Manager - DPO Services - Consulting (m/f/d)

Job Description

We are seeking a Manager to join our Advisory and Consulting practice. You will report to the leadership of KPMG Advisory and Consulting.

As part of our established and growing team, you will lead projects that place technology-related regulatory compliance at their core and act as a trusted point of contact for clients’ senior management, DPOs and compliance and legal functions. You will serve leading banks, asset managers, alternative investment fund managers and insurance companies across Luxembourg and Europe, as well as EU institutions.

What you will be working on1. Data protection support

Lead GDPR compliance projects to help clients strengthen their data protection frameworks and practices. Your responsibilities will include:

• Leading GDPR compliance maturity assessments and defining remediation roadmaps

• Overseeing the review and maintenance of Records of Processing Activities (RoPA)

• Drafting, reviewing and updating data protection policies and procedures, and ensuring the quality of deliverables

• Advising clients on the handling of complex data subject rights requests

• Advising clients on personal data breach assessments, including notification decisions and follow-up

• Leading Data Protection Impact Assessments (DPIAs)

• Reviewing data processing agreements (DPAs) and transfer impact assessments (TIAs

2. Data governance and management

Lead transformation and regulatory compliance projects relating to data governance, in particular the retention and deletion of personal data.

You will consider both governance and technical perspectives, including:

• Designing data retention and deletion frameworks and policies

• Designing target operating models

• Overseeing the preparation and maintenance of data and third-party inventories

• Defining data governance practices, roles and responsibilities

• Addressing structured and unstructured data environments

• Helping clients align their governance documentation with their operational and technical practices

3. Regulatory analysis

Lead regulatory analyses of applicable European regulations and Luxembourg law in connection with transformation projects involving new technologies.

Your responsibilities will include:

• Leading the analysis of regulatory requirements applicable to clients’ activities, projects and technology environments, and assessing their potential impact on business processes and governance arrangements

• Translating legal and regulatory requirements into clear operational, governance and technical actions and controls

• Identifying compliance gaps, defining practical remediation roadmaps and monitoring their implementation

Your work may cover regulatory frameworks such as the GDPR, Regulation (EU) 2018/1725 for EU institutions, the AI Act, the Data Act, DORA and other EU digital regulations.

4. Market and business development

Your responsibilities will include:

• Monitoring relevant regulatory developments and leading knowledge sharing within the team, including updates on Luxembourg and EU legislative procedures, EDPB guidelines and opinions, EDPS opinions on legislative proposals, and CNPD, CSSF and other supervisory authorities’ publications

• Developing thought leadership on data protection and digital regulation through publications, events and client sessions

• Collaborating with KPMG professionals across different disciplines and member firms to develop solutions that address clients’ needs

• Leading proposal preparation, contributing to pricing and developing client relationships and networks to generate new business opportunities

5. Engagement and people management

Your responsibilities will include:

• Managing engagements end to end, including planning, budget, staffing, quality and risk management

• Acting as the day-to-day point of contact for clients and building trusted relationships at senior level

• Leading, coaching and developing team members, and contributing to performance reviews and recruitment

• Contributing to the development of the Technology & Risk service offering, methodologies and tools

What we look for

• At least six years of experience in consulting, business analysis or project management, with a strong focus on data protection and a genuine interest in the impact of technology

• A proven track record of leading GDPR compliance projects end to end, ideally for financial sector clients

• A strong understanding of regulatory requirements and their impact on business processes and governance arrangements

• Experience with other EU digital regulations, such as the AI Act or the Data Act, would be a strong advantage

• Experience managing project budgets, teams and client relationships, and contributing to business development

• Strong analytical, presentation and communication skills, with the ability to engage with senior management and governing bodies

• An entrepreneurial, collaborative and client-focused mindset, with the ability to inspire and develop teams

• Fluency in English; proficiency in French or German would be an advantage

• A master’s degree in law, economics, finance or a related field

• A recognised data protection certification such as CIPP/E or CIPM would be an advantage