AVP - Data Protection (Techno-Legal)

The Japan Research Institute, Limited (Singapore Branch); New Delhi; On-site; INR 1,200,000 - 1,800,000; Full time

Job summary

Sumitomo Mitsui Banking Corporation (SMBC) invites a privacy specialist to join its regulatory privacy program, focusing on data protection compliance across the Asia-Pacific framework.

The role involves conducting legal research, drafting privacy documents, and supporting DPIAs for new products, with close collaboration across Legal, IT and Procurement teams. A strong emphasis on accuracy, documentation discipline and stakeholder coordination is expected.

Qualifications

• Working knowledge of data protection and privacy requirements.
• Experience in legal research, policy review and drafting.
• Familiarity with data flows and privacy impact assessments.

Responsibilities

• Support privacy legal and regulatory research; prepare summaries and trackers for DPO review.
• Maintain regulatory reference materials and obligation registers.
• Assist in drafting and reviewing privacy policies, notices, forms and guidance.
• Support version control, approvals, publication and evidence maintenance.
• Review contracts and data processing clauses with Legal, Procurement, and IT teams.
• Conduct Privacy Impact Assessments for new or changed products and processes.
• Track mitigations, owners, target dates and residual risks for DPO oversight.
• Support data flow mapping and data inventory across systems.
• Coordinate information collection and maintain supporting documentation.
• Participate in privacy-by-design reviews for tech projects.
• Document observations and follow up actions with stakeholders.
• Support privacy incident handling and DPO reporting.

Skills

Data protection

Legal research

Privacy policy review

Contract review

Regulatory compliance

Documentation discipline

Education

Graduate or post-graduate qualification in law or technology

Privacy certification desirable

Tools

Microsoft Office

GRC tools

Job description

Select how often (in days) to receive an alert:

Headquartered in Tokyo, Sumitomo Mitsui Banking Corporation (SMBC) is a leading global financial institution and a core member of Sumitomo Mitsui Financial Group (SMBC Group). Built upon our rich Japanese heritage since 1876, we put our customers first and provide seamless access to, from and within the Asia Pacific region. SMBC is one of the largest Japanese banks by assets and maintain strong credit ratings across our global integrated network. We work closely as one SMBC Group to offer personal, corporate and investment banking services to meet the needs of our customers.

With sustainability embedded within our strategy and operations, we are committed to creating a society in which today’s generation can enjoy economic prosperity and well-being, and pass it on to future generations.

Primary Responsibilities

( These are the key work activities to achieve the position objective. Limit this section to essential responsibilities.)

Percentage (%) of

Secondary Responsibilities

( List of duties that are marginal or infrequent. )

• Support privacy legal and regulatory research, including review of applicable data protection requirements, regulatory developments and internal compliance obligations; prepare structured summaries and implementation trackers for DPO review.

20%

Maintain regulatory reference materials, obligation registers and supporting records.

• Assist in drafting and periodic review of privacy policies, procedures, consent wording, privacy notices, forms, internal guidance and other privacy-related legal documentation.

20%

Support version control, approvals, publication and evidence maintenance.

• Support review of contracts, data processing clauses, confidentiality terms and third-party privacy requirements in coordination with Legal, Procurement, Information Security and relevant business teams.

15%

Maintain review comments, issue logs and closure evidence.

• Conduct or support Privacy Impact Assessments / DPIAs for new or changed products, processes, systems and technologies, including identification and documentation of legal and technology-related privacy risks.

15%

Track mitigations, owners, target dates and residual risks for DPO oversight.

• Support data flow mapping, data inventory, records of processing and review of personal data collection, use, storage, sharing, retention and disposal across systems and processes.

15%

Coordinate information collection and maintain supporting documentation.

• Participate in privacy-by-design reviews for technology projects and change initiatives; assess whether privacy requirements are appropriately reflected in system and process design.

10%

Document observations and follow up action items with relevant stakeholders.

• Support privacy incident assessment, data subject request / grievance handling, awareness activities and periodic DPO reporting.

5%

Maintain case files, trackers, dashboards and governance meeting inputs.

Total

100%

• Knowledge Requirements : Working knowledge of data protection and privacy requirements, legal research, contract and policy review, technology systems, data lifecycle concepts, privacy-by-design, DPIA / PIA, data subject rights, grievance handling and basic information security controls.
• Specialist / technical skills : Legal and regulatory research; drafting and document review; contract clause review; data flow mapping; privacy assessment; technology risk understanding; issue tracking; Microsoft Office and structured record management. Familiarity with privacy management or GRC tools is desirable.
• Behavioural / management skills : Analytical thinking, attention to detail, written and verbal communication, documentation discipline, stakeholder coordination, confidentiality, ownership and ability to work under the guidance of the DPO.
• Education & Qualifications : Relevant graduate or post-graduate qualification. A combined legal and technology background is preferred. Relevant privacy, technology or security certification may be desirable.