

The role leads Safaricom’s Customer Privacy and Data Protection agenda across data governance, data minimisation, privacy by design, consent management, customer rights enablement, data lifecycle management, cross border data transfers, breach management, regulatory engagement, data ethics, and privacy assurance reviews. It ensures deployment of a unified Privacy Management System anchored in global standards and frameworks such as the Kenya Data Protection Act (DPA 2019), GDPR equivalent practices, ISO/IEC 27701, OECD Privacy Guidelines, GSMA Mobile Privacy Principles, and global digital trust benchmarks.

The Executive Head of Privacy partners extensively with M PESA/Financial Services, Technology, Digital, Enterprise, Consumer, Data Engineering, Networks, Legal, Risk, Compliance, Procurement, Supply Chain, Corporate Affairs, HR, Internal Audit, and external regulators (ODPC, CBK, CAK) to embed privacy resilience, strengthen data handling controls by design, and ensure robust privacy assurance across Safaricom’s rapidly evolving digital environment.

The role champions customer trust, ethical data stewardship, transparency, and responsible innovation, enabling a culture where engineers, product teams, analysts, data scientists, marketers, and ecosystem partners design and operate privacy compliant products, respect customer choices, and proactively identify and mitigate privacy risks. Through advanced privacy risk analytics, data flow mapping, consent and preference governance, third party privacy due diligence, privacy impact assessments (PIAs/DPIAs), and continuous assurance, the Executive Head of Privacy ensures Safaricom operates as one of Africa’s most trusted, privacy conscious, and ethically grounded digital enterprises.

The Executive Head of Privacy is strategically accountable for:

• Privacy Strategy & Governance: Defining and governing Safaricom’s enterprise wide Privacy, Data Protection, and Data Governance strategy, policies, standards, and operating frameworks, ensuring alignment with DPA 2019, global privacy principles, and evolving regulatory expectations in digital, financial, and telecom sectors.
• Data Protection Risk Intelligence, Monitoring & Response: Driving privacy risk assessments, data flow visibility, metadata governance, monitoring of high risk processing activities, incident detection, breach response, and regulatory notifications to prevent, detect, and mitigate privacy and data misuse risks across Safaricom’s digital ecosystem.
• Privacy-by-Design, Secure Data Use & Ethical Engineering: Embedding privacy by design into technology, product development, analytics, AI/ML models, customer interfaces, APIs, and ecosystem integrations through PIAs/DPIAs, data minimisation, pseudonymisation, access governance, purpose limitation, and ethical design frameworks.
• Responsible AI Governance: Define and enforce enterprise-wide AI governance frameworks to ensure safe, ethical, and compliant use of AI across Safaricom’s digital and data ecosystem.
• Data Minimisation, Consent, Rights Management & Lifecycle Controls: Strengthening customer consent governance, transparency mechanisms, rights management (access, erasure, portability, objection), data retention and deletion controls, and lawful bases for processing, ensuring compliant, accurate, and accountable use of customer information.
• Sensitive Data & Digital Trust Safeguards: Ensuring protection of sensitive and financial data, including M PESA processing data, behavioural data, identity attributes, and metadata, applying strong privacy controls, confidentiality safeguards, and aligned practices with AML, cybersecurity, and fraud prevention teams.
• Ecosystem Privacy Assurance (M PESA, Digital, Partners, APIs): Strengthening privacy assurance for M PESA services, merchant/agent ecosystems, API partners, fintech integrations, cloud environments, cross border data flows, and digital service providers, ensuring robust contractual privacy obligations, oversight, and compliance testing.
• Privacy Compliance Reporting, Assurance & Regulatory Readiness: Delivering privacy dashboards, KRIs, heatmaps, DPIA outcomes, breach metrics, and Board/ELT reporting; ensuring readiness for ODPC audits, CBK reviews (for financial data), Internal Audit assurance, and alignment with Enterprise Risk & Compliance frameworks.
• Privacy Culture, Capability & Technology Transformation: Building enterprise wide privacy awareness, responsible data use behaviours, leadership engagement, and capability uplift across squads and functions; scaling privacy technology, automation, data classification tools, consent systems, discovery platforms, and AI driven privacy analytics.
• Privacy Advocacy & Ecosystem Engagement: Champion privacy and data ethics through proactive stakeholder engagement, regulatory collaboration, and enterprise-wide awareness.
• Group Subsidiary Oversight, Enablement & Governance: Provide Group-level oversight and strategic enablement to subsidiaries by defining minimum risk standards, frameworks, and reporting requirements while supporting local market execution through advisory partnership, capability uplift, and risk-by-design embedding. Ensure consistent application of Group policies, effective aggregation of risk exposures and emerging themes across markets, and timely escalation of material issues to the CRO and Board. Balance strong governance with commercial enablement by partnering with subsidiary leadership to proactively identify, assess, and mitigate risks in a way that supports sustainable growth and regulatory compliance across the Safaricom Group.
• Risk, Governance & Control Ownership: Embed and maintain effective risk, governance, compliance, and control practices within the function by proactively identifying and mitigating operational, regulatory, financial, people, technology, and reputational risks. Ensure adherence to internal policies, regulatory requirements, audit actions, and enterprise governance frameworks while driving accountability, ethical practices, and a strong controls environment across all areas of responsibility.
   

Anchored in Safaricom’s purpose of Transforming Lives, the Executive Head of Privacy ensures Safaricom operates with uncompromising data protection standards, customer trust, and responsible innovation. By safeguarding customer information, enabling ethical data use, and reinforcing transparency at every touchpoint, the role strengthens Safaricom’s position as Africa’s most trusted and future ready digital enterprise.

Health and Safety

• Uphold the company code of conduct, policies and procedures, ensuring integrity and accountability in every aspect of your work.
• All employees have a responsibility to adhere to safety, health, and wellbeing policies, guidelines and procedures in all actions and decisions. 
  Key accountabilities and decision ownership:
   

Privacy Strategy, Governance & Accountability

• Define and maintain the enterprise privacy strategy, policy suite, standards and baselines, aligned to Kenya’s DPA 2019 (rights, lawful bases, DPIAs, cross border rules).
• Operate a privacy governance model (committees, charters, decision rights) with clear DPO/DPIA ownership and Board/ExCo reporting.
• Implement and continually improve a PIMS under ISO/IEC 27701:2025 (stand alone management system), integrating with existing ISMS where helpful. 
• Adopt ISO/IEC 29100 privacy principles/roles as a common language across squads and vendors. 
• Map policies to GSMA Mobile Privacy Principles to ensure consistent mobile first customer protections. 
• Maintain privacy risk appetite, KRIs, and exception management, with time bound remediation and independent challenge.
   

Privacy by Design & Ethical Data Use

• Bake privacy by design checkpoints into lifecycle gates (ideation → design → build → release), with DPIAs/PIAs for high risk processing. 
• Apply ISO/IEC 27701 guidance to define controller/processor responsibilities, data minimisation, purpose limitation, and accountability evidence. 
• Use ISO/IEC 29100 principles to evaluate fairness, transparency, individual participation, and accountability in AI/ML use cases. 
• Adopt GSMA Mobile Privacy Design patterns for consent UX, notice, and in app privacy controls on mobile channels. 
• Publish ethical data use guardrails (e.g., no dark patterns, PETs where feasible, children’s data safeguards) and review them quarterly.
• Implement model cards and data ethics reviews for high impact algorithms affecting eligibility, pricing, or customer outcomes.
   

Responsible AI Governance

• Define and implement AI governance frameworks covering ethics, privacy, explainability, and accountability
• Establish enterprise-wide policies and standards for responsible AI development and deployment
• Ensure compliance with data protection laws (e.g., DPA 2019) and emerging global AI regulations
• Oversee AI use cases across the business to ensure alignment with privacy, fairness, and ethical standards
• Embed privacy-by-design and responsible AI principles into AI/ML lifecycle (design, development, deployment)
• Conduct AI risk assessments including bias, misuse, model transparency, and data protection risks
• Partner with Technology, Data, and AI teams to embed governance into MLOps and AI Factory processes
• Provide oversight and reporting to leadership on AI-related risks, controls, and regulatory exposure
   

Data Subject Rights, Consent & Lifecycle Management

• Standardise lawful basis and consent frameworks (opt in/opt out logic, proof of consent, preference centres) across web, app, USSD, and agent channels per DPA 2019 and General Regulations. 
• Industrialise DSARs (access, rectification, erasure, portability, objection) with SLA metrics and audit trails. 
• Implement retention & deletion schedules with defensible holds for disputes/regulatory obligations; monitor deletion job success. 
• Deploy data discovery, classification, and lineage for personal/sensitive data across on prem/cloud, billing, M PESA, and analytics stacks. 
• Govern children’s data and vulnerable segments (age gating, enhanced notices, limited profiling) as per ODPC expectations. 
• Maintain cross border transfer inventories (mechanisms, third country risk) and contractual safeguards.
   

Privacy Risk Intelligence, Monitoring & Breach Response

• Run a privacy risk register with heatmaps/KRIs; integrate with ERM and Security risk processes. 
• Monitor high risk processing activities (special categories, large scale profiling, location data) and trigger DPIAs where thresholds are met. 
• Establish privacy incident & breach playbooks (evidence capture, containment, harm assessment, customer comms) aligned to Section 43 breach notification obligations and ODPC’s portal. 
• Track time to detect, time to notify (ODPC/subjects) and post incident lessons; maintain full audit trails. 
• Define privacy metrics for logging/telemetry completeness supporting investigations and regulatory disclosure. 
• Coordinate joint response with Security/AML/Fraud where incidents intersect (e.g., identity theft), ensuring least necessary data is shared.
   

Ecosystem & Third Party Privacy Assurance (Agents, Merchants, Partners, Cloud)

• Implement privacy due diligence and risk tiering for vendors, agents, merchants, fintech partners, and cross border processors. 
• Mandate controller/processor clauses (purpose, security, sub processing limits, breach notice, audit rights, return/delete at exit). 
• Run periodic assurance (sampling, walkthroughs, evidence reviews) for high risk processors, record corrective actions and SLAs. 
• Validate mobile app SDKs/APIs for data minimisation and transparency per GSMA mobile privacy guidance. 
• Maintain an ecosystem processing inventory (what data, where, why, for how long, cross border) with ISO 27701 role mappings (controller vs. processor). 
• Run exit/transition controls to ensure secure return/erasure and revocation of access.
   

Sensitive, Financial & M PESA Data Safeguards

• Classify sensitive/financial PII and enforce stricter access, masking/pseudonymisation, and logging; align to DPA’s sensitive data notions. 
• Enforce purpose limitation and guardrails for analytics on financial movement/behavioural data. 
• Assure consent/notice for features like location, contact lists, device identifiers on mobile; follow GSMA principles. 
• Coordinate with AML/Fraud/Security to balance detection versus privacy (data minimisation, PETs, role based access). 
• Apply data subject rights (portability/erasure constraints) with clear exceptions where lawful (e.g., AML retention). 
• Verify downstream disclosures (e.g., to banks, PSPs) have lawful basis and proportionality.
   

Compliance Reporting, Audit Readiness & Regulatory Engagement

• Produce Board/ExCo privacy dashboards (DPIA volumes, DSAR SLAs, breaches, ecosystem risks, training coverage). 
• Maintain regulatory readiness for ODPC (audits, inquiries, responses), and coordinate with CBK/CAK where scopes intersect (financial/telecom data). 
• Align with Internal Audit on annual privacy assurance; close findings within SLA; prevent repeats. 
• Operate quality assurance over notices, consents, DSAR outputs, breach files, and cross border documentation. 
• Keep policy/standards current with legislative updates and OECD privacy guidance (principles, risk based accountability, breach notification concepts). 
• Document regulator communications and commitments; track to closure.
   

Privacy Advocacy & Ecosystem Engagement

• Lead engagement with regulators (ODPC, CBK) on data protection, privacy, and AI-related topics
• Represent Safaricom in industry forums and working groups on privacy and digital trust
• Build strong relationships with internal stakeholders across Technology, Commercial, Legal, and Risk
• Drive enterprise-wide awareness and culture on privacy, data ethics, and responsible data use
• Influence policy development and regulatory direction on emerging privacy and AI issues
• Provide strategic advisory to leadership on stakeholder expectations and regulatory positioning
• Develop thought leadership on privacy, digital trust, and responsible innovation
• Position Safaricom as a trusted, privacy-conscious digital ecosystem player

Privacy Culture, Capability & Technology Transformation

• Define a capability framework; hire and develop talent (privacy engineers, DPIA specialists, consent UX, data governance, incident response). 
• Roll out role based training for product, data, engineering, marketing, care, and ecosystem partners, measure completion and effectiveness. 
• Deploy privacy tech (consent & preference platforms, discovery/classification, data lineage, deletion/orchestration, PETs, redaction tools). 
• Establish RACI & playbooks for DPIAs, DSARs, breaches, cross border transfers; rehearse with simulations. 
• Drive continuous improvement sprints (consent UX, DSAR cycle time, deletion automation, false positive reduction in breach triage). 
• Participate in GSMA/OECD privacy communities; bring back best practices and benchmark insights.
   

Stakeholder Management

• Serve as the primary liaison between the Chief Corporate Risk Officer and all Privacy relevant internal and external stakeholders, ensuring timely, transparent, and insight driven communication on data protection risks, emerging privacy issues, regulatory obligations, customer rights trends, data ethics concerns, and developments impacting Safaricom’s Telco–FinTech platforms.
• Build and sustain trusted relationships with Privacy and Data Protection regulators, including the Office of the Data Protection Commissioner (ODPC), CAK, CBK (for financial data scopes), regional privacy authorities, global privacy networks, industry taskforces, and standard setting organisations (ISO/IEC 27701, ISO/IEC 29100, GSMA Mobile Privacy) — positioning Safaricom as a responsible, transparent, and privacy mature digital enterprise. 
• Engage proactively with global and regional privacy forums, digital trust alliances, mobile privacy working groups, cross border data flow policy networks, and cloud privacy governance bodies to benchmark maturity, anticipate regulatory shifts, understand emerging privacy risks (AI/ML, IoT, digital ID), and embed international best practice into Safaricom’s privacy management system. 
• Collaborate cross functionally with M PESA/Financial Services, Technology, Digital, Enterprise, Consumer, Networks, Data Engineering, Legal, Risk, Compliance, Procurement, Supply Chain, Finance, Strategy, Corporate Affairs, HR, and Internal Audit to embed privacy by design, responsible data practices, transparency, and lawful processing into systems, products, data flows, algorithms, and customer journeys. 
• Leverage insights from DPIAs, privacy risk assessments, data flow mapping, consent analytics, DSAR patterns, breach investigations, partner privacy assessments, and behavioural data use indicators to refine privacy strategy, strengthen internal controls, elevate design choices, influence senior leadership decisions, and protect Safaricom’s digital trust and reputation. 
• Represent Safaricom in national, regional, and global privacy, digital rights, and data protection platforms, including privacy summits, regulator roundtables, mobile industry privacy forums, cloud privacy conferences, and digital ethics panels — advocating for user trust, fairness, accountability, and ethical innovation. 
• Act as a strategic advisor to internal and external assurance partners, ensuring that privacy insights, systemic risks, DPIA outcomes, data ethics considerations, and control recommendations are contextualised to Safaricom’s data architecture, digital platforms, regulatory expectations, and long term business strategy.
   

Leadership and Talent Development

• Provide strategic and inspiring leadership to the Privacy department ensuring delivery of high quality privacy assurance, DPIA oversight, rights enablement excellence, responsible data use guidance, and effective privacy governance across Safaricom entities and partner ecosystems.
• Design and evolve the enterprise Privacy Operating Model and governance structures, ensuring balanced expertise across privacy engineering, DPIAs, consent governance, data minimisation, privacy risk analytics, data protection incident response, third party privacy assurance, ethical AI/ML governance, and regulatory engagement. 
• Build deep specialist capability in privacy impact assessments, data protection law (DPA 2019), global privacy standards (ISO/IEC 27701, ISO/IEC 29100), GSMA mobile privacy principles, data governance, privacy engineering (PETs, pseudonymisation, data masking), breach response management, and responsible data use design — through targeted hiring, certifications, coaching, labs, and continuous learning. 
• Develop a Privacy Excellence Framework, including privacy playbooks, consent standards, notice templates, rights request handling guides, DPIA/PIA methodologies, breach response workflows, partner privacy due diligence blueprints, and privacy KPIs/KRIs — ensuring consistency, accountability, and operational excellence. 
• Embed OKRs and a performance driven culture across the Privacy function, aligning incentives to reduced privacy incidents, improved DSAR turnaround, stronger consent governance, lower data minimisation gaps, better DPIA outcomes, and measurable uplift in privacy maturity.
• Champion ethical leadership, transparency, confidentiality, independence, and sound regulatory judgement, ensuring privacy advisory and investigations uphold Safaricom’s values, legal obligations, individual rights, and global privacy principles. 
• Drive cross functional collaboration across all Three Lines of Defence, ensuring Privacy works seamlessly with 1st line (business units, product teams, data teams), 2nd line (Risk, Compliance, DPO), and 3rd line (Internal Audit) to manage privacy risks, resolve findings, and ensure regulatory readiness for major digital platform and data innovation initiatives.
• Lead change management for major privacy, regulatory, or technology shifts, ensuring enterprise readiness through updated policies, privacy notices, DPIAs, training, change enablement materials, simulations, and targeted briefings for leadership, developers, analysts, and ecosystem partners.
• Foster a culture of continuous privacy improvement and innovation, championing the adoption of privacy enhancing technologies (PETs), automated DSAR workflows, data discovery and classification tools, consent management platforms, breach response automation, and data ethics practices, strengthening digital trust and institutional resilience.
   

Group Subsidiary Oversight, Enablement & Governance

• Define and maintain minimum Group risk standards and governance frameworks applicable across subsidiaries.
• Provide advisory support and capability uplift to subsidiary teams to embed risk-by-design within local operations and commercial initiatives.
• Aggregate and analyze subsidiary risk exposures, trends, and emerging themes for Group-level visibility and Board reporting.
• Monitor adherence to Group policies and escalate material deviations or systemic risks appropriately.
• Support subsidiaries in regulatory engagement and assurance activities to ensure consistent application of Group risk expectations.
• Balance governance with commercial enablement by partnering with local leadership to manage risks in a manner that supports sustainable growth and market competitiveness.
   

Core competencies, knowledge and experience:

Customer Obsession

• Deepen team connection to our customers and communities.
• Foster authentic relationships with customers and partners that build trust.
• Explicitly take customer-centric decisions and take personal ownership to achieve results.
• Simplify processes through digitalization and promote a digital mindset and digital first customer experience.
• Stay focused on the big priorities, know when to make meaningful trade-offs and demonstrate brilliant execution.
   

Purpose

• Create an inspiring vision for your team to drive strategy and performance.
• Show ambition and courage, empowering others to go beyond the plan.
• Bold and challenge teams to reimagine how things are done.
• Prompt new thinking and ideas by asking “what if” questions.
• Use knowledge of the external environment (customers, partners, competition, external bodies) to identify and act on opportunities for growth at pace.
   

Innovation

• Create psychological safety so everyone can have an impact.
• Fuel innovative ideas from others and test them to enable growth.
• Explore successes and failures with curiosity and resilience; fearlessly recognizing lessons learned.
• Share your ongoing learning and personal purpose with others.
• Learn fast from digital adoption, using learnings to drive simplicity, scale and efficiency.
   

Collaboration

• Articulate your team’s role in making our strategy happen, prioritizing and aligning resources with current and future needs.
• Actively collaborate to break silos and hold your team accountable to do the same.
• Develop others to make the most of their talents and coach them to take ownership to get things done.
• Create an inclusive environment ensuring the safety and wellbeing of others.
• Live our Purpose and demonstrate the highest Standard of integrity.

• Bachelor’s degree in Law, Information Technology, Data Science, Cybersecurity, Risk, Business, or related field
• Postgraduate qualification (LLM, MSc Data Protection, MBA, Cybersecurity, Digital Governance, or Risk Management) strongly preferred
• At least one advanced privacy credential:
  o    CIPP/E, CIPP/US, or CIPP/A (Certified Information Privacy Professional)
  o    CIPM (Certified Information Privacy Manager)
  o    CIPT (Certified Information Privacy Technologist)
  o    CDPSE (Certified Data Privacy Solutions Engineer)
  o    ISO 27701 / ISO 27001 Lead Implementer or Lead Auditor
  o    CISM / CISSP (advantageous in tech-heavy environments)
• Deep expertise in:
  o    Kenya Data Protection Act (DPA 2019)
  o    ODPC regulatory framework
  o    GDPR-equivalent global privacy standards
  o    Cross-border data transfer compliance
  o    Privacy by Design & Default frameworks
  o    Data governance & lifecycle management
  o    Consent management & preference governance
  o    Data minimization & purpose limitation controls
  o    Privacy Impact Assessments (PIAs/DPIAs)
  o    Third-party privacy risk management
  o    Data subject rights (DSARs) operationalization
  o    Breach management & regulatory notification processes
• Strong understanding of:
  o    AI & analytics governance (Responsible AI, data ethics)
  o    API ecosystems & embedded finance risks
  o    Cloud data architecture & digital platforms
  o    Customer analytics & marketing data risk
  o    Telco data, mobile money data, and digital identity risks
• 12–15+ years in Privacy, Data Protection, Information Governance, or Digital Risk
• Minimum 5+ years in senior leadership role
• Experience within telecommunications, fintech, banking, digital platforms, or tech-driven environments
• Experience engaging directly with regulators (ODPC exposure strongly preferred)
• Proven experience leading privacy transformation or enterprise privacy uplift programs
• Experience embedding privacy in product lifecycle environments
• Proven expertise leading enterprise wide Privacy and Data Protection programmes or Centres of Excellence, including oversight of privacy governance frameworks, Privacy Impact Assessments (PIAs/DPIAs), consent management, data lifecycle controls, cross border data governance, breach management, and privacy risk analytics, aligned to global standards such as ISO/IEC 27701 (PIMS) and ISO/IEC 29100 (privacy principles).
• Proven ability to advise CEO, CRO, ExCo, and Board Committees, translating complex privacy, data ethics, and regulatory risks into clear business implications, strategic opportunities, and corrective action recommendations aligned to corporate risk appetite and market expectations.
• Demonstrated experience engaging with regulators (ODPC, CBK for financial data governance, CAK for telecom/consumer protections), industry bodies, external auditors, and global privacy networks (ISO, GSMA, OECD) on data protection, digital rights, and responsible data use matters.
• Member in good standing of a recognized professional body is required. 
• High ethical standards, integrity, confidentiality, and independence, essential for stewarding enterprise privacy, defending customer rights, and making objective, principle based decisions free from commercial pressure.
• Exceptional influencing, communication, and relationship building skills, able to simplify complex privacy, regulatory, and technical concepts into clear, business aligned language for senior stakeholders.
• Strong strategic systems thinker, capable of connecting privacy risks to customer trust, market reputation, regulatory expectations, operational resilience, digital innovation safety, and long term enterprise sustainability.
• Demonstrated resilience, courage, and sound judgement under pressure, critical during regulatory reviews, high profile data breach events, complex DPIAs, rights handling escalations, and public trust impacting scenarios.
• Commitment to capability building, privacy culture uplift, and continuous improvement, fostering a high performance, future ready, and digitally responsible organisation.

How to apply If you feel that you are up to the challenge and possess the necessary qualification and experience, kindly click on the apply button. Remember to attach your resume