Data Governance and Privacy Manager

Let's Write Africa's Story Together!

Old Mutual is a firm believer in the African opportunity and our diverse talent reflects this.

Job Description

The Data Governance and Privacy Manager is responsible for establishing, leading, and maintaining independent 2nd line oversight of data governance, data risk, data quality and privacy compliance across OMI.

This role ensures that OMI manages data as a strategic and regulatory compliant asset. The incumbent provides independent challenge to 1st line operational teams (IT, Data Architecture, Engineering, Underwriting, Claims and Operations) while ensuring full alignment with SA regulatory mandates and requirements (e.g. POPIA).

Responsibilities will include the following:

Data Risk Framework and Appetite

• Develop, maintain and embed the Data Risk Management Framework, policy and standards, aligned to the Old Mutual Group enterprise risk framework.
• Define the data risk taxonomy (data quality, data privacy, data lineage, retention, data access, AI/model data, third-party data).
• Propose data risk appetite statements, key risk indicators (KRIs) and tolerance thresholds for approval by the risk committees.
• Provide independent oversight of the implementation and effectiveness of data governance policies, standards, procedures and control frameworks.
• Ensure that data risks are appropriately integrated into enterprise risk registers, technology risk assessments, operational risk assessments and relevant business risk management processes.
• Maintain a forward-looking view of emerging data risks arising from business strategy, digital transformation, acquisitions, technology changes, outsourcing and new data use cases.

Independent Data Risk Oversight and Challenge

• Conduct independent reviews and risk assessments of material data processes, systems, business initiatives, third-party vendor data sharing agreements and change programmes.
• Review and challenge first-line risk and control self-assessments (RCSAs) for data-related risks across underwriting, claims, finance, actuarial and IT.
• Oversee and challenge Data Protection Impact Assessments (DPIAs) for all new business initiatives products, and technology implementations.
• Evaluate the design and operating effectiveness of data controls, including preventive, detective and corrective controls.
• Identify systemic weaknesses, recurring control failures and risk concentrations across business units, applications, data domains and third parties.
• Review material data incidents, breaches, quality failures and reporting inaccuracies to assess root causes, control weaknesses and the adequacy of management responses.
• Track data risk events, incidents and breaches through root-cause analysis to closure of remediation actions.

Data Governance and Data Quality Oversight

• Assess whether appropriate controls exist to ensure data is accurate, complete, consistent, valid, timely, unique and fit for its intended purpose.
• Oversee the risk management practices supporting data lineage, traceability, reconciliation and data transformation across source systems, operational platforms, data warehouses and reporting environments.
• Monitor material data quality issues, recurring exceptions, unresolved defects and the effectiveness of corrective actions.
• Provide oversight of data migration and conversion risks, including reconciliation, completeness validation, record integrity and business sign-off.
• Assess the reliability of critical management information and regulatory submissions where data deficiencies could affect decision-making, financial soundness or regulatory compliance.

Data Privacy, Protection and Confidentiality Risk

• Provide independent oversight of data protection and privacy risks in collaboration with the Information Officer, Privacy, Legal, Compliance and Information Security functions.
• Assess whether appropriate controls are in place to protect personal, sensitive, confidential and commercially critical information throughout its lifecycle.
• Oversee risk management arrangements relating to data classification, access restrictions, encryption, masking, anonymisation, secure transfer, retention and secure disposal.
• Assess risks associated with unauthorised access, disclosure, loss, alteration, misuse or inappropriate sharing of data.
• Challenge weaknesses in data access governance, including excessive privileges, inappropriate access, segregation-of-duties conflicts and inadequate periodic access reviews.
• Assess risks arising from the processing and sharing of policyholder, claimant, beneficiary, employee and other personal information.
• Provide risk oversight of cross-border data transfers, outsourced processing, data sharing arrangements and the use of external service providers.
• Monitor material data privacy and confidentiality incidents, ensuring that root causes, control weaknesses and corrective actions are addressed by accountable First Line owners.
• Support the relevant control functions in assessing compliance with applicable data protection and privacy obligations, including POPIA.

Critical Data Assets and Data Lifecyle Risk

• Establish risk-based criteria for identifying and prioritising critical data assets, datasets, data flows and business processes.
• Evaluate whether critical data assets are adequately protected against loss, corruption, unauthorised modification and unavailability.
• Assess data resilience arrangements, including backup integrity, recoverability, restoration testing and dependency on critical data platforms.
• Assess the risks arising from legacy systems, fragmented data environments, shadow data stores, uncontrolled data extracts and unmanaged copies of sensitive information.

Third- Party, Outsourcing and Cloud Data

• Provide oversight of data risks associated with outsourced services, cloud platforms, administrators, service providers, business partners and other external parties.
• Assess whether third-party arrangements provide appropriate protection for confidentiality, integrity, availability and lawful processing of organisational data.
• Challenge the adequacy of data-related due diligence, contractual safeguards, audit rights, subcontracting arrangements, incident notification obligations and exit provisions.
• Assess risks associated with external data hosting, offshore processing, concentration of critical data services and dependency on key providers.
• Monitor material third-party data risks and remediation commitments in collaboration with Third-Party Risk Management and Procurement.
• Provide independent challenge on the adequacy of controls governing the return, transfer, retention and secure destruction of data when contracts terminate or services change. 

Issues Management and Remediation Oversight

• Maintain oversight of data-related risk findings, incidents, control deficiencies and agreed management actions.
• Challenge remediation plans for completeness, practicality, accountable ownership, milestones and sustainable resolution.
• Validate the adequacy of evidence provided by First Line management to demonstrate that agreed actions have been completed.
• Monitor overdue actions, repeated findings, management risk acceptance and residual exposure.
• Escalate ineffective remediation, recurring failures and unresolved material risks to the appropriate governance forums.
• Collaborate with Internal Audit, Compliance and other assurance providers to support coordinated assurance and reduce duplication of effort.

Qualifications required:

• Bachelor’s degree in information systems, Data Management, Computer Science, Risk Management, Information Security, Statistics, Business or a related discipline.
• A relevant postgraduate qualification in Risk Management, Information Systems, Data Governance or a related field would be advantageous.

 Professional Certifications:

• Risk and governance: CISA, CRISC, CGEIT, COBIT 2019 would be advantageous.
• Data Management: Certified Data Management Professional (CDMP), CIPP/E or CIPM

Experience, skills and knowledge required:

• At least 6–8 years of relevant experience in data risk, IT risk, information governance, data governance, information security, technology risk or a related discipline.
• Strong understanding of data management principles, data quality, metadata, lineage, ownership and lifecycle controls.
• Experience assessing privacy, information security, data access, data integrity and data availability risks.
• Exposure to AI governance, model risk or automated decision-making risk would be advantageous.

• Execution
• Collaboration (Relating)
• Innovation (Perspective)
• Leading with Influence
• Personal Mastery (Learning)
• Strategic

The Recruitment Process:

• TA Interview: This will be a discussion with our Senior Talent Acquisition Specialist to give you an understanding of our business, our culture & values and more context on the role. It will also allow us the opportunity to get to know you more and ensure OMI can meet your career aspirations.
• Panel Interview: This will be with 2 members of the Senior Leadership of the Hiring Team and 1 member of the HC Senior Team.
• Technical & Psychometric Assessments: These will depend on the role and will sometimes happen concurrently with Vetting through an external service provider, as well as Internal Verification.
• Final Feedback.

All About OMI:

https://www.oldmutual.co.za/about/old-mutual-insure/ 

Please note that, unfortunately, we cannot accept any applications after the closing date

Skills

Action Planning, Adaptive Thinking, Business Requirements Analysis, Business Risk Management, Cultural Awareness, Database Administration, Data Compilation, Data Controls, Data Governance, Data Management, Evaluating Information, Executing Plans, Expertise Management System, Graphical User Interface (GUI) Development, Information Governance, IT Architecture, Privacy Compliance, Readiness Assessments, Risk Framework, Risk Management Strategies, User Requirements Documentation

Competencies

Action OrientedBusiness InsightCollaboratesCommunicates EffectivelyCourageCultivates InnovationCustomer FocusDecision Quality

Education

Bachelor of Commerce (BCom): Management,Information Systems & Technology (Required), NQF Level 9 – Masters

Closing Date

11 November 2026 , 23:59

The appointment will be made from the designated group in line with the Employment Equity Plan of Old Mutual South Africa and the specific business unit in question.

The Old Mutual Story!