Responsibilities

Accountabilities :

• Standards, framework, controls and policies: Driving and supporting the integration of and embedding of privacy standards, controls and policies into standard business processes. Incl. the 10 global privacy principles
• Adoption of Global PEP Privacy Tooling: Encourage use and adoption (e.g. by training) by the business of the new Global Privacy Tooling (e.g. OneTrust) for privacy related governance and operations;
• Privacy Risk Assessments (PIAs) for businesses / functions engaged in data processing: manages and ensures adoption of PIA process by the business, documents remediation plans, monitors their execution and provides appropriate updates to Privacy Councils. This also involves if PIAs trigger a high risk processing activity that may need to be escalated to the sector DPO(s) e.g. via a Data Protection Impact Assessment (DPIA).
• Communication/Reporting: Connects on a regular basis with key stakeholders across BU and Functions to understand their current and planned data processing activities and ensure they are clear privacy operational requirements. Exercises judgement to raise key risk and compliance issues to the DPO and/or Legal and/or the Privacy Councils.
• Record of Processing Activities: Encourage use and adoption of the Global tool to ensure processing activities of the business is properly logged. Where necessary manages maintenance of a record of all personal data processing activities (i.e. data inventory).
• Data Subject Rights: Manages the data subject rights request process, partnering with data subject facing functions (Consumer Services, Insights and HR) in continuously endeavoring to improve the management of processes to permit data subjects to exercise their rights of access and deletion (including facilitating records location/extraction/consolidation/deletion) in accordance with agreed legislatively driven SLAs.
• CoE Operating Manual: ensure that the CoE manual is followed, monitored, and maintained. Where necessary report back any required enhancement to ensure the smooth running of the CoE operations.
• Data protection by design: Supports the business on the embedding of current privacy standards, controls and policies into “Business As Usual” and into overall ways the Business works with third parties who process PEP personal data. This will involve assisting to formulate, embed and enforce protocols and ways of working with IT system owners across the business to ensure privacy is flagged and addressed in system design as early as possible and prior to PEP onboarding.
• Training and Awareness: supports in the development of a privacy compliance training program. Promotes privacy awareness throughout the business and ensuring adequate support is granted to the Sector DPOs in the roll out of a regular cadence of communications to keep privacy on the business agenda.
• Privacy Councils: Supports the China DPO to lead quarterly Regional Privacy Councils as part of the PepsiCo global privacy governance framework, ensuring privacy risk/key privacy matters are raised and escalated appropriately and in accordance with PepsiCo’s privacy policies and standards.

Qualifications

Key Skills/Experience Required

• Bachelor level degree (preferably in law or information technology/cyber security and data security)
• 10+ years’ experience
• Data, Regulatory Compliance, Audit, Data Privacy experience
• Commercial and financial acumen
• Technology: ERP, Content management, Computer, Business Analysis and Project Management
• Knowledge of operational management accounting
• Internal governance and control skills
• Knowledge of data privacy legislative & regulatory landscape
• Knowledge of reporting and presentation to various levels of stakeholders including senior level
• Communication and collaboration skills
• Writing skills (Strategy Roadmaps, Reports, KPIs, KRIs, Policies and Procedures and Standard Operating Procedures)
• Research skills