AVP - Data Protection (Techno-Legal)

SMBC Group; New Delhi; On-site; INR 900,000 - 1,500,000; Full time

Job summary

SMBC Group in New Delhi seeks a privacy-focused professional to support the Data Protection Officer in implementing and maintaining the bank's data privacy framework. The role blends legal, regulatory and information technology knowledge to assist with research, policy drafting, privacy assessments, contract reviews, data mapping and compliance evidence.

You will collaborate with Legal, Procurement and IT teams to draft and review privacy documentation, conduct DPIAs, map data flows, and support

Qualifications

• Knowledge of data protection and privacy requirements; ability to conduct legal/regulatory research.
• Experience with drafting and reviewing privacy policies, notices and related documentation.
• Familiarity with data flow mapping, DPIA/PIA processes and data lifecycle concepts.

Responsibilities

• Support the Data Protection Officer in research on data protection requirements and regulatory developments.
• Assist in drafting privacy policies, procedures, consent wording, notices and internal guidance.
• Review contracts for data processing clauses and privacy commitments with cross-functional teams.
• Conduct or support Privacy Impact Assessments / DPIAs for new products and processes.
• Assist data flow mapping, data inventory, and processing records across systems and processes.
• Support privacy-by-design reviews for technology projects and changes.
• Assist in privacy incident assessment, data subject requests and DPO reporting.

Skills

Data privacy

Legal research

Contract review

Data mapping

Regulatory knowledge

Education

Graduate or postgraduate qualification in law/tech

Tools

MS Office

GRC tools

Job description

Support the Data Protection Officer in implementing and maintaining the Bank’s data privacy framework through a combination of legal, regulatory and information technology knowledge. The role will assist with legal and regulatory research, policy and notice drafting, privacy assessments, contractual reviews, data mapping, technology-related privacy reviews, issue tracking and maintenance of compliance evidence.

Primary Responsibilities

• Support privacy legal and regulatory research, including review of applicable data protection requirements, regulatory developments and internal compliance obligations; prepare structured summaries and implementation trackers for DPO review.
• Assist in drafting and periodic review of privacy policies, procedures, consent wording, privacy notices, forms, internal guidance and other privacy-related legal documentation.
• Support review of contracts, data processing clauses, confidentiality terms and third-party privacy requirements in coordination with Legal, Procurement, Information Security and relevant business teams.
• Conduct or support Privacy Impact Assessments / DPIAs for new or changed products, processes, systems and technologies, including identification and documentation of legal and technology-related privacy risks.
• Support data flow mapping, data inventory, records of processing and review of personal data collection, use, storage, sharing, retention and disposal across systems and processes.
• Participate in privacy-by-design reviews for technology projects and change initiatives; assess whether privacy requirements are appropriately reflected in system and process design.
• Support privacy incident assessment, data subject request / grievance handling, awareness activities and periodic DPO reporting.

Knowledge, Skills, Experience & Qualifications

• Knowledge Requirements: Working knowledge of data protection and privacy requirements, legal research, contract and policy review, technology systems, data lifecycle concepts, privacy-by-design, DPIA / PIA, data subject rights, grievance handling and basic information security controls.
• Specialist / technical skills: Legal and regulatory research; drafting and document review; contract clause review; data flow mapping; privacy assessment; technology risk understanding; issue tracking; Microsoft Office and structured record management. Familiarity with privacy management or GRC tools is desirable.
• Behavioural / management skills: Analytical thinking, attention to detail, written and verbal communication, documentation discipline, stakeholder coordination, confidentiality, ownership and ability to work under the guidance of the DPO.
• Education & Qualifications: Relevant graduate or post-graduate qualification. A combined legal and technology background is preferred. Relevant privacy, technology or security certification may be desirable.