Job description

We help the world run better
At SAP, we keep it simple: you bring your best to us, and we'll bring out the best in you. We're builders touching over 20 industries and 80% of global commerce, and we need your unique talents to help shape what's next. The work is challenging – but it matters. You'll find a place where you can be yourself, prioritize your wellbeing, and truly belong. What's in it for you? Constant learning, skill growth, great benefits, and a team that wants you to grow and succeed.

This role is based in Cairo, regional scope is Arabian countries 

PURPOSE AND OBJECTIVES

When processing personal data as part of its business operations, SAP must comply with the requirements of the EU's General Data Protection Regulation (GDPR), Egypt's Data Protection Law No. 151 of 2020, UAE's Federal Decree-Law No. 45 of 2021, Saudi Arabia's PDPL (Personal Data Protection Law), and other applicable data protection and privacy laws in the countries where SAP operates.

To support the local SAP entities in meeting their data protection and privacy compliance obligations, SAP has established a global network of Data Protection and Privacy professionals. This network consists of local Data Protection Officers (DPOs) and Data Protection and Privacy Coordinators (DPPCs) that report to the management of the SAP entities by which they are hired and to SAP's global Data Protection & Privacy team, reporting to SAP's Group Data Protection Officer.

We are looking for an experienced Lead Senior Legal Counsel to serve as the local Data Protection Officer (DPO) for Egypt and as Data Protection and Privacy Coordinator (DPPC) for Arabian countries including the UAE and Saudi Arabia, responsible for leading data protection compliance strategy across the assigned country responsibility.

EXPECTATIONS AND TASKS

The role is responsible for ensuring SAP's compliance with Egypt's data protection regulations, GDPR, and data protection laws across assigned Arabian countries. This role involves collaborating closely with the global data protection and privacy team, local business units, senior management, and external regulatory authorities to manage data protection risks and drive data protection and privacy awareness across the organization. 

Under Law No. 151 of 2020, the local DPO is a legally recognized role that requires formal registration with the regulator. The candidate must meet the following statutory requirements:

1. Official Registration: The candidate must be registered (or eligible for immediate registration) in the official DPO Register held by the Egyptian Personal Data Protection Center (PDPC).
2. Legal Capability Demonstration (Mandatory Exam):

• To finalize registration with the PDPC, the candidate must successfully demonstrate legal and technical capabilities in data privacy.
• Requirement: The candidate must pass the official PDPC accreditation examination (or equivalent authorized evaluation) proving deep knowledge of Egyptian Law No. 151 of 2020, its executive regulations, and international data transfer frameworks.

Note: Continued employment in this role is contingent upon successfully passing this exam and securing/maintaining active registration with the PDPC.

Key Responsibilities:

• Regulatory Compliance & Strategy:
• Ensure compliance with Egypt's Personal Data Protection Law No. 151 of 2020, UAE Federal Decree-Law No. 45 of 2021, Saudi Arabia's Personal Data Protection Law (PDPL), GDPR, and other relevant regional regulations.
• Act as the officially registered and certified Data Protection Officer (DPO) for SAP's legal entities in Egypt in front of the Egyptian Personal Data Protection Center (PDPC), ensuring all local registration and licensing requirements are met.
• Develop and implement a comprehensive data protection compliance strategy for Egypt and assigned Arabian countries.
• Monitor, interpret, and assess changes in data protection legislation, regulations, and industry standards across all assigned jurisdictions.
• Provide timely updates, guidance, and legal opinions on regulatory developments and best practices.
• Conduct and document the mandatory periodic evaluations, system inspections, and data protection audits as required by Article 9(1) of the Egyptian PDPL, and support the implementation of remediation measures.
• Strategic Advice & Representation:
• Provide legal and compliance advice on data protection issues and conduct Data Protection Impact Assessments (DPIAs) for new projects, initiatives, and emerging technologies, including AI/ML applications, ensuring alignment with the guidelines of the Egyptian PDPC and regional regulators.
• Represent SAP's Group Data Protection Officer within the assigned region and serve as the direct, primary point of contact for the Egyptian PDPC and other regional supervisory authorities.
• Drive the development, implementation, and maintenance of local data protection and privacy policies, standards, and procedures aligned with global requirements in accordance with SAP Global Data Protection and Privacy Strategy.
• Assist local Legal Representatives (who carry statutory and criminal liability under Egyptian law) and Chief Finance Officers in fulfilling their local data protection responsibilities and dedicated legal entity processes.
• Compliance Monitoring, Risk Management & Operations:
• Monitor and advise LoBs implementing local procedures (Records of Processing Activities - ROPA) of data processing operations for the Egyptian entity, ensuring it is available for inspection by the PDPC.
• Establish and monitor compliance with data protection policies, procedures, and regulatory requirements across all assigned entities.
• Manage data breach response protocols, according to SAP’s established processes, ensuring that any personal data breach affecting Egyptian data subjects is reported to the PDPC and affected individuals within the statutory 72-hour window, in compliance with Article 9(6) of the PDPL.
• Act as the dedicated point of contact for data subjects, establishing clear channels to receive, investigate, and resolve requests, complaints, and inquiries regarding their rights under Egyptian law and regional frameworks.
• Support the execution of cross-border data transfer impact assessments and obtain necessary data transfer licenses and permits from the PDPC as required by Egyptian law.
• Awareness, Training & Organizational Development:
• Conduct targeted data protection and privacy training programs for various organizational levels, tailored to the compliance requirements of Egypt, Saudi Arabia, and the UAE.
• Develop and maintain data protection awareness materials and communications.
• Strengthen and expand SAP's global data protection community within the assigned region.

• Regional Coordination & Harmonization:
• Harmonize data protection documentation, processes, and compliance approaches across Egypt and assigned Arabian countries in alignment with global DPP standards, while strictly respecting local localization and sovereign cloud requirements (e.g., KSA and Egypt cloud regulations).
• Coordinate data protection initiatives and ensure consistency in implementation across multiple jurisdictions.
• Build and maintain collaborative relationships with local and regional stakeholders, including government authorities (specifically the PDPC in Egypt, SDAIA in KSA, and the UAE Data Office), industry partners, and external legal counsel.

EDUCATION AND QUALIFICATIONS / SKILLS AND COMPETENCIES

Required skills

• University degree in Law with specialization in data protection, privacy, or information technology law
• Minimum 10 years of professional experience as a Data Protection Officer, Chief Privacy Officer, or in a senior legal/compliance role focused on data protection
• Thorough knowledge and practical experience with GDPR and other global data protection regulations
• Demonstrated expertise in Egypt's Data Protection Law No. 151 of 2020 and/or UAE/Saudi Arabian data protection frameworks
• Professional experience in managing cross-jurisdictional compliance initiatives
• Strong project management capabilities with ability to lead complex, multi-stakeholder initiatives
• Exceptional written and oral presentation skills with ability to communicate complex legal and technical concepts to non-specialist audiences
• Strong communication skills at all organizational levels, including C-suite executives
• Ability to build and maintain relationships with internal and external stakeholders, including regulatory authorities

Technical & Legal Expertise:

• Deep understanding of data protection principles, frameworks, and regulatory requirements across assigned jurisdictions
• Proficiency in conducting DPIAs and risk assessments