Privacy Lead
Paytm
Noida, Uttar Pradesh, IndiaPosted 1 month ago
Skill Required
ITSOCEngineeringISO 27001ObservabilitysecuritybuildingEmbedded CfintechdesignCloudAI
Key highlights
- 15+ years of experience required
- Bachelor’s degree required; Master’s preferred
- Deep expertise in DPDP Act, GDPR, and ISO 27701
- Experience in highly regulated industries such as Banking and FinTech
- Lead privacy readiness for RBI and other regulatory audits
- Strong understanding of privacy regulations and governance frameworks
Role overview
We are seeking an experienced Privacy Lead to establish, manage, and continuously enhance the organization’s Privacy Program across business functions, products, technology platforms, and third‑party ecosystems. The ideal candidate will possess deep expertise in privacy regulations including India’s Digital Personal Data Protection Act (DPDP Act), GDPR, and privacy governance frameworks. The individual will partner closely with Legal, Compliance, Information Security, Product, Engineering, Risk, HR, and Business teams to ensure privacy‑by‑design principles are embedded into organizational processes and technology solutions.
Responsibilities
- Develop and execute the enterprise‑wide Privacy Program and Privacy Governance Framework.
- Define privacy policies, standards, procedures, and controls aligned with regulatory requirements.
- Establish Privacy‑by‑Design and Privacy‑by‑Default principles across products and services.
- Build privacy risk management and privacy control monitoring mechanisms.
- Advise executive leadership on emerging privacy risks and regulatory developments.
- Act as the organization’s privacy subject matter expert for audits, inspections, and regulatory reviews.
- Lead compliance initiatives for Digital Personal Data Protection Act (DPDP Act), India; GDPR; ISO 27701 Privacy Information Management System; RBI data governance and customer data protection requirements; and applicable privacy and data protection obligations relevant to the Banking, FinTech, Payments, and Technology sectors.
- Conduct regulatory gap assessments, compliance monitoring, privacy control implementation, privacy risk assessments, and policy and procedure reviews.
- Establish and manage Privacy Impact Assessment (PIA) and Data Protection Impact Assessment (DPIA) processes.
- Conduct privacy assessments for new products and services, technology platforms, cloud deployments, customer‑facing applications, third‑party integrations, and AI and data analytics initiatives.
- Identify privacy risks and drive remediation plans.
- Define controls governing data collection, usage, retention, archival, sharing, and deletion to ensure lawful processing of personal data.
- Monitor compliance with data minimization and purpose limitation principles.
- Oversee data retention and secure disposal programs.
- Establish processes for handling data access, correction, erasure, consent withdrawal, and grievance redressal requests, ensuring statutory timelines and obligations.
- Coordinate responses across business, legal, and technology teams for data subject rights management.
- Design and oversee enterprise consent management frameworks, ensuring consent collection, storage, withdrawal, and auditability comply with applicable regulations.
- Review customer journeys, websites, mobile applications, and digital platforms for privacy compliance and assess tracking technologies and customer preference management processes.
- Evaluate privacy risks associated with vendors, partners, service providers, and data processors, review privacy clauses, data processing agreements, and contractual obligations, participate in vendor risk assessments and due diligence reviews, and ensure third‑party privacy obligations are appropriately governed and monitored.
- Develop and maintain privacy incident response procedures, assess privacy incidents, coordinate investigation activities, work closely with Information Security, Legal, Compliance, and Risk teams to manage privacy‑related events, and support regulatory reporting and internal governance processes where required.
- Design and deliver enterprise‑wide privacy awareness programs and conduct targeted privacy training for Product Teams, Engineering Teams, HR Teams, Customer Operations Teams, and Business Functions, promoting a privacy‑first culture across the organization.
- Lead privacy readiness activities for RBI Audits, Internal Audits, External Audits, Regulatory Reviews, Privacy Certifications, manage audit evidence and remediation activities, and represent the organization during privacy assessments and inspections.
Requirements
- Bachelor's Degree in Engineering, Information Technology, Computer Science, Law, Risk Management, or related discipline.
- Master's Degree preferred.
- 15+ years of experience in Privacy, Information Security, Compliance, Risk Management, Data Governance, or related domains.
- Demonstrated experience building and managing enterprise privacy programs.
- Experience within Banking, Financial Services, FinTech, Payments, Technology, or other highly regulated industries.
- Strong understanding of privacy regulations, privacy governance frameworks, and data protection principles.
- Experience supporting regulatory audits and compliance assessments.
Nice to have
- Certified Information Privacy Professional (CIPP/E)
- Certified Information Privacy Manager (CIPM)
- Certified Information Privacy Technologist (CIPT)
- CISSP
- CISM
- CRISC
- ISO 27701 Lead Implementer or Lead Auditor
- ISO 27001 Lead Implementer or Lead Auditor
- CDMP (Certified Data Management Professional)
- CGEIT
- COBIT Foundation
- Privacy Governance Frameworks
- DPDP Act & GDPR Compliance
- Data Discovery & Classification
- Consent Management
- Data Mapping & Data Flow Analysis
- Privacy Impact Assessments (PIA/DPIA)
- Data Retention & Deletion Controls
- Data Loss Prevention (DLP)
- Third‑Party Risk Management
- Cloud Privacy Controls
- Privacy Monitoring & Reporting
- Executive Stakeholder Management
- Regulatory Engagement
- Strategic Thinking
- Program Management
- Risk‑Based Decision Making
- Policy Development
- Cross‑Functional Leadership
- Strong Communication & Influencing Skills
Additional details
- Success Metrics: Privacy Compliance Maturity, Audit and Regulatory Outcomes, DPIA/PIA Coverage, Data Subject Request SLA Adherence, Privacy Incident Reduction, Third‑Party Privacy Risk Coverage, Privacy Awareness Completion Rates, Privacy Control Effectiveness.