Opening For Data Protection Officer

Role & responsibilities

The Data Protection Officer (DPO) will be responsible for establishing, implementing, maintaining and monitoring the organization's data privacy and protection governance framework in accordance with the Digital Personal Data Protection Act, 2023 (DPDP Act), applicable Rules, regulatory requirements and contractual obligations.

Preferred candidate profile

1. Privacy Governance & Planning

The DPO will:

• Establish and maintain the organization's privacy governance framework.
• Understand the business model, processes and personal-data processing activities.
• Identify personal data collected, processed, stored and shared across the organization.
• Establish and maintain a Personal Data Inventory.
• Conduct data-flow mapping across business processes and technology systems.
• Identify internal and external data-sharing arrangements.
• Identify third parties processing personal data.
• Conduct privacy gap and risk assessments.
• Develop and maintain the DPDP implementation roadmap.
• Establish privacy governance committees, roles and responsibilities.
• Maintain privacy registers, records and compliance evidence.

2. Privacy Policies, Notices & SOPs

The DPO will prepare, review and periodically update privacy documentation, including:

• Privacy Policy.
• Customer Privacy Notice.
• Employee Privacy Notice.
• Candidate Privacy Notice.
• Partner Privacy Notice.
• Website Privacy Notice.
• Cookie Notice, where applicable.
• Consent Management Policy.
• Data Retention Policy.
• Data Classification Policy.
• Data Sharing Policy.
• Data Principal Rights SOP.
• Privacy Incident/Breach Response Procedure.
• Data Disposal/Deletion Procedure.
• Privacy-by-Design guidelines.

The DPO will coordinate with Legal, Compliance and relevant process owners for review and approval.

3. Consent Management

The DPO will establish the organization's consent governance framework, including:

• Identify processes where consent is required.
• Define consent requirements and appropriate consent mechanisms.
• Review/approve consent wording in coordination with Legal.
• Define consent capture and recording requirements.
• Define consent withdrawal mechanisms.
• Define consent record retention requirements.
• Monitor implementation of consent controls across applications and business processes.

The DPO will define and approve the privacy requirements for the workflow, while the relevant business and IT teams will implement the controls.

4. Technology & Application Privacy

The DPO will work with IT and application owners to define privacy requirements for CRM, HRMS, websites, cloud applications and other systems processing personal data.

The DPO will provide requirements relating to:

• Identification and classification of personal data.
• Data minimization.
• Purpose limitation.
• Role-based access.
• PAN and other sensitive personal information.
• Data masking.
• Data download/export restrictions.
• Audit logging.
• Consent recording.
• Data correction and deletion.
• Data retention.
• Data sharing.
• Backup and restoration considerations.
• Privacy-by-design requirements.

5. Department-wise Privacy Oversight

Sales

The DPO will ensure that:

• Appropriate privacy notices are provided.
• Consent requirements are followed.
• Personal data is collected for defined purposes.
• Consent records are maintained.
• Sales employees receive privacy awareness training.
• CRM data handling follows approved privacy requirements.

6. Data Principal Rights Management

The DPO will establish and manage the process for receiving, coordinating and responding to Data Principal requests in accordance with applicable requirements.

Responsibilities include:

• Registration and tracking of requests.
• Validation and categorization of requests.
• Identification of relevant systems and process owners.
• Coordination with Sales, HR, Operations, IT and other functions.
• Tracking correction/deletion or other required actions.
• Maintaining evidence and response records.
• Ensuring appropriate escalation and closure.

The DPO will coordinate with relevant internal and external stakeholders where personal data has been shared with other parties.

7. Data Breach & Privacy Incident Management

The DPO will establish the privacy governance component of the organization's incident-management framework.

In the event of a suspected privacy incident or data breach, the DPO will:

• Receive and register the incident.
• Coordinate with IT/Security and relevant business functions.
• Assess the nature and extent of the incident.
• Identify affected personal data and Data Principals.
• Maintain incident documentation and chronology.
• Coordinate with Legal and Compliance regarding applicable obligations.
• Determine applicable notification and communication requirements.
• Track corrective and preventive actions.
• Maintain appropriate breach/incident records.

8. Third-Party & Vendor Privacy Management

The DPO will review privacy risks associated with third parties that process personal data, including:

• CRM providers.
• Cloud service providers.
• HRMS/payroll providers.
• Call centres.
• Document-management providers.
• SMS/email providers.
• Technology and application service providers.

The DPO will assess:

• Personal data shared.
• Purpose of processing.
• Data access requirements.
• Security/privacy controls.
• Contractual privacy obligations.
• Data retention and deletion requirements.
• Data-sharing arrangements.
• Incident notification requirements.
• Sub-processing arrangements, where applicable.

The DPO will coordinate with Procurement, Legal, IT and the respective business owner for appropriate contractual and operational controls.

9. Privacy by Design & New Initiatives

The DPO will participate in relevant new initiatives involving personal data, including:

• New products and services.
• New CRM modules.
• New applications.
• New integrations/API interfaces.
• New vendors.
• New customer journeys.
• New data collection.
• Major changes to existing systems/processes.

The DPO will assess privacy implications and recommend appropriate privacy controls before implementation.

10. Training, Awareness & Compliance Monitoring

The DPO will establish an organization-wide privacy awareness programs

11. Regulatory Monitoring & Management Reporting