Data Privacy (Manager/ Sr Manager) | Big4

Acme Services; Navi Mumbai; On-site; INR 150,000 - 210,000; Full time

Job summary

Acme Services invites a senior privacy compliance professional to lead end-to-end data privacy initiatives across multiple business verticals including retail, healthcare, and education. You will operationalize DPDPA, maintain RoPA, consent mechanisms, and cross-border transfer controls while driving ISO 27701 certification in alignment with ISO 27001.

You will serve as the primary liaison to internal teams, auditors, and regulatory authorities, mapping obligations under IT Act 2000, DPDP Act

Qualifications

• Experience implementing privacy compliance programs.
• Familiarity with DPDP Act 2023, DPDP Rules 2025, GDPR.
• Ability to coordinate audits and regulatory filings.

Responsibilities

• Own end-to-end execution and maintenance of the enterprise data privacy compliance program across the group.
• Lead DPDPA compliance operationalization across all businesses including RoPA, lawful basis, consent, cross-border transfers.
• Drive ISO 27701 certification aligned with ISO 27001 for information security.
• Act as primary compliance interface for internal teams, auditors, and regulators.
• Maintain regulatory obligations mapping under IT Act 2000, DPDP Act 2023, GDPR, and global privacy statutes.
• Conduct periodic assessments to identify gaps and drive remediation plans to closure.
• Oversee PIAs and DPIs for new products and data processing changes.
• Lead data breach compliance remediation including regulatory notifications.
• Draft and maintain data protection policies, SOPs, consent templates, notices, and DPA templates.
• Oversee third-party/privacy compliance monitoring of processors and sub-processors.
• Prepare dashboards, audit findings, and regulatory readiness reports for senior management.

Skills

DPDPA compliance

ISO 27701

Data privacy

Regulatory liaison

Risk assessment

Job description

Job Roles & Responsibilities

• Own the end-to-end execution and maintenance of the enterprise data privacy compliance program across the group and individual business verticals (retail, healthcare, education, etc.), ensuring all processing activities meet regulatory obligations and internal policy standards.
• Lead DPDPA compliance operationalization across all businesses including data inventory and records of processing activities (RoPA), lawful basis documentation, consent mechanism implementation, and cross-border data transfer compliance under applicable adequacy and contractual frameworks.
• Drive the attainment and sustained compliance of Privacy Information Management System (PIMS) / ISO 27701 certification across business units, while maintaining alignment with the ISO 27001 information security management system.
• Act as a primary compliance interface for internal business teams, auditors, and regulatory authorities on data privacy matters.
• Maintain a dynamic regulatory compliance register mapping applicable obligations under the IT Act 2000, DPDP Act 2023, DPDP Rules 2025, GDPR, and other relevant global privacy statutes to organizational processes, controls, and accountable owners.
• Conduct periodic compliance assessments across business units to identify gaps, partial compliance, or emerging obligations, and drive structured remediation plans through to verified closure.
• Oversee the execution of Privacy Impact Assessments (PIAs) and Data Protection Impact Assessments (DPIAs) for new products, services, technology deployments, and data processing changes from compliance perspective.
• Lead the compliance dimension of data breach response — including regulatory notification obligations, Data Protection Board filings, record-keeping requirements, and post-breach compliance remediation — in coordination with IT, Cyber Security, Legal, and business teams.
• Draft, review, and maintain the repository of data protection policies, standard operating procedures, consent templates, privacy notices, and data processing agreements, ensuring they remain current with evolving regulatory requirements.
• Oversee third-party and vendor privacy compliance through an ongoing compliance monitoring program for external data processors and sub-processors.
• Support with preparation of compliance dashboards, audit findings, and regulatory readiness reports to senior management and governance committees, as needed.