Compliance, Data Protection & Certification Manager

Value to HT: HT keeps its licences, registrations, four ISO certificates and a clean regulatory record while handling other people's most sensitive data, and turns that into the assurance evidence that wins clients outside the Group.

What the business gets

• One register of every obligation HT carries, each with an owner and evidence, so the business is never surprised by a regulator

• Data protection that bank, insurance and government clients audit and accept: impact assessments before go-live, processor agreements, breach handling on the 24- and 72-hour clocks

• Four ISO certificates that survive every surveillance audit, so the claims on HT's proposals are always backed

• One client assurance pack (certificates, policies, test summaries, SOC reports) that answers vendor due diligence in days: a direct enabler of the 25% external revenue target

• Licences, accreditations and tender certificates (e-invoicing, NITDA cloud, PenCom, NSITF) kept current, so no product or bid is blocked

Key accountabilities

1. Own the obligations register and compliance calendar across the NDPC, CBN (through bank clients), NITDA, NRS, ngCERT, PCI SSC, PenCom, NSITF, ITF and the CAC; monthly attestation from each owner.

2. Run the data protection programme with the DPO: registration, annual audit return, records of processing, impact assessments before high-risk processing, processor agreements with every client and sub-processor, transfer records and staff training.

3. Own the regulatory incident clocks (client notice; 24-hour CBN through bank clients; 72-hour ngCERT and NDPC); keep and drill the playbook with the CISO and Legal.

4. Plan and evidence data residency against the CBN circular and NITDA's sovereign data tiers before each deadline and market.

5. Run the integrated management system across ISO 27001, 9001, 22301 and 20000-1: internal audit programme, management reviews, corrective actions, Statement of Applicability and the role managers' calendar; host the annual surveillance audit and the 2028 recertification; lead the ISO 9001:2026 transition and the ISO 27001 scope extension.

6. Coordinate attestations with the CISO's team (SOC 2 Type II, SOC 1 readiness, PCI DSS service-provider readiness) and maintain the client assurance pack; answer due-diligence questionnaires within an agreed turnaround.

7. Run the policy cycle on the Policy Hub; check marketing and bid claims so HT only claims what is certified; issue a quarterly regulatory update to EMC, feeding the CRO's Board report.

Why now

• From 1 January 2027 HT holds payroll, health and loan data for seven companies and must meet data residency rules; e-invoicing licences carry uptime, testing and reporting conditions.

• External clients buy on certificates and attestations; one failed surveillance audit would put all four ISO certificates at risk, and the system is run by the CRO with no deputy.

External benchmark: NDPC fined Fidelity Bank ₦555.8m (2024), partly for reliance on non-compliant third-party processors, and MultiChoice ₦766.2m (2025); 1,369 firms are under review. ISO Survey 2024: 96,709 ISO 27001 certificates worldwide, increasingly required at tender.

Experience and qualifications

• 7+ years in compliance, data protection or management-system roles in a regulated technology company, fintech or bank

• Deep knowledge of the NDPA 2023 and GAID 2025; CBN and NITDA frameworks

• ISO/IEC 27001 Lead Auditor or Implementer; experience of at least one of ISO 9001, 22301 or 20000-1; SOC 2 or PCI DSS project experience

• NDPC-recognised DPO credential, CIPP/E or CIPM an advantage; legal training an advantage Risks it leads on

Framework categories: Regulatory, Compliance, Legal, Assurance

• Regulatory and legal landscape

• Data protection: classification, records management, loss prevention policy

• Policies, standards and programme reporting

• Certification and attestation management

• Workforce awareness and training

• Marketing and bid claims control

Strategy lines it protects

Reseller to operator; Group to external clients; Delivery to adviser.

Converge and e-invoicing ₦0.46bn; every regulated client contract; the certification clients rely on; the 25% external revenue target; fines of up to 2% of gross revenue avoided

Year-one deliverables

Every obligation has a named owner and evidence Q1 2027

Impact assessments complete for all high-risk processing Before go-live / Q1 2027

Annual data protection return filed; zero regulatory penalties 31 March 2027 / full year

Open ISO improvement points closed; surveillance audit passed with no major nonconformity Q2 2027 / July 2027

Client assurance pack live; questionnaires answered within 10 working days From Q2 2027

SOC 2 issued; SOC 1 and PCI DSS readiness plans agreed; ISO 9001:2026 plan 2027

Measures of success

• Obligations met on time: 100%

• High-risk processing with an impact assessment before go-live: 100%

• Major nonconformities at external audit: zero

• Client assurance requests answered on time: 90%

• Regulatory penalties: zero

Works with: DPO, Legal, HR, CISO, IMS role managers, certification body, Marketing and bid teams, external DPCO

Grows later with: IMS & Certification Officer (management system, surveillance audits, attestations, assurance pack) as external revenue and attestations grow.