Data Protection Specialist

Purpose

As a Data Protection Specialist, you will be responsible for the implementation of the GDPR and the Group’s Data Protection Policy and Procedures for the Bank and Group Companies (Domestic and International). You will support the Data Protection Office in safeguarding personal data, ensuring compliance with regulatory and legal frameworks, and providing expertise on data protection matters across the organization.

What you will be doing

• Support the Data Protection Office in implementing GDPR and the Group’s Data Protection Policy and Procedures
• Draft, review and update privacy policies, procedures and notices for employees, customers, and third parties, ensuring alignment with Group and local regulatory requirements
• Monitor controls, KPIs, KRIs and maintain the Register of Processing Activities, ensuring compliance with GDPR principles such as lawfulness, fairness, transparency, data minimization, integrity and accountability
• Conduct Data Protection Impact Assessments (DPIAs), handle data breach notifications, record them in the Data Breach Register, and check responses to data subject requests
• Review and advise on Data Processing Agreements, new projects (e.g. cloud, digital applications, cross-border transfers) and provide legal assessments to ensure compliance with GDPR and related legislation
• Stay up to date with new laws, regulations and guidance (e.g. outsourcing, DORA, EDPB recommendations) and incorporate relevant changes into policies and practices
• Deliver training, guidance and awareness sessions to Business Areas and collaborate with Group subsidiaries to harmonize practices across the Bank
• Work closely with IT, Cybersecurity and other teams to assess risks, advise on mitigating measures and support secure and compliant data processing

What you need to have

• A Bachelor’s degree in Law from a recognized university and a lawyer’s license to practice law in Greece
• A Master’s degree or certification in Data Protection, GDPR, or Technology Law (preferred)
• At least five (5) years of proven experience in GDPR matters, including contract management, cross-border data transfers, incident management, handling customer complaints/requests, knowledge of outsourcing and DORA legislation, and familiarity with complex texts and recommendations from regulatory bodies such as EDPB
• Excellent command of Greek and English, both written and spoken
• Strong analytical thinking and attention to detail
• Ability to work autonomously, take initiative, and manage multiple projects and deadlines
• Ability to collaborate effectively with technical teams (IT, Cybersecurity) to understand and mitigate technology-related risks
• Professionalism, integrity, and confidentiality in handling sensitive matters