Privacy Lead

Job description

About the Role We are seeking an experienced Privacy Lead to establish, manage, and continuously enhance the organization's Privacy Program across business functions, products, technology platforms, and third-party ecosystems. The ideal candidate will possess deep expertise in privacy regulations including India's Digital Personal Data Protection Act (DPDP Act), GDPR, and privacy governance frameworks. The individual will partner closely with Legal, Compliance, Information Security, Product, Engineering, Risk, HR, and Business teams to ensure privacy-by-design principles are embedded into organizational processes and technology solutions. The Privacy Lead will serve as the subject matter expert for privacy governance, regulatory compliance, privacy risk management, data subject rights management, privacy impact assessments, and data protection controls. Key Responsibilities Privacy Governance & Strategy -Develop and execute the enterprise-wide Privacy Program and Privacy Governance Framework. -Define privacy policies, standards, procedures, and controls aligned with regulatory requirements. -Establish Privacy-by-Design and Privacy-by-Default principles across products and services. -Build privacy risk management and privacy control monitoring mechanisms. -Advise executive leadership on emerging privacy risks and regulatory developments. -Act as the organization's privacy subject matter expert for audits, inspections, and regulatory reviews. Regulatory Compliance Lead compliance initiatives for: -Digital Personal Data Protection Act (DPDP Act), India -GDPR (General Data Protection Regulation) -ISO 27701 Privacy Information Management System -RBI data governance and customer data protection requirements -Applicable privacy and data protection obligations relevant to the Banking, FinTech, Payments, and Technology sectors Responsibilities include: -Regulatory gap assessments -Compliance monitoring -Privacy control implementation -Privacy risk assessments -Policy and procedure reviews Privacy Impact Assessments (PIA/DPIA) Establish and manage Privacy Impact Assessment (PIA) and Data Protection Impact Assessment (DPIA) processes. -Conduct privacy assessments for: -New products and services -Technology platforms -Cloud deployments -Customer-facing applications -Third-party integrations -AI and data analytics initiatives -Identify privacy risks and drive remediation plans. Data Lifecycle Management -Define controls governing: -Data collection -Data usage -Data retention -Data archival -Data sharing -Data deletion -Ensure lawful processing of personal data. -Monitor compliance with data minimization and purpose limitation principles. -Oversee data retention and secure disposal programs. Data Subject Rights Management -Establish processes for handling: -Data Access Requests -Data Correction Requests -Data Erasure Requests -Consent Withdrawal Requests -Grievance Redressal Requests -Ensure compliance with statutory timelines and obligations. -Coordinate responses across business, legal, and technology teams. Consent & Preference Management -Design and oversee enterprise consent management frameworks. -Ensure consent collection, storage, withdrawal, and auditability comply with applicable regulations. -Review customer journeys, websites, mobile applications, and digital platforms for privacy compliance. -Assess tracking technologies and customer preference management processes. Third-Party Privacy Risk Management -Evaluate privacy risks associated with vendors, partners, service providers, and data processors. -Review privacy clauses, data processing agreements, and contractual obligations. -Participate in vendor risk assessments and due diligence reviews. -Ensure third-party privacy obligations are appropriately governed and monitored. Privacy Incident Management -Develop and maintain privacy incident response procedures. -Assess privacy incidents and coordinate investigation activities. -Work closely with Information Security, Legal, Compliance, and Risk teams to manage privacy-related events. -Support regulatory reporting and internal governance processes where required. Privacy Training & Awareness -Design and deliver enterprise-wide privacy awareness programs. -Conduct targeted privacy training for: -Product Teams -Engineering Teams -HR Teams -Customer Operations Teams -Business Functions -Promote a privacy-first culture across the organization. Audit & Regulatory Engagement -Lead privacy readiness activities for: -RBI Audits -Internal Audits -External Audits -Regulatory Reviews -Privacy Certifications -Manage audit evidence and remediation activities. -Represent the organization during privacy assessments and inspections. Required Qualifications -Education -Bachelor's Degree in Engineering, Information Technology, Computer Science, Law, Risk Management, or related discipline. -Master's Degree preferred. Mandatory Experience -15+ years of experience in Privacy, Information Security, Compliance, Risk Management, Data Governance, or related domains. -Demonstrated experience building and managing enterprise privacy programs. -Experience within Banking, Financial Services, FinTech, Payments, Technology, or other highly regulated industries. -Strong understanding of privacy regulations, privacy governance frameworks, and data protection principles. -Experience supporting regulatory audits and compliance assessments. Preferred Certifications Privacy Certifications -Certified Information Privacy Professional (CIPP/E) -Certified Information Privacy Manager (CIPM) -Certified Information Privacy Technologist (CIPT) Security & Governance Certifications -CISSP -CISM -CRISC -ISO 27701 Lead Implementer or Lead Auditor -ISO 27001 Lead Implementer or Lead Auditor -Data Governance & Risk Certifications -CDMP (Certified Data Management Professional) -CGEIT -COBIT Foundation Technical Skills -Privacy Governance Frameworks -DPDP Act & GDPR Compliance -Data Discovery & Classification -Consent Management -Data Mapping & Data Flow Analysis -Privacy Impact Assessments (PIA/DPIA) -Data Retention & Deletion Controls -Data Loss Prevention (DLP) -Third-Party Risk Management -Cloud Privacy Controls -Privacy Monitoring & Reporting Leadership Competencies -Executive Stakeholder Management -Regulatory Engagement -Strategic Thinking -Program Management -Risk-Based Decision Making -Policy Development -Cross-Functional Leadership -Strong Communication & Influencing Skills Success Metrics -Privacy Compliance Maturity -Audit and Regulatory Outcomes -DPIA/PIA Coverage -Data Subject Request SLA Adherence -Privacy Incident Reduction -Third-Party Privacy Risk Coverage -Privacy Awareness Completion Rates -Privacy Control Effectiveness About the RoleWe are seeking an experienced Privacy Lead to establish, manage, and continuously enhance the organization's Privacy Program across business functions, products, technology platforms, and third-party ecosystems.The ideal candidate will possess deep expertise in privacy regulations including India's Digital Personal Data Protection Act (DPDP Act), GDPR, and privacy governance frameworks. The individual will partner closely with Legal, Compliance, Information Security, Product, Engineering, Risk, HR, and Business teams to ensure privacy-by-design principles are embedded into organizational processes and technology solutions.The Privacy Lead will serve as the subject matter expert for privacy governance, regulatory compliance, privacy risk management, data subject rights management, privacy impact assessments, and data protection controls.Key ResponsibilitiesPrivacy Governance & Strategy-Develop and execute the enterprise-wide Privacy Program and Privacy Governance Framework.-Define privacy policies, standards, procedures, and controls aligned with regulatory requirements.-Establish Privacy-by-Design and Privacy-by-Default principles across products and services.-Build privacy risk management and privacy control monitoring mechanisms.-Advise executive leadership on emerging privacy risks and regulatory developments.-Act as the organization's privacy subject matter expert for audits, inspections, and regulatory reviews.Regulatory ComplianceLead compliance initiatives for: -Digital Personal Data Protection Act (DPDP Act), India -GDPR (General Data Protection Regulation) -ISO 27701 Privacy Information Management System -RBI data governance and customer data protection requirements -Applicable privacy and data protection obligations relevant to the Banking, FinTech, Payments, and Technology sectorsResponsibilities include: -Regulatory gap assessments -Compliance monitoring -Privacy control implementation -Privacy risk assessments -Policy and procedure reviewsPrivacy Impact Assessments (PIA/DPIA)Establish and manage Privacy Impact Assessment (PIA) and Data Protection Impact Assessment (DPIA) processes.-Conduct privacy assessments for: -New products and services -Technology platforms -Cloud deployments -Customer-facing applications -Third-party integrations -AI and data analytics initiatives-Identify privacy risks and drive remediation plans.Data Lifecycle Management-Define controls governing: -Data collection -Data usage -Data retention -Data archival -Data sharing -Data deletion-Ensure lawful processing of personal data.-Monitor compliance with data minimization and purpose limitation principles.-Oversee data retention and secure disposal programs.Data Subject Rights Management-Establish processes for handling: -Data Access Requests -Data Correction Requests -Data Erasure Requests -Consent Withdrawal Requests -Grievance Redressal Requests-Ensure compliance with statutory timelines and obligations.-Coordinate responses across business, legal, and technology teams.Consent & Preference Management-Design and oversee enterprise consent management frameworks.-Ensure consent collection, storage, withdrawal, and auditability comply with applicable regulations.-Review customer journeys, websites, mobile applications, and digital platforms for privacy compliance.-Assess tracking technologies and customer preference management processes.Third-Party Privacy Risk Management-Evaluate privacy risks associated with vendors, partners, service providers, and data processors.-Review privacy clauses, data processing agreements, and contractual obligations.-Participate in vendor risk assessments and due diligence reviews.-Ensure third-party privacy obligations are appropriately governed and monitored.Privacy Incident Management-Develop and maintain privacy incident response procedures.-Assess privacy incidents and coordinate investigation activities.-Work closely with Information Security, Legal, Compliance, and Risk teams to manage privacy-related events.-Support regulatory reporting and internal governance processes where required.Privacy Training & Awareness-Design and deliver enterprise-wide privacy awareness programs.-Conduct targeted privacy training for: -Product Teams -Engineering Teams -HR Teams -Customer Operations Teams -Business Functions-Promote a privacy-first culture across the organization.Audit & Regulatory Engagement-Lead privacy readiness activities for: -RBI Audits -Internal Audits -External Audits -Regulatory Reviews -Privacy Certifications-Manage audit evidence and remediation activities.-Represent the organization during privacy assessments and inspections.Required Qualifications-Education -Bachelor's Degree in Engineering, Information Technology, Computer Science, Law, Risk Management, or related discipline. -Master's Degree preferred.Mandatory Experience-15+ years of experience in Privacy, Information Security, Compliance, Risk Management, Data Governance, or related domains.-Demonstrated experience building and managing enterprise privacy programs.-Experience within Banking, Financial Services, FinTech, Payments, Technology, or other highly regulated industries.-Strong understanding of privacy regulations, privacy governance frameworks, and data protection principles.-Experience supporting regulatory audits and compliance assessments.Preferred CertificationsPrivacy Certifications -Certified Information Privacy Professional (CIPP/E) -Certified Information Privacy Manager (CIPM) -Certified Information Privacy Technologist (CIPT)Security & Governance Certifications -CISSP -CISM -CRISC -ISO 27701 Lead Implementer or Lead Auditor -ISO 27001 Lead Implementer or Lead Auditor-Data Governance & Risk Certifications -CDMP (Certified Data Management Professional) -CGEIT -COBIT FoundationTechnical Skills-Privacy Governance Frameworks-DPDP Act & GDPR Compliance-Data Discovery & Classification-Consent Management-Data Mapping & Data Flow Analysis-Privacy Impact Assessments (PIA/DPIA)-Data Retention & Deletion Controls-Data Loss Prevention (DLP)-Third-Party Risk Management-Cloud Privacy Controls-Privacy Monitoring & ReportingLeadership Competencies-Executive Stakeholder Management-Regulatory Engagement-Strategic Thinking-Program Management-Risk-Based Decision Making-Policy Development-Cross-Functional Leadership-Strong Communication & Influencing SkillsSuccess Metrics-Privacy Compliance Maturity-Audit and Regulatory Outcomes-DPIA/PIA Coverage-Data Subject Request SLA Adherence-Privacy Incident Reduction-Third-Party Privacy Risk Coverage-Privacy Awareness Completion Rates-Privacy Control Effectiveness