- Act as the designated DPO under India's DPDP Act 2023 and other applicable privacy laws.
- Maintain a data processing inventory with a documented lawful basis for all activities under the DPDPA Act 2023.
- Support the development and maintenance of privacy policies, data retention schedules, and consent management frameworks.
- Monitor the Privacy by Design and Privacy by Default into the SDLC and data engineering practices.
- Review DPAs, data sharing agreements, and privacy clauses in vendor contracts.
Data Subject Rights & Incident Management
- Manage data subject requests — access, correction, erasure, portability, and grievance redressal — within regulatory timelines.
- Lead the data breach response: detection, containment, regulatory notification, and post-incident review.
Cyber Security Strategy & Governance
- Establish cybersecurity policies, standards, and guidelines based on industry best practices and regulatory frameworks (ISO 27001).
- Collaborate with HR and the compliance team to build a cybersecurity-aware culture through regular training and education programmes.
- Lead risk assessments to identify potential security threats and vulnerabilities, and propose effective mitigation measures.
- Develop and maintain an incident response programme, managing cybersecurity incidents and data breaches from detection to remediation.
Requirements
- 3+ years of experience in information security, data privacy, or a combined role, preferably in fintech, insurtech, BFSI, or a regulated industry.
- Knowledge of India's DPDP Act 2023 and hands-on experience implementing data protection programmes.
- Robust working knowledge of ISO 27001.
- Proven experience managing security incidents, data breaches, and regulatory notifications.
- Excellent communication skills — able to translate complex security and legal concepts for non-technical stakeholders.
- Technical degree (B.Tech/M.Tech in CS/IT or MBA in Information Security, or related field).