Data Protection Officer

About the role

The Security Team at TUMO protects the organisation's digital environment and the personal data of students and staff across its global network. The Data Protection Officer (DPO) provides independent oversight of privacy compliance, ensuring consistent data protection standards and that privacy requirements are implemented in products, systems and operations. The role reports to the Chief Information Security Officer and is established by charter with direct, unobstructed access to the CEO and Executive.

Key responsibilities

• Maintain the GDPR baseline across all centres and track divergences in EU national law, including Germany's TDDDG, France's LIL and CNIL positions, and non-EU regimes such as India's DPDP, Japan's APPI, Kazakhstan's data residency rules, Switzerland's nFADP and Armenian law
• Brief the Executive on material legal changes and their cost, and advise on parental consent thresholds by jurisdiction
• Act as point of contact for centre-side DPOs, external data protection coordinators, municipal offices and supervisory authorities, and support franchise account managers with assessments, privacy policies and partner responses
• Draft or contribute to data protection clauses in franchise and partner agreements, revise them when required, and work with the Head of Legal on legal review of privacy policies, cookies and data subject requests
• Specify product and platform changes required by privacy law, table them with owning teams, verify they were implemented correctly, and escalate risks to the CISO and Executive
• Own Data Processing Agreements, Joint Controller Agreements and Standard Contractual Clauses, apply the Article 44-49 transfer chain and run Transfer Impact Assessments
• Handle access, erasure and objection requests across centres, own breach assessments and the 72-hour notification decision, maintain the Record of Processing Activities, run DPIAs and contribute to AI Impact Assessments
• Deliver data protection training and induction and contribute to the wider awareness programme

Required profile

• Extensive working knowledge of the EU GDPR and national divergence in at least two member states
• Previous experience as a Data Protection Officer or working closely with one
• Experience with DPAs, Joint Controller Agreements, SCCs, Transfer Impact Assessments and DPIAs, and end-to-end handling of data subject requests
• Familiarity with at least one non-EU privacy regime (DPDP, APPI, nFADP or comparable)
• Understanding of technical privacy controls such as identity and access management, data residency, logging, retention, analytics, tracking and consent management
• Awareness of the EU AI Act and ISO/IEC 42001, and experience processing children's data
• Strong written and verbal English; Armenian, French or German is an advantage

What we offer

• Health insurance and a discount on travel insurance
• Assistance with work permits and opening a bank account if needed
• Extra New Year paid holidays (3rd, 4th and 5th of January)
• 5 days of personal leave and birthday leave