Location:

Applications are invited from candidates based out of or ready to relocate to: Patna, Guwahati, Ranchi, Raipur, Jaipur, Bhubaneswar, Mumbai, Hyderabad

1. JOB OVERVIEW, JOB BACKGROUND AND PURPOSE1.

JOB OVERVIEW, JOB BACKGROUND AND

The Digital Personal Data Protection Act, 2023 and DPDP Rules, 2025 (most obligations commencing May 2027) require organisations to process personal data lawfully and transparently, protect it with reasonable security safeguards, and give Data Principals an accessible way to exercise their rights and raise grievances.

This role leads the implementation of the DPDP Act 2023 in the business unit to ensure that all digital personal data collection and processing is lawful, transparent, and secured by reasonable security safeguards and runs the grievance and rights-request function. It is the bridge between legal requirements, information security controls and programme operations.

2. KEY RESPONSIBILITIES & DUTIESEY RESPONSIBILITIES & DUTIES

1. DPDP Act 2023 Compliance, Consent Management

· Drive the DPDP readiness roadmap and track compliance milestones ahead of the May 2027 commencement.

· Implement notice and consent capture, management and withdrawal across digital, offline and field channels as per the DPDP Act 2023.

· Implement verifiable parental consent for children’s data, and consent from lawful guardians for persons with disabilities.

· Implement and manage Consent Management System and ensure channels and processes for Data principal to exercise their rights as per DPDP Act 2023.

· Maintain the data inventory and Record of Processing Activities (RoPA), mapping data flows, purposes and lawful bases, including legitimate uses

· Ensure all contracts, MoUs, service agreements are DPDPA compliant.

2. Data Retention & Erasure

· Define and enforce retention schedules so data is erased once the specified purpose is served or consent is withdrawn, unless law requires retention,



and run the erasure process including advance notice to Data Principal.

3. Grievance Redressal and Data Principal Rights

· As per DPO guidelines, set up and run the grievance redressal mechanism: intake channels, triage, escalation matrix, resolution and closure.

· Maintain the grievance MIS and report it monthly to the DPO, maintain case records and documentation to support any proceedings.

· Establish workflows to fulfill Data Principal rights as per DPDP Act 2023.

4. Technical Safeguards and Breach Management

· Work with IT team to implement reasonable security safeguards to prevent personal data breaches, aligning with applicable policies.

· Oversee encryption, anonymization, and pseudonymization techniques for data at rest and in transit.

· Manage Data Breach Notifications: In the event of a breach, you must lead the process of informing the DPO and every affected Data Principal and work with DPO and legal team for required reporting and responses.

· Maintain breach registers and run post-incident reviews, and coordinate CERT-In reporting where applicable.

5. Other governance and regulatory functions

· Work closely with Data Protection Officer (DPO) for regulatory filings and independent audits and governance reporting, SoP development.

6. Vendor & Cross-Border Management

- Run privacy due diligence on processors and partners, and draft or review Data Sharing Agreements and monitor processor compliance through audits and assessments.
- Guide and monitor donor and program teams on cross-border data transfers to ensure compliance.

7. Training,



Audit & Reporting

- Train staff, field teams and volunteers on DPDP obligations, consent and data handling.
- Conduct internal privacy audits and DPIAs for all programmes, apps and systems.
- Prepare quarterly DPDP compliance reports for the DPO and leadership.
- Track regulatory updates from MeitY and the DPBI, and initiate the update process of policies and SOPs accordingly.

3.SKILLS AND ATTRIBUTESILLS AND ATTRIBUTE

Technical / Domain

· Strong working knowledge of the DPDP Act 2023 and Rules 2025, the IT Act 2000 and CERT-In Directions; familiarity with GDPR is a plus.

· Proficiency in GRC (Governance, Risk, and Compliance) software, identity management, and data discovery tools.

· Ability to design SLAs, workflows and SOPs, and to translate legal requirements into operational processes.

Behavioural

· Collaboration, coordination, stakeholder management and the ability to build consensus across technical and programme teams and engage with business-line senior leadership.

· Sound judgement, discretion and integrity in handling sensitive personal data.

· Structured, detail-oriented and deadline-driven.

· Explicit written and verbal communication, plain-language drafting, and de-escalation skills when handling Data Principal grievances. Proficiency in English and Hindi an advantage.

4.ESSENTIAL QUALIFICATIONS & EXPERIENCE:

3. ESSENTIAL QUALIFICATIONS & EXPERIENC

· Education: Degree in Law, Computer Science, Information Technology, Information Security or a related field, or equivalent professional experience.

· Work Experience: 6-8 years in data privacy, compliance or information security, including ISO 27001 implementation or a privacy programme.

· Experience in grievance or complaint handling, or customer or beneficiary redressal, is preferred.

· Certifications: ISO 27001 LI, ISO 27701 LI will be added advantage.

📌 Senior Project Manager — DPDP Act Compliance & Grievance Management (Mumbai)
🏢 Piramal Swasthya
📍 Mumbai