Data Privacy Manager/ Senior Manager

Job details

BKC, Mumbai

Essential: LL.B / LL.M (specialization in Tech Law preferred)

B.E./B.Tech/MBA with significant demonstrable experience in Privacy Program Management.

Desirable: Preferred Certifications: CIPP/E, CIPP/A, CIPM, or CIPT (IAPP).

Total Experience: 5–7 years in Compliance, Legal, or Information Security.

Core Privacy Experience: Minimum 4+ years dedicated to Data Privacy.

Implementation Experience: Must have hands-on experience implementing privacy frameworks (GDPR, ISO 27701, or SPDI Rules) from scratch.

1. DPDPA Implementation Strategy (The "From Scratch" Build)

Gap Analysis: Conduct a comprehensive organization-wide gap analysis against DPDPA 2023 requirements and existing data practices.
Data Mapping & ROPA: Lead the discovery phase to create a dynamic Record of Processing Activities (ROPA). Map data lifecycles across all business verticals (Demat, PAN, e-Governance services).
Policy Architecture: Draft and finalize internal Privacy Policies, Data Retention Policies, and Data Breach Response procedures tailored to the new Act.

2. Consent Architecture & Rights Management

Consent Management: Design the technical and legal workflow for obtaining "Verifiable Consent." Collaborate with IT to integrate with Consent Managers as defined in the Act.
Notice Management: Redraft privacy notices (Itemised Notice) to ensure they are available in English and 22 scheduled Indian languages as mandated.
Grievance Redressal: Set up the "Consent Withdrawal" and "Grievance Redressal" mechanisms for Data Principals (investors/clients) ensuring strict SLA adherence.

3. Significant Data Fiduciary (SDF) Obligations

DPIA: Establish a framework for and conduct periodic Data Protection Impact Assessments (DPIAs) for high-risk processing activities.
Audit Readiness: Act as the point of contact for the Independent Data Auditor (IDA) and ensure readiness for periodic privacy audits.

4. Vendor & Third-Party Risk Management

Review and renegotiate contracts with all Data Processors to ensure flow-down clauses regarding liability and security safeguards are legally binding under the new Act.

5. Training & Culture

Drive the "Privacy Culture" change. Conduct role-based training for employees, specifically targeting IT, Operations, and Customer Support teams regarding their obligations under DPDPA.