About the Department

The Data Protection (DP) Unit plays a central role in supporting and monitoring the Authority’s compliance with applicable data protection laws, including the General Data Protection Regulation (GDPR), and fosters a culture of privacy across the Authority by advising on the lawful, fair, transparent, and secure processing of personal data. The Unit monitors compliance with data protection legislation and supports the handling of data subject rights requests within statutory timeframes. It also contributes to the development and review of internal policies, procedures, and contractual arrangements involving personal data, and advises and supports incident response in the event of a personal data breach, including investigation, containment, and notification obligations where required. In line with Article 39 GDPR, the DP Unit acts independently and serves as a key point of contact on matters relating to data protection, thereby fostering accountability and maintaining trust in the Authority’s processing of personal data.

About the Role

The responsibilities of the eventual appointee shall include the following:

Maintain, review, and enhance the Authority’s Records of Processing Activities;

Monitor compliance with applicable data protection legislation, internal policies, and established data protection standards, and escalate risks, gaps, and recommendations to the Data Protection Officer;

Provide informed advice and guidance to internal stakeholders on the interpretation and practical application of data protection laws;

Advise on and monitor the conduct of Data Protection Impact Assessments (DPIAs), ensuring that high-risk processing activities are properly assessed and that identified mitigation measures are documented and followed up;

Oversee and coordinate the handling of data subject rights requests (including access, rectification and erasure), ensuring compliance with statutory deadlines and procedural requirements;

Review and advise on Data Processing Agreements (DPAs), data sharing arrangements, and other contractual instruments involving the processing or transfer of personal data, ensuring appropriate safeguards are incorporated;

Provide guidance on the application of privacy by design and privacy by default principles in projects, systems, and operational processes involving personal data;

Support and advise on personal data breach management, including breach assessment, documentation, coordination of containment measures, and preparation of notifications to the supervisory authority and/or affected data subjects where required;

Serve as a point of contact for internal stakeholders on data protection;

Contribute to the development and periodic review of data protection policies, procedures, training, and awareness initiatives to promote accountability and a strong data protection culture across the Authority;

Undertake any other duties as assigned by the Data Protection Officer or Senior Management and/or as may be required by the MFSA from time to time based on the exigencies of the Authority.

About you

Qualification at MQF Level 6 or equivalent qualification in Law, Information Technology or Computer Science or in a closely related field and in possession of a recognised Privacy Certification focusing on the General Data Protection Regulation.

A minimum of 5 years relevant experience, preferably within the financial services sector or in fields involving extensive personal data processing and compliance. Candidates without the necessary formal academic qualifications and minimum years’ experience but with at least 10 years of substantial relevant experience will also be considered.

Skills and competencies:

Strong knowledge of data protection laws, GDPR requirements, and related regulatory frameworks.

Knowledge of IT systems, data flows, and information security concepts, sufficient to assess technical and organisational risks during Data Protection Impact Assessments.

Proven ability to provide independent advice and guidance on data protection matters, monitor compliance, and support data protection accountability.

Analytical and detail-oriented, with the ability to assess risks, review processing activities, evaluate system designs, and interpret legal and regulatory requirements.

Experience or aptitude in reviewing IT architectures, databases, cloud services, software applications, and data sharing arrangements in the context of impact assessments.

Ability to communicate findings clearly to both technical and non-technical stakeholders, including project owners.

High level of integrity, discretion, and professional judgment when handling sensitive personal data and confidential information.

Competence in handling data subject rights requests, reviewing contractual agreements, and assisting with personal data breach management.

Excellent report writing and presentation skills.

Other Important Information

The MFSA is an Equal Opportunities Employer as certified by the NCPE (National Commission for the Protection of Equality) and is committed to a policy of equal opportunity in all aspects of employment and will take care to avoid any form of discrimination in its recruitment procedures. The MFSA reserves the right to withdraw this call at any time and not to select any of the Candidates.

It is the responsibility of applicants in possession of qualifications awarded by Universities and other similar institutions outside Malta to produce a recognition statement on comparability of qualifications issued by the Malta Qualifications Recognition Information Centre (MQRIC). Applicants should do so preferably at application stage or otherwise at the preliminary interview should an applicant be selected for such interview. Details can be obtained by accessing the National Commission for Further and Higher Education website on www.ncfhe.gov.mt under MQRIC heading.

The MFSA shall ensure that any processing of personal data is in accordance with Regulation (EU) 2016/679 (General Data Protection Regulation), the Data Protection Act (Chapter 586 of the Laws of Malta) and any other relevant European Union and national law. For further details, you may refer to the Data Protection Policy on the MFSA webpage www.mfsa.mt. Candidates are to note that the submission of any false statement/s or omission, even if unintended, may lead to the cancellation of their application and may render the candidate's appointment liable to termination.

Furthermore, please note that candidates may be asked to submit any documentation in support of the information provided, including but not limited to, proof of qualifications and Police Conduct Certificates.

Public Call Permit: 223/2026

Senior Analyst (Data Protection)

Job Description