Data Protection Officer

LCKY Group•Malta, MT

About The Position

The Data Protection Officer will oversee and support data protection compliance across LCKY Group, helping ensure that personal data is processed responsibly and in accordance with the GDPR and other applicable privacy legislation. Working with Legal, Compliance, IT, Information Security, Marketing, Customer Support, HR and other business functions, the DPO will provide practical guidance on privacy risks and help embed privacy considerations into business processes, products and operations. The role covers the data protection lifecycle for customer and employee data, marketing activities, digital products, data sharing, third-party relationships and international operations. It combines technical knowledge of data protection legislation with a pragmatic, business-oriented approach. The DPO will establish and maintain data protection governance and compliance practices; assess privacy risks and advise on privacy by design; guide customer-data operations and data-subject rights; coordinate responses to personal data breaches and regulatory enquiries; and deliver training, stakeholder advice and compliance reporting. The role also involves collaborating with internal teams and external advisers on complex or cross-border privacy matters.

Requirements

Degree in Law, Data Protection, Compliance or a related discipline.
Demonstrable experience in data protection, privacy compliance or a related legal or regulatory role.
Strong knowledge of the GDPR and practical experience applying data protection requirements in a business environment.
Understanding of data protection challenges in online gaming, digital platforms, e-commerce, financial services or other regulated industries.
Experience with DPIAs, data mapping, data subject requests, breach management, privacy policies and third-party data processing arrangements.
Ability to interpret legal requirements and translate them into clear, practical business recommendations.
Strong analytical, organisational and stakeholder management skills.
Excellent written and verbal English, with the ability to communicate complex topics clearly to non-specialists.

Nice To Haves

Previous experience as a formally appointed DPO or in a dedicated privacy role.
Experience within the iGaming industry or another highly regulated, international business.
Professional certification such as CIPP/E, CIPM or an equivalent data protection qualification.
Familiarity with international data transfers, digital marketing, customer profiling and privacy considerations relating to emerging technologies.
Experience working across multiple jurisdictions and business entities.

Responsibilities

Develop, implement and maintain the Group's data protection policies, procedures, guidelines and internal controls.
Monitor compliance with the GDPR and other applicable data protection and privacy requirements across relevant entities and markets.
Maintain and oversee records of processing activities and support an effective data protection governance framework.
Monitor regulatory developments and assess their potential impact on Group operations, products and customer-facing activities.
Advise stakeholders on data protection obligations and support appropriate remedial actions.
Conduct and oversee Data Protection Impact Assessments (DPIAs), legitimate interest assessments and other applicable privacy risk assessments.
Advise on privacy-by-design and privacy-by-default principles for products, systems, processes and marketing activities.
Review data processing agreements, vendor arrangements, data-sharing agreements and international data transfers with Legal and relevant stakeholders.
Support assessments of new technologies and data-driven initiatives, including customer analytics, personalisation and AI-enabled tools.
Advise on data protection in customer account management, identity verification, payment-related processes, customer support and responsible gambling activities where personal data is involved.
Advise on lawful use of customer data for marketing, promotions, segmentation and personalised communications.
Support handling data subject requests, including access, erasure, objection and other applicable rights.
Assess privacy considerations relating to player profiling, automated decision-making and sensitive personal data where applicable.
Work with Compliance, Information Security and operational teams to consider data protection alongside gaming and regulatory obligations.
Coordinate responses to personal data breaches with Information Security, Legal and relevant business teams, including risk assessment and notification requirements.
Act as a contact point for data subjects and supervisory authorities on personal data processing matters as required.
Support investigations, regulatory enquiries and communications relating to data protection.
Maintain documentation of incidents, decisions, risk assessments and corrective actions.
Develop and deliver data protection training and awareness initiatives across the Group.
Provide practical stakeholder advice and promote accountability and responsible data handling.
Conduct periodic compliance reviews and report data protection risks, findings and improvement actions to senior management.
Collaborate with internal teams and external advisers on complex or cross-border privacy matters.