Data Protection Officer (DPO)

Role Summary :

The DPO oversees the Client's compliance with the Digital Personal Data Protection Act, 2023 and Digital Personal Data Protection Rules 2025 (hereinafter together referred to as DPDPA) acting as the primary interface with data principals and the Data Protection Board of India (hence DPBI) to ensure lawful, transparent handling of digital personal data.

The role requires an India-based individual accountable to the DPBI, Information Security and Privacy Steering Committee/Board and responsible for monitoring obligations, managing grievances and advising on data protection practices.

Key Responsibilities :

- Ensure organisational compliance with DPDPA and data protection obligations

- Develop and update data protection policies, procedures, and frameworks

- Handle data principal grievances and requests including access, erasure/deletion and data correction, and retention of personal data with appropriate provisions for children and persons with disabilities.

- Maintain data processing registers and documentation related to consent management and privacy notices

- Oversee third-party processor compliance through data processing agreements, audits and reviews

- Lead and manage data breach detection, assessment and notification to Data Protection Board of India and data principals

- Provide data protection training and awareness programs

- Oversee and validate that technical and algorithmic processing measures are risk assessed and do not adversely impact the rights of data principals.

- Report quarterly to Information Security and Privacy Steering Committee/Board on compliance posture and emerging risks

- Advise on international data transfers and cross-border compliance

- Participate in product/service design reviews to ensure privacy-by-design principles

- Ensure, oversee and conduct Data Protection Impact Assessments for high-risk processing and independent audits are conducted, reviewed and reported to Information Security and Privacy Steering Committee/Board, in case Client is designated as Significant Data Fiduciary.

Qualifications :

- Bachelor's and Master's degree in Law, Computer Science, Engineering, Information Systems, or a related discipline

- Minimum 7+ years of relevant experience in data protection, privacy, information security, or regulatory compliance roles

- Expertise in the DPDPA, GDPR, and other applicable international data protection laws and standards

- Experience in data breach response, incident management, and engagement with regulators or supervisory authorities

- Sound technical understanding of information security concepts, including cybersecurity controls, encryption, data architecture, and enterprise systems

- Strong analytical, communication, documentation, and stakeholder management skills, with the ability to operate independently

- Relevant professional certifications such as CIPP, CIPM, CDPSE, ISO/IEC 27701 (PIMS), or equivalent, preferred