JOB DESCRIPTION
Openings 1 Base location Delhi-NCR Assignment 2years, project-dedicated Reporting AmbiSure engagement leadership; operational interface programme sponsor Work model Bank-approved onsite/hybrid arrangement; key Bank meetings in person Role objectiveLead 2 years Digital Personal Data Protection (DPDP) Act advisory engagement. Own the project plan, regulatory and privacy-control design, review of risk assessments, quality of outputs, and independent assurance of the implementation performed by System Integrator (SI). This position is also named Project Managerl. Core responsibilities
• Act as the single accountable delivery able to create and manage the programme charter, integrated schedule, RAID log, action tracker, responsibilities matrix, resource roster and milestone acceptance register.
• Lead DPDP Act/Rules applicability reviews and establish an obligation-to-control traceability matrix, considering relevant RBI, KYC/PMLA, CERT-In, UIDAI and other customer-specific requirements.
• Direct the discovery of personal data processing across application, branch, doorstep, call-centre, vendor and digital channels; validate the Record of Processing Activities (ROPA), data-flow diagrams, retention decisions and risk-based gap report.
• Design and review privacy governance, notices and consent controls, specified legitimate-use records, data-principal rights workflows, grievances, breach procedures, retention/erasure rules, vendor clauses and privacy-by-design requirements.
• Lead and quality-review Data Protection Impact Assessments (DPIAs), third-party assessments, mitigation plans, residual-risk recommendations and change-triggered reassessments.
• Prepare or supervise the SI scope of work, solution requirements, evaluation criteria, interface and acceptance-test requirements; support objective SI evaluation without participating in conflicted commercial decisions.
• Perform independent SI milestone assurance through design, architecture, configuration, testing, evidence review, operational readiness and written acceptance recommendations. The SI builds and fixes technology.
• Lead privacy training, tabletop breach exercises, regulator/audit-readiness support and management reporting. Approve weekly reports, detailed monthly packs, KPI/KRI dashboards and quarterly senior-management presentations.
• Manage delivery through six-month stabilisation/hypercare, including evidence completeness, priority issue tracking,



closure verification and the final knowledge-transfer and handover report.
• Attend all formally scheduled Bank physical meetings as required, proactively manage dependencies, and maintain confidentiality and approved handling of Bank information. Preferred expertise and qualifications
• More than 10 years’ relevant data privacy / GRC consulting experience is a robust preference for technical scoring; seven to ten years may also be considered depending on qualifications and documented delivery experience.
• CIPP, CIPM, CDPSE, DCDPO/DCPP or comparable recognised data privacy qualification, together with demonstrable privacy consulting experience in banking or financial services.
• Hands-on development of privacy policies, DPIAs, ROPA/data maps, consent and data-subject rights processes, privacy breach procedures, vendor-risk reviews and assurance test packs.
• Practical knowledge of assisted banking channels, core banking environments, regulated records retention and third-party technology delivery.
• Strong drafting, stakeholder facilitation, executive reporting, quality review and regulatory audit response skills. DPDP Advisory, Governance & Implementation Assurance

JOB DESCRIPTION
Openings 1 Base location Delhi-NCR Assignment 2 years, project-dedicated Reporting Senior Privacy Consultant / Project Manager–Lead Work model Primarily onsite during discovery, design and implementation assurance Role objectiveSupport full 2 years privacy governance and implementation assurance assignment. Own the working-level collection, analysis, documentation and evidence tracking required for data discovery, ROPA, privacy gap assessments, DPIAs, policy/rights workflows, vendor assessment, SI test observation and audit readiness. Core responsibilities
• Conduct structured interviews and workshops with Bank business units, technology teams, branch/field representatives and processors to understand actual personal-data processing and supporting controls.
• Build, validate and maintain the personal-data inventory, ROPA, system/process data-flow diagrams,



data-category classification and processing/retention register under Senior Consultant review.
• Collect and index policy, process, technical and vendor evidence; document DPDP/RBI-related control gaps, risk ratings, owner actions, due dates, dependencies and closure status.
• Draft supporting privacy documents and operating procedures for notices/consent, legitimate uses, data-principal rights, complaints, breach handling, retention and erasure, third-party processing and privacy by design.
• Prepare DPIA workpapers including processing descriptions, necessity/risk questions, mitigation trackers and residual-risk documentation; escalate material issues to the Senior Consultant.
• Maintain SI requirements traceability, test cases, UAT observation records, screenshots/log references, issue registers, defect retests and stage-gate evidence without assuming responsibility for SI implementation.
• Support training logistics and content, branch/doorstep privacy scenarios, tabletop breach drills, audit evidence retrieval and regulatory response document collation.
• Produce daily action/status updates, weekly progress inputs, monthly KPI/KRI extracts, version-controlled document registers and signed-off delivery/evidence trackers.
• Support onsite implementation monitoring through month 18 and operational stabilisation, issue closure, evidence archiving and handover through month 24.
• Follow IPPB’s confidentiality, information security, access, data masking, background verification and document-approval requirements at all times. Preferred expertise and qualifications
• Approximately 2–5 years of relevant privacy, GRC, information security audit, regulatory compliance or BFSI consulting experience (AmbiSure target, not prescribed RFP minimum).
• Familiarity with the DPDP Act and Rules, privacy notices, consent, data-principal rights, DPIAs, ROPA, records retention and incident/breach documentation.
• Experience preparing data flows, control matrices, risk registers, policy/SOP drafts, vendor review trackers, UAT observations and audit evidence packs.
• Exposure to banking customer journeys, KYC, AePS, CBS, RBI-regulated controls and third-party processors.
• CIPP, CIPM, CDPSE, DCDPO/DCPP, ISO 27001 or ISO 27701 training/certification is advantageous, but the RFP does not state that every junior consultant must hold one.

How to Apply
? Email: [email protected] ? Contact: +91 83569 50776

📌 Senior Privacy Consultant (Mumbai)
🏢 Ambisure Technologies
📍 Mumbai