Privacy Lead

About the Role

We are seeking an experienced Privacy Lead to establish, manage, and continuously enhance the organization's Privacy Program across business functions, products, technology platforms, and third-party ecosystems.

The ideal candidate will possess deep expertise in privacy regulations including India's Digital Personal Data Protection Act (DPDP Act), GDPR, and privacy governance frameworks. The individual will partner closely with Legal, Compliance, Information Security, Product, Engineering, Risk, HR, and Business teams to ensure privacy-by-design principles are embedded into organizational processes and technology solutions.

The Privacy Lead will serve as the subject matter expert for privacy governance, regulatory compliance, privacy risk management, data subject rights management, privacy impact assessments, and data protection controls.

Key Responsibilities

Privacy Governance & Strategy

-Develop and execute the enterprise-wide Privacy Program and Privacy Governance Framework.
-Define privacy policies, standards, procedures, and controls aligned with regulatory requirements.
-Establish Privacy-by-Design and Privacy-by-Default principles across products and services.
-Build privacy risk management and privacy control monitoring mechanisms.
-Advise executive leadership on emerging privacy risks and regulatory developments.
-Act as the organization's privacy subject matter expert for audits, inspections, and regulatory reviews.

Regulatory Compliance

Lead compliance initiatives for:
-Digital Personal Data Protection Act (DPDP Act), India
-GDPR (General Data Protection Regulation)
-ISO 27701 Privacy Information Management System
-RBI data governance and customer data protection requirements
-Applicable privacy and data protection obligations relevant to the Banking, FinTech, Payments, and Technology sectors

Responsibilities include:
-Regulatory gap assessments
-Compliance monitoring
-Privacy control implementation
-Privacy risk assessments
-Policy and procedure reviews

Privacy Impact Assessments (PIA/DPIA)

Establish and manage Privacy Impact Assessment (PIA) and Data Protection Impact Assessment (DPIA) processes.
-Conduct privacy assessments for:
-New products and services
-Technology platforms
-Cloud deployments
-Customer-facing applications
-Third-party integrations
-AI and data analytics initiatives
-Identify privacy risks and drive remediation plans.

Data Lifecycle Management

-Define controls governing:
-Data collection
-Data usage
-Data retention
-Data archival
-Data sharing
-Data deletion
-Ensure lawful processing of personal data.
-Monitor compliance with data minimization and purpose limitation principles.
-Oversee data retention and secure disposal programs.

Data Subject Rights Management

-Establish processes for handling:
-Data Access Requests
-Data Correction Requests
-Data Erasure Requests
-Consent Withdrawal Requests
-Grievance Redressal Requests
-Ensure compliance with statutory timelines and obligations.
-Coordinate responses across business, legal, and technology teams.

Consent & Preference Management

-Design and oversee enterprise consent management frameworks.
-Ensure consent collection, storage, withdrawal, and auditability comply with applicable regulations.
-Review customer journeys, websites, mobile applications, and digital platforms for privacy compliance.
-Assess tracking technologies and customer preference management processes.

Third-Party Privacy Risk Management

-Evaluate privacy risks associated with vendors, partners, service providers, and data processors.
-Review privacy clauses, data processing agreements, and contractual obligations.
-Participate in vendor risk assessments and due diligence reviews.
-Ensure third-party privacy obligations are appropriately governed and monitored.

Privacy Incident Management

-Develop and maintain privacy incident response procedures.
-Assess privacy incidents and coordinate investigation acti