Data Privacy Officer

Data Privacy Officer (Consultant)

Job Location: Mumbai / Pune
Engagement: Consultant Part-time Advisory
Experience: 5-10+ Years in Data Privacy / Privacy Compliance

Job Summary

We are looking for an experienced Data Privacy Officer (Consultant) to provide independent privacy advisory support across India and international data protection requirements. The consultant will advise on regulatory compliance, privacy risk, contracts, HR data, technology, AI initiatives, and privacy implementation, while working closely with Legal, IT, Information Security, HR, and business teams.

Key Responsibilities

• Advise on Indias Digital Personal Data Protection (DPDP) Act and applicable Rules, including applicability and implementation timelines, along with GDPR, CCPA/CPRA, and other relevant privacy regulations.
• Support data mapping and Records of Processing Activities (RoPA) covering processing purposes, lawful basis, data categories, recipients, retention, and international data transfers.
• Review privacy policies, employee/candidate privacy notices, consent mechanisms, retention schedules, deletion and anonymization procedures.
• Advise on Data Subject Requests (DSRs) and privacy grievances, including verification, response timelines, exceptions, documentation, and closure.
• Review Data Processing Agreements (DPAs), vendor/client privacy clauses, subprocessors, international transfer mechanisms, and contractual obligations in coordination with Legal.
• Provide privacy guidance across recruitment, background verification, employee records, payroll, benefits, monitoring, and offboarding, including contractors, consultants, freelancers, and staffing agencies.
• Advise on privacy incidents and data breaches, including assessment, notification requirements, and communications with clients, individuals, and authorities in coordination with IT, Information Security, and Legal.
• Advise on Privacy by Design for products, AI tools, technology initiatives, and new business projects, including student and children’s data where applicable.
• Conduct privacy awareness and role-specific training sessions and provide periodic management reporting on privacy risks, gaps, remediation status, and regulatory developments.
• Support ongoing SOC 2 compliance and audits, including privacy-related controls, evidence, and remediation requirements.

Key Skills & Qualifications

• 5-10+ years of practical experience in Data Privacy, Data Protection, Privacy Compliance, or related areas.
• Strong practical knowledge of India DPDP framework, GDPR, CCPA/CPRA, and other applicable privacy regulations.
• Hands-on experience in privacy contract/DPA reviews, international data transfers, DSRs, breach response, and HR data privacy.
• Experience with data mapping, RoPA, privacy notices, consent management, retention, deletion/anonymization, and Privacy by Design.
• Exposure to EdTech, SaaS, AI-enabled products, and the IT/ITES domain is needed
• Understanding of Controller/Processor obligations, vendor privacy management, and third-party risk.
• Experience working with Legal, IT, Information Security, HR, and business stakeholders.
• Certifications such as CIPP/E, CIPM, CIPT, CDPO, or equivalent are preferred, along with demonstrated practical experience.

Engagement & Deliverables

• The consultant will provide independent privacy advice with direct access to senior management.
• Implementation ownership will remain with the respective internal business, HR, Legal, IT, and Information Security teams.
• Indicative advisory commitment: 8 hours per month, with defined availability and response expectations.
• Additional support may be required for privacy incidents, audits, implementation projects, regulatory changes, or urgent matters.
• Initial deliverables will include a privacy gap assessment, prioritized implementation roadmap, and periodic compliance/risk reporting.
• The consultant will coordinate with Legal, HR, IT, Information Security, and business teams to support effective privacy governance.
• The role will be formally designated as the organization’s DPO only if required and approved under applicable law.