Data Privacy Officer

National Payments Corporation of India (NPCI); Mumbai; On-site; INR 3,500,000 - 6,000,000; Full time

Job summary

NPCI in Mumbai seeks a senior privacy leader to design and implement enterprise privacy controls, policies, and compliance frameworks across the organization.

You will drive GDPR and DPDP initiatives, oversee the DPO Office, and embed privacy-by-design in products and AI. This role requires strong collaboration with Engineering, Information Security, Product, Risk, Compliance, and Legal teams.

Qualifications

• 7 to 11 years of experience with at least 4 years implementing privacy controls and managing privacy programs.
• Strong information security knowledge and ability to translate risks into governance requirements.
• Proven experience in implementing GDPR and DPDP compliance frameworks.
• Understanding of privacy risk management, data governance, and breach management.
• Experience with frontier AI privacy, PETs, and privacy engineering concepts.
• BFSI sector experience and banking regulatory awareness is mandatory.
• Professional certifications such as CISSP, CIPP, CIPM, or AIGP preferred.

Responsibilities

• Design and enhance enterprise privacy controls, policies, standards, and compliance frameworks.
• Lead GDPR, DPDP Act, and other privacy regulation implementation initiatives.
• Oversee the DPO Office operations, governance, reporting, and stakeholder engagement.
• Integrate privacy-by-design into products, tech, processes, and AI-enabled solutions.
• Conduct privacy assessments, data mapping, PIAs, and risk assessments.
• Monitor and address privacy, security, and governance risks related to frontier AI models.
• Drive adoption of Privacy Enhancing Technologies and privacy engineering practices.
• Establish privacy governance across data lifecycle: collection, processing, storage, sharing, disposal.
• Support audits, regulatory inspections, and compliance reviews.
• Provide leadership and awareness programs to strengthen privacy culture.
• Engage with senior management and regulators on privacy strategy and risk mitigation.

Skills

Privacy governance

Privacy risk management

Information security

GDPR/DPDP compliance

Stakeholder management

Leadership

Privacy engineering

Job description

Role & responsibilities

• Design, implement, and continuously enhance enterprise-wide privacy controls, policies, standards, and compliance frameworks.
• Lead and drive implementation initiatives related to GDPR, Digital Personal Data Protection (DPDP) Act, and other applicable privacy regulations.
• Manage and oversee the operational activities of the Data Protection Officer (DPO) Office, including governance, reporting, compliance monitoring, and stakeholder engagement.
• Integrate privacy-by-design and privacy-by-default principles into products, technologies, business processes, and AI-enabled solutions. Collaborate with Engineering, Information Security, Product Management, Risk, Compliance, and Legal teams to implement practical and scalable privacy controls.
• Conduct privacy assessments, data mapping, privacy impact assessments (PIAs), and risk assessments across systems and applications.
• Evaluate, monitor, and address emerging privacy, security, and governance risks associated with frontier AI models, machine learning systems, and advanced data processing technologies.
• Drive adoption and implementation of Privacy Enhancing Technologies (PETs) such as anonymization, pseudonymization, differential privacy, federated learning, and secure data-sharing techniques.
• Establish privacy governance mechanisms for handling personal data throughout its lifecycle, including collection, processing, storage, sharing, and disposal.
• Support internal and external audits, regulatory inspections, and compliance reviews.
• Provide leadership, guidance, and awareness programs to strengthen the organization's privacy culture and data protection maturity.
• Engage with senior management and regulatory stakeholders on privacy strategy, compliance posture, and risk mitigation initiatives.

Requirements

• 7 to 11 years of overall professional experience, with a minimum of 4 years of deep, hands-on experience in privacy control implementation and privacy program management.
• Strong Information Security knowledge with the ability to understand and translate technical risks into privacy controls and governance requirements.
• Proven experience in implementing and operationalizing GDPR and DPDP compliance frameworks.
• Solid understanding of privacy risk management, data governance, consent management, data subject rights, cross-border data transfers, and breach management processes.
• Working knowledge of frontier AI models and the associated privacy, governance, ethical, and regulatory challenges.
• Hands-on experience with Privacy Enhancing Technologies (PETs) and modern privacy engineering concepts.
• Engineering or technology background preferred, with the ability to engage effectively with technical teams.
• Experience in the Banking, Financial Services, and Insurance (BFSI) sector is mandatory.
• Strong understanding of banking operations, digital payments ecosystems, payment products, and regulatory expectations in the financial sector.
• Excellent stakeholder management, communication, and leadership skills.

Professional certifications such as CISSP, CIPP, CIPM, AIGP, or equivalent privacy and security credentials will be highly preferred.