Senior Assistant Manager, Data Protection Office

JOB PURPOSE

1. To support Woodlands Hospital in implementing, operationalising and strengthening the organisation's Data Protection Programme in compliance with the Personal Data Protection Act (PDPA), Ministry of Health (MOH) requirements, National Healthcare Group (NHG) policies and institutional data protection requirements.
2. To support the Director (Data Protection Office) and Assistant Director (Data Protection Office) in planning, coordination and collaboration with internal stakeholders, NHG, MOH, PDPC, Synapxe and other partners on data protection governance, compliance management, risk assessments, data security, incident management and staff awareness initiatives.
3. To support the implementation and operationalisation of activities across the WH Data Protection Framework, including Risk & Compliance Management, Data Security Controls, Incident Management & Response, and Awareness, Engagement, Training & Culture.
4. To support other concurrent institutional governance initiatives and secondary portfolios as assigned.

MAJOR DUTIES & RESPONSIBILITIES

Specific

1. Conduct data protection compliance reviews, audits and assessments across departments.
2. Support Data Protection Impact Assessments (DPIAs), risk assessments and compliance reviews for new systems, projects, programmes and initiatives.
3. Plan, coordinate and monitor Data Security Maintenance Programme (DSMP) activities and reporting requirements.
4. Support implementation and monitoring of compliance with PDPA obligations, MOH requirements and NHG policies.
5. Conduct vendor and third-party data protection risk assessments, review contractual data protection requirements, and support ongoing oversight of data intermediary compliance.
6. Support implementation and monitoring of data security controls, including secure handling requirements, Data Loss Prevention (DLP) governance and related investigations.
7. Coordinate with ITD, Synapxe, cybersecurity and governance stakeholders on data protection and information security matters.
8. Manage reporting, assessment, escalation and coordination of data protection incidents, near misses and breaches.
9. Support investigations, root cause analysis, corrective actions, and post-incident reviews.
10. Prepare reports, dashboards and presentations for management, committees and regulatory reporting where required.
11. Develop, coordinate and conduct data protection awareness, engagement and competency development programmes for staff, DP Leads and key stakeholders, including onboarding, refresher training and capability-building initiatives.
12. Support policy communications, institutional campaigns and staff engagement initiatives to strengthen data protection culture.
13. Provide advisory support and respond to departmental queries relating to data protection compliance and governance.
14. Support institutional accreditation, audit, licensing and assurance activities relating to data protection and information management.
15. Support mandatory reporting and escalation requirements to NHG, MOH and PDPC where required.
16. Support administration of Data Loss Prevention (DLP) controls, investigations and whitelisting governance.
17. Support privacy, data protection, risk, and governance reviews for Artificial Intelligence (AI) and emerging technology initiatives, including the assessment of associated compliance, security and operational risks.

General

1. Support the annual departmental workplan and budgeting exercise.
2. Support procurement, contract management and budget monitoring for departmental initiatives where required.
3. Foster an environment of open communication, collaboration and teamwork across stakeholders.
4. Support the development, review and implementation of institutional policies, procedures, guidelines and frameworks relating to data protection.
5. Plan, drive and manage departmental and institution-level quality improvement initiatives.
6. Support the continuous improvement of institutional data protection governance, risk management and compliance practices.
7. Participate in relevant NHG, MOH and institutional workgroups, committees and projects.
8. Maintain accurate personal data inventories, data flow documentation, records, registers and governance documentation relating to data protection activities.
9. Perform any other duties assigned by the Director or Assistant Director, Data Protection Office