Data Protection Specialist

Overview

This position is located in the Global Privacy Office (GPO) at World Food Programme Headquarters in Rome, Italy. The incumbent will work either in Rome or remotely.

Under the supervision of the Global Data Protection Officer (DPO), the Data Protection Specialist provides technical and operational support to Headquarters as part of the Global Privacy Office, and contributes to the rollout of the Privacy Program across division-wide operations.

The deadline for applications is 16 December 2026-23:59-GMT+01:00 Central European Time (Rome).

Responsibilities

Key responsibilities include:

• Support the development, implementation, and operationalization of Data Protection and Privacy policies, governance mechanisms, procedures, and tools to maximize program efficiency and comprehensive rollout across divisions and offices.
• Review the existing policy and governance framework (e.g., policies, guidelines, and toolkits) and adapt it to the Privacy Program and corporate operational needs.
• Draft SOPs, position papers, and guidance; conduct legal research and documentation to stay current on global Data Protection developments, trends, and regulations and their impact in the humanitarian context (including topics such as biometrics, digital identities, blockchain, and big data).
• Provide consistent advice to Headquarters divisions, regional bureaus, and field offices on Data Protection and Privacy issues, identifying needs and priorities arising from the interpretation or application of WFP principles, policies, guidelines, relevant international standards, conventions, and best practices.
• Support operationalization of program elements such as privacy notices, PIAs, register of processing, LIAs, training and awareness campaigns, SARs, and data breach response mechanisms.
• Prepare and/or review Data Protection and Privacy agreements and contracts with public and private entities.
• Continuously improve systems, tools, processes, and templates to align with operational needs.
• Support the development of reporting mechanisms to monitor Data Protection and Privacy activities, identify risks and gaps, and support remediation.
• Document, track, and report program metrics and milestones for Privacy Program implementation.
• Prepare notes for the record, reports, memoranda, talking points, and correspondence as required.
• Conduct training and awareness activities as required.
• Perform other related duties as required.

Requirements

• Advanced university degree in a relevant discipline (including but not limited to law, computer science, information technology) or related field with relevant work experience.
• LLM or Master of Law on data protection, privacy, computer and communications law, compliance, international, digital or media law.
• At least 3 years of responsible professional experience in Data protection, Privacy, and Information Security in a law/consultancy firm and/or a large public/private sector organization.
• Experience implementing Privacy and Data Protection compliance programs, operations, and/or risk management programs in large corporations.
• Experience conducting PIAs, LIAs, maintaining records of processing activities, incident response management, and SARs mechanisms, and drafting contracts, SOPs, policies, and guidelines.
• Experience working in a global, large-scale, complex, and fast-paced environment.
• Experience delivering work with accuracy and quality, prioritizing, and meeting timelines.
• Ability to work autonomously with minimal supervision and as part of a team, including cooperation across regions and time zones.
• Experience working within a law firm and/or the United Nations system, or a similar international organization, is highly desirable.

Preferred Qualifications

• Knowledge of international security management systems industry standards (ISO 27001, ISO 27701, NIST…) is desired.

Knowledge & Skills

• In-depth knowledge of Data protection, Privacy, and Information Security regulations, international security standards, and key legal issues.
• Understanding of information technologies and their impact on the protection of personal data (e.g., privacy by design and by default, AI, big data, biometric technologies, digital identities, blockchain, and SNSs).
• Ability to identify Data Protection-related risks and gaps based on local legal environments, developments, and projects.
• Ability to contribute to large cross-functional projects.
• Strong analytical, interpersonal, communications, and presentational skills.
• Excellent drafting skills, including concise writing and synthesizing information from legal and jurisprudential sources.
• Demonstrated cultural sensitivity and diplomatic skills.
• Ability to work effectively with people of different national and cultural backgrounds.
• Strong planning and organization skills, confidentiality, and accountability.

Languages

• Fluency (level C) in English.
• Intermediate proficiency (level B) in an additional UN official language (Arabic, Chinese, French, Russian, Spanish) and/or the organization’s working language is desirable.

Compensation & Benefits

An attractive compensation package is offered. Please refer to the Terms and Conditions section of this vacancy announcement for details.

Equal Opportunity & Accessibility

The employer is committed to equal employment opportunity and encourages qualified candidates to apply irrespective of race, colour, national origin, ethnic or social background, genetic information, gender, gender identity and/or expression, sexual orientation, religion or belief, HIV status or disability.

Reasonable accommodation will be provided for individuals with disabilities throughout the recruitment process.

Additional Information

• Applications must be submitted exclusively through the organization’s online recruiting system. CVs or applications sent by email, LinkedIn, or any other channel are not considered.
• Required documents at the application stage are your CV and Cover Letter; additional documents may be requested later.
• Only shortlisted candidates will be contacted.
• All selected candidates will undergo reference and background checks.

Reminders on Fees & Disclosures

The United Nations does not charge any application, processing, training, interviewing, testing, or other fee connected with the application or recruitment process. If a fee request is received, it should be disregarded.