Data Privacy Manager/ Senior Manager

By admin, 27 April, 2026
Position

Data Privacy Manager/ Senior Manager

Role

Data Privacy Manager/ Senior Manager

CTA Text
Job Description
Location

BKC, Mumbai

Qualification

Essential: LL.B / LL.M (specialization in Tech Law preferred)

OR

B.E./B.Tech/MBA with significant demonstrable experience in Privacy Program Management.

Desirable: Preferred Certifications: CIPP/E, CIPP/A, CIPM, or CIPT (IAPP).

Experience

Total Experience: 5–7 years in Compliance, Legal, or Information Security.

 

Core Privacy Experience: Minimum 4+ years dedicated to Data Privacy.

Implementation Experience: Must have hands-on experience implementing privacy frameworks (GDPR, ISO 27701, or SPDI Rules) from scratch.

Job Description

1. DPDPA Implementation Strategy (The "From Scratch" Build)

  • Gap Analysis: Conduct a comprehensive organization-wide gap analysis against DPDPA 2023 requirements and existing data practices.
  • Data Mapping & ROPA: Lead the discovery phase to create a dynamic Record of Processing Activities (ROPA). Map data lifecycles across all business verticals (Demat, PAN, e-Governance services).
  • Policy Architecture: Draft and finalize internal Privacy Policies, Data Retention Policies, and Data Breach Response procedures tailored to the new Act.

2. Consent Architecture & Rights Management

  • Consent Management: Design the technical and legal workflow for obtaining "Verifiable Consent." Collaborate with IT to integrate with Consent Managers as defined in the Act.
  • Notice Management: Redraft privacy notices (Itemised Notice) to ensure they are available in English and 22 scheduled Indian languages as mandated.
  • Grievance Redressal: Set up the "Consent Withdrawal" and "Grievance Redressal" mechanisms for Data Principals (investors/clients) ensuring strict SLA adherence.

3. Significant Data Fiduciary (SDF) Obligations

  • DPIA: Establish a framework for and conduct periodic Data Protection Impact Assessments (DPIAs) for high-risk processing activities.
  • Audit Readiness: Act as the point of contact for the Independent Data Auditor (IDA) and ensure readiness for periodic privacy audits.

4. Vendor & Third-Party Risk Management

  • Review and renegotiate contracts with all Data Processors to ensure flow-down clauses regarding liability and security safeguards are legally binding under the new Act.

5. Training & Culture

  • Drive the "Privacy Culture" change. Conduct role-based training for employees, specifically targeting IT, Operations, and Customer Support teams regarding their obligations under DPDPA.
Order

13