Experienced Data Protection and Privacy expert

The role focuses on: Assessment & implementation Plan: A clear baseline, overview of actions and risk based priorities; Stakeholder management: Drive stakeholder alignment, ensure sufficient priority and progress, create an overview of dependencies and priorities; Operating Model & Governance: Clear roles, responsibilities, ownership, decision-making processes and reporting structures defined; Risk & Gap Analysis: Compliance gaps, privacy risks and control weaknesses are identified.

Mitigation actions with accountable owners are agreed upon; Work Instructions & Controls: Practical procedures, controls and guidance are developed and/or updated to ensure consistent and compliant execution of all actions and requirements; Assessments: Support the maintenance and improvement of key data protection requirements and risk assessments such as maintaining a record of processing activities, implementing privacy by design, reviewing DPIA’s and LIA’s; Implementation & Adoption: Collaborate with Tribes and 1LoD and 2 LoD teams across the organisation, identify of scalable solutions and ways to work smarter.

Embed new ways of working and ensure operational adoption across relevant teams; Knowledge Transfer & Sustainability: Identify the need for guidance, transfer knowledge where needed, align relevant interpretations of legal obligations and requirements. Document relevant decisions and considerations and alignment; Final Handover Report: Deliver a comprehensive overview of achievements, remaining risks, recommendations and actions required for long-term ownership and compliance.

The ideal candidate brings a Bachelor's or Master's degree, preferably in Law; demonstrable expertise in GDPR and privacy-related regulation, supported by relevant certifications; proven experience translating regulatory requirements into operational processes, controls and practical business solutions; strong organizational sensitivity and the ability to balance regulatory, business and operational considerations; at least 7 years of experience in data protection, privacy, compliance or risk management; experience operating in a highly regulated environment, preferably within financial services; strong influencing and stakeholder management skills; the confidence and professional resilience to challenge decisions when required; an autonomous working style; excellent written and verbal communication skills in both Dutch and English; a pragmatic mindset; familiarity with ING's organization and governance structure is considered a strong advantage.