Group Data Protection Officer | M-KOPA

Remote (covering Kenya, Uganda, Nigeria, Ghana, South Africa and the UK)

You’re respected where you are. Regulators take your calls, your board reads your reports, and your privacy programme probably runs well. But when did your work last decide whether millions of people could get credit for the first time?

Most DPO roles protect an organisation from risk. This one does that too, and it also determines how responsibly a financial inclusion business uses data to serve people the formal banking system overlooked.

Where M-KOPA is today

M-KOPA now serves 10 million customers, up from 5 million in 2024. We have unlocked $2+ billion in credit, and 86% of customers report an improved quality of life. 70% use our products to generate income, and 55% are accessing products and services for the first time. We employ 2,300+ people, work with 35,000 agents, have contributed $45 million in taxes, and have assembled 2 million smartphones in Kenya.

Why this timing matters

If you’ve seen us advertising several roles, that’s deliberate. We’re building the foundations for the journey to supersede the 10 million customers. Every new market, product and data partnership raises the stakes on privacy. We want the person who sets the standard to be in place before that growth, not after it.

What makes this different

• Your current role: Advising on privacy after decisions are made. This role: Embedding privacy by design into AI, profiling, automated decision-making, device and location data, and partnerships while products are still being shaped.

• Your current role: One regulator, one legal regime. This role: Six markets with different frameworks, from GDPR and UK GDPR to regimes in emerging markets, and one coherent Group programme across them.

• Your current role: Compliance measured by absence of incidents. This role: Compliance measured by customer trust, because 10 million people hand us their data to access credit and products they couldn’t get elsewhere.

What you’ll actually do

You will lead M-KOPA’s privacy programme and the in-house team that runs it. You’ll own Records of Processing Activities, Data Protection Impact Assessments, Transfer Impact Assessments and our path to ISO 27701 certification. You will be the principal contact for data protection regulators across every market, handling complaints, investigations, registrations and formal correspondence.

You’ll also lead the response when something goes wrong. You will work with Information Security on breach risk assessment, regulator and individual notification within statutory timelines, and the root-cause work afterwards. In the same week you might negotiate a data processing agreement with a vendor, advise product teams on a new AI-driven feature, and brief executive leadership on risk through privileged reporting to the Group General Counsel.

You’ll also build a culture: training plans, awareness programmes, and smarter use of automation and responsible AI tools in privacy processes.

What you bring

• Extensive progressive experience in data protection compliance, with deep working knowledge of GDPR and UK GDPR, laws modelled on them, and regimes across multiple jurisdictions including emerging markets, plus standards such as ISO/IEC 27001, ISO 27701 and the NIST Privacy Framework.

• A proven track record of implementing privacy programmes in multinational organisations, applying data protection requirements to AI, profiling and automated decision-making, and managing incidents and breaches through to regulator notification.

• Demonstrable experience reporting to senior leadership or a Board, and leading and developing a multi-location team of data protection professionals. A qualification to practise law is preferred but not essential.

The reality check

This role is demanding. You’ll work across time zones and regulators, with real accountability when incidents occur. It requires the judgement to say “yes, and here’s how” far more often than “no.” If you’ve been doing that quietly well in an environment where privacy is seen as a cost, you’re probably ready for exactly this.

Ready to talk?

If you’re reading this and thinking “that’s the job I’d design for myself,” that’s probably the signal to explore it. Let’s have a conversation.

Why M-KOPA?

At M-KOPA, we empower our people to own their careers through diverse development programs, coaching partnerships, and on-the-job training. We support individual journeys with family-friendly policies, prioritize well-being, and embrace flexibility.

Join us in shaping the future of M-KOPA as we grow together. Explore more at m-kopa.com.

Recognized four times by the Financial Times as one Africa's fastest growing companies (2022, 2023, 2024, 2025 and 2026), named on CNBC's World’s Top Fintech Companies 2025 & 2026 and by TIME100 Most influential companies in the world 2023 and 2024 , we've served over 10 million customers, unlocking $2 billion in cumulative credit for the everyday earners across Africa, in addition to over 10,000 e-bikes financed in Kenya.

Important Notice

M-KOPA is an equal opportunity and affirmative action employer committed to assembling a diverse, broadly trained staff. Women, minorities, and people with disabilities are strongly encouraged to apply.

M-KOPA explicitly prohibits the use of Forced or Child Labour and respects the rights of its employees to agree to terms and conditions of employment voluntarily, without coercion, and freely terminate their employment on appropriate notice. M-KOPA shall ensure that its Employees are of legal working age and shall comply with local laws for youth employment or student work, such as internships or apprenticeships.

M-KOPA does not collect/charge any money as a pre-employment or post-employment requirement. This means that we never ask for ‘recruitment fees’, ‘processing fees’, ‘interview fees’, or any other kind of money in exchange for offer letters or interviews at any time during the hiring process.

Applications for this position will be reviewed on a rolling basis. Shortlisting and interviews will take place at any stage during the recruitment process. We reserve the right to close the vacancy early if a suitable candidate is selected before the advertised closing date.

If your application is successful M-KOPA undertakes pre-employment background checks as part of its recruitment process, these include; criminal records, identification verification, academic qualifications, employment dates and employer references.