Compliance, Data Protection & Certification Manager

Value to HT: HT keeps its licences, registrations, four ISO certificates and a clean regulatory record while handling other people's most sensitive data, and turns that into the assurance evidence that wins clients outside the Group.

What the business gets

• One register of every obligation HT carries, each with an owner and evidence, so the business is never surprised by a regulator

• Data protection that bank, insurance and government clients audit and accept: impact assessments before go-live, processor agreements, breach handling on the 24- and 72-hour clocks

• Four ISO certificates that survive every surveillance audit, so the claims on HT's proposals are always backed

• One client assurance pack (certificates, policies, test summaries, SOC reports) that answers vendor due diligence in days: a direct enabler of the 25% external revenue target

• Licences, accreditations and tender certificates (e-invoicing, NITDA cloud, PenCom, NSITF) kept current, so no product or bid is blocked

Key accountabilities

• Own the obligations register and compliance calendar across the NDPC, CBN (through bank clients), NITDA, NRS, ngCERT, PCI SSC, PenCom, NSITF, ITF and the CAC; monthly attestation from each owner.

• Run the data protection programme with the DPO: registration, annual audit return, records of processing, impact assessments before high-risk processing, processor agreements with every client and sub-processor, transfer records and staff training.

• Own the regulatory incident clocks (client notice; 24-hour CBN through bank clients; 72-hour ngCERT and NDPC); keep and drill the playbook with the CISO and Legal.

• Plan and evidence data residency against the CBN circular and NITDA's sovereign data tiers before each deadline and market.

• Run the integrated management system across ISO 27001, 9001, 22301 and 20000-1: internal audit programme, management reviews, corrective actions, Statement of Applicability and the role managers' calendar; host the annual surveillance audit and the 2028 recertification; lead the ISO 9001:2026 transition and the ISO 27001 scope extension.

• Coordinate attestations with the CISO's team (SOC 2 Type II, SOC 1 readiness, PCI DSS service-provider readiness) and maintain the client assurance pack; answer due-diligence questionnaires within an agreed turnaround.

• Run the policy cycle on the Policy Hub; check marketing and bid claims so HT only claims what is certified; issue a quarterly regulatory update to EMC, feeding the CRO's Board report.

Why now

• From 1 January 2027 HT holds payroll, health and loan data for seven companies and must meet data residency rules; e-invoicing licences carry uptime, testing and reporting conditions.

• External clients buy on certificates and attestations; one failed surveillance audit would put all four ISO certificates at risk, and the system is run by the CRO with no deputy.

External benchmark: NDPC fined Fidelity Bank ₦555.8m (2024), partly for reliance on non-compliant third-party processors, and MultiChoice ₦766.2m (2025); 1,369 firms are under review. ISO Survey 2024: 96,709 ISO 27001 certificates worldwide, increasingly required at tender.

Experience and qualifications

• 7+ years in compliance, data protection or management-system roles in a regulated technology company, fintech or bank

• Deep knowledge of the NDPA 2023 and GAID 2025; CBN and NITDA frameworks

• ISO/IEC 27001 Lead Auditor or Implementer; experience of at least one of ISO 9001, 22301 or 20000-1; SOC 2 or PCI DSS project experience

• NDPC-recognised DPO credential, CIPP/E or CIPM an advantage; legal training an advantage Risks it leads on

Framework categories: Regulatory, Compliance, Legal, Assurance

• Regulatory and legal landscape

• Data protection: classification, records management, loss prevention policy

• Policies, standards and programme reporting

• Certification and attestation management

• Workforce awareness and training

• Marketing and bid claims control

Strategy lines it protects

Reseller to operator; Group to external clients; Delivery to adviser.

Converge and e-invoicing ₦0.46bn; every regulated client contract; the certification clients rely on; the 25% external revenue target; fines of up to 2% of gross revenue avoided

Year-one deliverables

Every obligation has a named owner and evidence Q1 2027

Impact assessments complete for all high-risk processing Before go-live / Q1 2027

Annual data protection return filed; zero regulatory penalties 31 March 2027 / full year

Open ISO improvement points closed; surveillance audit passed with no major nonconformity Q2 2027 / July 2027

Client assurance pack live; questionnaires answered within 10 working days From Q2 2027

SOC 2 issued; SOC 1 and PCI DSS readiness plans agreed; ISO 9001:2026 plan 2027

Measures of success

• Obligations met on time: 100%

• High-risk processing with an impact assessment before go-live: 100%

• Major nonconformities at external audit: zero

• Client assurance requests answered on time: 90%

• Regulatory penalties: zero

Works with: DPO, Legal, HR, CISO, IMS role managers, certification body, Marketing and bid teams, external DPCO

Grows later with: IMS & Certification Officer (management system, surveillance audits, attestations, assurance pack) as external revenue and attestations grow.