Compliance, Data Protection & Certification Manager at Heirs Holdings

Key accountabilities

• Own the obligations register and compliance calendar across the NDPC, CBN (through bank clients), NITDA, NRS, ngCERT, PCI SSC, PenCom, NSITF, ITF and the CAC; monthly attestation from each owner.
• Run the data protection programme with the DPO: registration, annual audit return, records of processing, impact assessments before high-risk processing, processor agreements with every client and sub-processor, transfer records and staff training.
• Own the regulatory incident clocks (client notice; 24-hour CBN through bank clients; 72-hour ngCERT and NDPC); keep and drill the playbook with the CISO and Legal.
• Plan and evidence data residency against the CBN circular and NITDA's sovereign data tiers before each deadline and market.
• Run the integrated management system across ISO 27001, 9001, 22301 and 20000-1: internal audit programme, management reviews, corrective actions, Statement of Applicability and the role managers' calendar; host the annual surveillance audit and the 2028 recertification; lead the ISO 9001:2026 transition and the ISO 27001 scope extension.
• Coordinate attestations with the CISO's team (SOC 2 Type II, SOC 1 readiness, PCI DSS service-provider readiness) and maintain the client assurance pack; answer due-diligence questionnaires within an agreed turnaround.
• Run the policy cycle on the Policy Hub; check marketing and bid claims so HT only claims what is certified; issue a quarterly regulatory update to EMC, feeding the CRO's Board report.

Why now

• From 1 January 2027 HT holds payroll, health and loan data for seven companies and must meet data residency rules; e-invoicing licences carry uptime, testing and reporting conditions.
• External clients buy on certificates and attestations; one failed surveillance audit would put all four ISO certificates at risk, and the system is run by the CRO with no deputy.
• External benchmark: NDPC fined Fidelity Bank ₦555.8m (2024), partly for reliance on non-compliant third-party processors, and MultiChoice ₦766.2m (2025); 1,369 firms are under review. ISO Survey 2024: 96,709 ISO 27001 certificates worldwide, increasingly required at tender.

Experience and qualifications

• 7+ years in compliance, data protection or management-system roles in a regulated technology company, fintech or bank
• Deep knowledge of the NDPA 2023 and GAID 2025; CBN and NITDA frameworks
• ISO/IEC 27001 Lead Auditor or Implementer; experience of at least one of ISO 9001, 22301 or 20000-1; SOC 2 or PCI DSS project experience
• NDPC-recognised DPO credential, CIPP/E or CIPM an advantage; legal training an advantage Risks it leads on
• Framework categories: Regulatory, Compliance, Legal, Assurance
• Regulatory and legal landscape
• Data protection: classification, records management, loss prevention policy
• Policies, standards and programme reporting
• Certification and attestation management
• Workforce awareness and training
• Marketing and bid claims control