Data Protection Officer

Data Protection Officer — Yubi MENA

Location: Dubai, UAE (Regional coverage)

Reports to: Group CISO, Yubi Group, with direct access to Yubi MENA senior management and relevant Board/Board committee forums on data protection matters. The DPO shall operate independently in the performance of statutory DPO responsibilities and shall have appropriate access to information, resources and management necessary to fulfil those responsibilities.

Role Context

The Data Protection Officer (DPO) is accountable for Yubi MENA's data protection and privacy programme across its debt marketplace, lending, and financial services platforms. The role holder will serve as Yubi MENA's regional Data Protection Officer, including fulfilling statutory DPO obligations where required under applicable UAE, DIFC, ADGM, KSA and other MENA data protection regimes., and other applicable data protection regimes across the jurisdictions in which Yubi MENA operates (including ADGM and Saudi Arabia's PDPL, where relevant). Given the sensitivity of the financial, credit, and KYC data Yubi processes on behalf of borrowers, lenders, and institutional clients, this role is central to maintaining regulatory trust, platform integrity, and customer confidence.

Determines and advises on Yubi's role as Controller, Processor, Joint Controller or Sub-processor for material processing activities, and ensures appropriate contractual, governance and accountability arrangements are established. The Data Protection Officer (DPO) is a senior compliance role accountable for Yubi MENA's data protection and privacy programme across its debt marketplace, lending, and financial services platforms.

The role holder will serve as Yubi MENA's Regional Data Protection Officer, including fulfilling statutory DPO obligations where required under applicable UAE, DIFC, ADGM, KSA and other MENA data protection regimes. Given the sensitivity of the financial, credit, and KYC data Yubi processes on behalf of borrowers, lenders, and institutional clients, this role is central to maintaining regulatory trust, platform integrity, and customer confidence.

The DPO determines and advises on Yubi's role as Controller, Processor, Joint Controller or Sub-processor for material processing activities, and ensures appropriate contractual, governance and accountability arrangements are established.

The DPO provides expert privacy advice to the MENA leadership team, Legal & Compliance, Technology, and business units, and acts as the primary liaison with regional data protection authorities.

Key Accountabilities

Strategic Contribution

• Develops and drives Yubi MENA's data protection strategy, aligned to regional regulatory requirements (UAE PDPL, DIFC Law, ADGM, KSA PDPL) and Yubi's growth plans across the debt and credit marketplace.
• Builds a privacy framework that scales with Yubi's expansion into new products (lending, supply chain finance, co-lending) and new GCC markets.
• Promotes a culture of privacy-by-design across product, engineering, credit, and operations teams.
• Establishes and operates privacy-by-design and privacy-by-default review gates within the product development lifecycle for new products, material feature changes, new processing purposes, data integrations and high-risk use cases.
• Advises leadership on privacy risk exposure tied to sensitive financial and credit data.
• Maintains a regional privacy risk register and establishes measurable privacy KRIs/KPIs covering regulatory compliance, DPIA coverage, data-subject rights performance, incidents, retention exceptions, third-party privacy risk, cross-border transfer exposure and remediation status.

Leadership & Regulatory Engagement

• Serves as the primary point of contact for the UAE's Data Office, DIFC Commissioner of Data Protection, and other applicable regulators, as well as for data subjects (borrowers, lenders, guarantors). Serves as the primary point of contact for applicable data protection authorities, including the UAE Data Office, DIFC Commissioner of Data Protection and relevant ADGM/KSA authorities, as applicable, and acts as an escalation point for data protection matters involving borrowers, lenders, guarantors and other data subjects.
• Leads breach and incident response, coordinating with Technology, Risk, and Legal, and reporting to leadership within statutory notification windows. Provides privacy regulatory oversight during personal-data incidents, coordinating with Technology, Security, Risk and Legal on assessment, notification thresholds, regulatory notifications, data-subject communications and remediation within applicable statutory timelines.
• Acts as an escalation point for privacy complaints and complex data subject requests.
• Coordinates with counterparts in Yubi's India/global privacy function to