Data Protection Officer (DPO) / DPCO - Remote

About the role

OraSave, part of Oracorp Investment Limited, a fintech company building Africa's digital financial ecosystem, is seeking an experienced Data Protection Officer (DPO) or an NDPC-licensed Data Protection Compliance Organisation (DPCO) to provide professional oversight of data protection, privacy compliance and governance. This is a remote, contract engagement focused on compliance with the Nigeria Data Protection Act 2023 (NDPA) and applicable regulatory requirements.

Key responsibilities

• Conduct NDPA 2023 compliance audits, baseline assessments and gap analyses
• Maintain data inventories, records of processing activities and data-flow maps
• Carry out Data Protection Impact Assessments (DPIAs) where applicable
• Identify privacy and data protection risks and recommend mitigations
• Review third-party data-processing arrangements, vendor agreements and payment service provider integrations
• Develop, review and maintain privacy policies, procedures and compliance documentation
• Advise on privacy-by-design during product development and platform upgrades
• Support breach detection, escalation, reporting and incident response; coordinate data subject access requests
• Provide data protection awareness and training, advise management on regulatory developments and run a 90-day compliance improvement programme

Required profile

• Current NDPC DPCO licence, or relevant professional qualifications and experience as an individual DPO
• Strong knowledge of the NDPA 2023 and NDPC regulations
• Demonstrable experience in data protection, privacy compliance and regulatory governance
• Previous experience in fintech, banking, payment services or other financial services
• Experience with privacy audits, data protection assessments and vendor risk reviews
• Relevant academic background (Law, Information Security, Compliance) and certifications such as CIPP, CIPM or CIPT are an advantage

The engagement is structured around deliverables: a 30-day assessment followed, by mutual agreement, a 90-day improvement and remediation programme. It is a remote consultancy or outsourced DPO arrangement, with fees and scope agreed with the client.