Data Protection & Compliance Manager

Quin; Hyderabad; On-site; INR 1,200,000 - 1,800,000; Full time

Job summary

Quin, a safety-technology company based in Hyderabad, is seeking a Data Protection & Compliance Manager (DPO). The role involves ensuring data protection compliance across GDPR and India's DPDP Act, managing governance, risk, and compliance functions, and maintaining security certifications.

Ideal candidates should have 4–8 years of experience in data protection, a solid command of GDPR, and the ability to work autonomously across teams. This position offers an opportunity to shape the company's data governance framework.

Qualifications

• 4–8 years of experience in data protection, privacy, GRC, or technology/compliance law.
• Working knowledge of GDPR and familiarity with India's DPDP Act.
• Experience owning security certification programs or data protection programs.

Responsibilities

• Ensure enterprise security assurance and data protection.
• Act as Data Protection Officer across GDPR and India's DPDP Act.
• Author policies and maintain governance documents.
• Perform vendor risk assessments and manage customer assurance.

Skills

Data protection expertise

GDPR knowledge

Risk management

Security compliance

Policy authorship

Vendor risk management

AI algorithm governance

Autonomous working

Job description

Overview

Data Protection & Compliance Manager (DPO)

Quin is a safety-technology company. We embed sensor tech — crash detection, motion sensing, connectivity — into helmets and protective gear as an ingredient brand, shipping inside products from partners across motorcycling, cycling, sports, Industrial PPE and more. Quin products are designed to scale to millions of users, adopted by leading, global brands. Our engineering and product operations centre is in Hyderabad, where we are building our team and product with world-class excellence.

Why this role exists

This role is responsible for ensuring enterprise security assurance, global data protection, and AI/algorithmic governance are not just managed, but a sales enabler and point of pride for the company. You'll stand up our governance, risk and compliance function, and own the data-protection role for the company.

What You'll Own

• Security compliance & certifications
  • Own the control framework, evidence collection, and continuous-monitoring cadence (partnering with the InfoSec Engineer on the technical controls).
• Data protection & DPO
  • Act as the company's Data Protection Officer across GDPR (UK/EU) and India's DPDP Act, including registration obligations.
  • Own RoPA, DPIAs, data-subject-request handling, breach response and notification, retention schedules, and cross-border transfer mechanisms.
  • Lead and embed privacy by design.
• Policy authorship & document governance
  • Author and own the full internal governance stack: information security, acceptable use, data classification & handling, incident response, business continuity / disaster recovery, access control, change management, vendor/third-party risk, and an AI/ML-use governance policy for our motion-data work.
  • Draft and maintain all privacy-facing documents: the app and portal privacy notices, cookie/consent notices, the DPA template and sub-processor register, and internal data-handling SOPs.
  • Be the single accountable owner and custodian of the entire policy & document estate — versioning, review cadence, approvals, and the internal knowledge base. This includes keeping the customer- and product-facing agreements that external counsel drafts current in the repository.
  • Stand up a lightweight, real risk register the business actually uses.
• Third-party & vendor risk
  • Own vendor due diligence, DPAs, and the sub-processor register.
• Enterprise trust & customer assurance
  • Own security questionnaires, RFP compliance sections, and a customer-facing trust posture.
• Product & AI governance
  • Build a proportionate governance approach for our motion-sensing/ML work, in line with EU AI Act and algorithmic transparency in a pragmatic and practical manner.

Must-haves

• 4–8 years in data protection, privacy, GRC, or technology/compliance law — ideally in SaaS or a product company handling personal data at scale.
• Deep, working command of GDPR; familiarity with India's DPDP Act.
• Demonstrable ownership of either a security-certification program (SOC 2 and/or ISO 27001) or a data-protection/DPO program end to end — and the credibility to learn the other fast.
• The ability to work directly with engineers and translate regulation into concrete product/technical requirements.
• Genuinely autonomous: you scope, drive and close things without being managed.

Strong pluses

• CIPP/E, CIPM, CISSP, or ISO 27001 Lead Implementer/Auditor.
• Exposure to the EU AI Act or AI/algorithmic governance.
• Experience with a global SaaS/enterprise buyer base and their procurement/security reviews.
• Comfort operating across geographies (UK/EU, India, China supply chain).

How We Work

Small team of doers. We hire people who move fast and go deep, not people who manage other people to do the work. You'll have real ownership and very little bureaucracy.