Compliance and Grievance Manager

Role & responsibilities:

1. DPDP Compliance Framework & Consent Management

• Implement and manage Consent Management and interoperable platforms to allow Data Principals to give, manage, and withdraw consent.
• Ensure all data collection is preceded by a Notice in the 22 languages specified in the Eighth Schedule to the Constitution (as required by the Act).
• Maintain a comprehensive Record of Processing Activities (RoPA) and map data flows to identify "legitimate uses."

2. Technical Safeguards & InfoSec

• Deploy "Reasonable Security Safeguards" to prevent personal data breaches, aligning with ISO 27001 or NIST frameworks.
• Oversee encryption, anonymization, and pseudonymization techniques for data at rest and in transit.
• Manage Data Breach Notifications: In the event of a breach, you must lead the process of informing the Data Protection Board of India (DPB) and every affected Data Principal.

3. Rights of the Data Principal

• Establish workflows to fulfill Data Principal rights: Right to Access, Right to Correction/Erasure, and the Right to Grievance Redressal.
• Ensure that data is deleted once the "specified purpose" is met or when consent is withdrawn (Data Minimization).

4. Significant Data Fiduciary (SDF) Obligations (If Applicable)

• If the organization is classified as an SDF, oversee the mandatory Data Protection Impact Assessments (DPIA).
• Coordinate with Data Protection Officer (DPO) for regulatory filings and independent audits.

5. Vendor & Cross-Border Management

• Review and update Data Processing Agreements (DPAs) with third-party processors to ensure they adhere to DPDP standards.
• Monitor cross-border data transfers to ensure compliance with the Central Governments "restricted country" list (Negative List).

Preferred candidate profile :

• Experience: 4-6 years in data privacy/compliance. Experience with DPDP Act is highly preferred.
• Legal: Expert-level understanding of the DPDP Act 2023, Rules 2025, IT Act 2000 (Section 43A,79), GDPR.
• Technical: Proficiency in GRC (Governance, Risk, and Compliance) software, identity management, and data discovery tools.
• Breach Response: Percentage of breaches reported to the DPB within the prescribed timeline (likely 72 hours).
• Consent Accuracy: Audit score of "Notice & Consent" mechanisms across all digital touchpoints.
• DSAR Completion: 100% resolution of Data Subject Access Requests within statutory timelines.
• Note on the DPDP Act 2023: Unlike the GDPR, the Indian Act treats all personal data uniformly (no separate "Sensitive" category), but it imposes high penalties (up to 250 Crore) specifically for the failure to take reasonable security safeguards to prevent a data breach. This makes the "InfoSec" part of this role critical for financial risk management.
• Collaboration and coordination with multiple stakeholders and bring consensus during disputes
• Reports- Preparing quarterly report on DPDP compliance, Breach Management.
• Audit- DPIA, RoPA, internal audit