Group Data Protection Officer

Company Description:
Trust Payments is an MFSA-regulated in Malta; and an FCA-regulated company in the UK. We provide a range of payments and commerce solutions, with market-leading technology and data insights.

We offer innovative payment methods and cutting-edge technologies, with a truly global presence. Our global offices cater to the most demanding business sectors, including retail, travel, hospitality, forex, and financial services.

Driving value for our clients and demonstrating genuine care for their success, is a core value of ours. We also believe in striving to build a better, more sustainable tomorrow and believe in conducting our business ethically, driving social and environmental change.

We have a passionate, collaborative, and diverse culture that recognizes that every employee contributes to our business success.

Find out more at www.trustpayments.com.

Trust Payments has an exciting opportunity for a Group Data Protection Officer (Part-Time)  to join their team.

Location: Malta; Hybrid- Part Time 
Salary: Competitive + Benefits

How will you make an impact in this role?
The Role:
The DPO is responsible for overseeing the Group's compliance with data protection laws and regulations across the EU, including the UK and Malta — covering the UK GDPR, EU GDPR, and any relevant local legislation. This role ensures that personal data is processed lawfully, transparently, and securely, and that appropriate governance frameworks and controls are in place. The DPO serves as the primary point of contact for data protection authorities, advises on privacy impact assessments, manages data subject rights requests, and promotes a culture of data protection awareness across the Group. 

What We Expect of You, Day To Day:

• Serve as the organisation's formally appointed DPO and primary contact for the IDPC (Malta) and the ICO (UK).
• Monitor compliance with the UK GDPR, EU GDPR, and national data protection laws in both jurisdictions.
• Advise the Group and executive leadership on data protection and privacy risk, regulatory developments, and compliance obligations.
• Oversee the development and continuous improvement of the Group-wide data protection strategy and privacy governance framework.
• Manage and maintain comprehensive Records of Processing Activities (ROPA) for both Malta and UK operations.
• Coordinate responses to regulatory enquiries, investigations, and audits.
• Complete and document DPIAs for processing activities, working collaboratively with relevant business teams where necessary.
• Handle all data subject rights requests (DSARs, right to erasure, etc.) within legal timeframes.
• Investigate and document personal data breaches, escalate high-risk incidents to the Board and/or relevant stakeholders, and assist with regulatory reporting in line with legal obligations.
• Conduct vendor risk assessments in coordination with relevant business teams and assist with the review of data processing agreements (DPAs) and related contractual obligations.
• Embed privacy-by-design principles into all product, service, and system design.
• Deliver and track all Group data protection training and awareness initiatives.
• Respond to internal queries regarding GDPR and local data protection law obligations.
• Liaise with IT Security, Compliance, Legal, and HR to ensure effective implementation of all relevant data protection measures.
• Maintain documentation for audit readiness and internal assurance.
• Manage and maintain the Group Privacy Team software tool.

Qualifications

• Experience
  • Demonstrable experience overseeing and implementing data protection compliance within an MFSA, FCA, or similarly regulated business.
  • Degree or equivalent professional experience in a DPO role.
  • Professional data protection qualifications (e.g., CIPP/E, CIPM, BCS, or equivalent).
  • Previous experience in a B2B environment.
  • Proven track record in contributing to large-scale GDPR transformation programmes.
  • Experience or familiarity with privacy software tools is beneficial.
• Knowledge and Skills
  • Comprehensive knowledge and practical application of EU GDPR, UK data protection law, Malta data protection legislation, and related privacy regulations.
  • Excellent communication skills with the ability to engage clearly and effectively at senior leadership level.
  • A pragmatic, solution-focused approach to data privacy.
  • Skilled at problem-solving and building collaborative relationships across the organisation.
• Accountability
  • This role operates with professional independence, as required under Article 38 of the GDPR.
  • Provides regular reporting on DPO-related metrics, risks, and issues to senior leadership, the Board, or relevant committees as needed.
• KPI’s
  • Level of compliance with GDPR and related privacy obligations.
  • Timely and compliant handling of DPIAs, rights requests (including DSARs), and breach/incident responses.
  • Audit findings and regulator engagement outcomes.
  • Organisation-wide integration of privacy-by-design principles.