Data Protection Consultant

Weekday; Mumbai; On-site; INR 500,000 - 1,200,000; Full time

Job summary

Weekday is seeking a Data Protection Consultant to drive privacy programs and regulatory compliance for clients in Mumbai. You will lead ROPA and DPIA activities, assess privacy risks, and help implement governance across business processes and systems.

The ideal candidate will have at least 2 years of hands-on experience in Data Privacy and Data Protection, with exposure to GDPR, DPDPA, and CCPA/CPRA, and be able to communicate regulatory requirements clearly to stakeholders.

Qualifications

• Minimum 2 years of relevant experience in Data Privacy, Data Protection, Information Security, GRC, or related domains.
• Hands-on experience in ROPA is mandatory.
• Hands-on experience in conducting DPIAs is mandatory.
• Good working knowledge of GDPR.
• Working knowledge of India's DPDPA and CCPA/CPRA.
• Understanding of privacy risk assessments, gap assessments, and compliance audits.
• Knowledge of privacy principles, data lifecycle, data processing activities, and privacy risk management.
• Familiarity with ISO 27001 and ISO 27701.

Responsibilities

• Design, implement, and support Privacy and Data Protection Programs for clients.
• Independently prepare, review, and maintain Records of Processing Activities (ROPA).
• Conduct Data Protection Impact Assessments (DPIA) and identify privacy risks and appropriate mitigation measures.
• Conduct privacy risk assessments, gap assessments, audits, and compliance reviews.
• Perform data privacy assessments across business processes, systems, applications, and third-party relationships.
• Work with information security and privacy frameworks including ISO 27001, ISO 27701, NIST, and HITRUST.
• Advise internal teams and clients on privacy regulations including GDPR, DPDPA, and CCPA/CPRA.
• Draft and review privacy policies, procedures, assessment reports, compliance documentation, and implementation roadmaps.
• Assist organizations with establishing and improving privacy governance frameworks.
• Support cybersecurity governance and ISMS documentation.
• Identify privacy and security compliance gaps and recommend remediation measures.
• Work with stakeholders across Legal, IT, Information Security, Compliance, HR, and business functions.
• Support client meetings, workshops, assessments, and privacy-related consulting engagements.

Skills

Data Privacy

Data Protection

ROPA

DPIA

GDPR

DPDPA/CCPA

ISO 27001

ISO 27701

Governance

Job description

This role is for one of our clients

Industry: Software Development

Seniority level: Associate level

Min Experience: 2+ years
Location: Mumbai, Maharashtra, India
JobType: full-time

₹5,00,000 - ₹12,00,000 a year

We are looking for aData Protection Consultantwith a minimum of2 years of hands-on experience in Data Privacy and Data Protection, with strong practical exposure toRecords of Processing Activities (ROPA)andData Protection Impact Assessments (DPIA).

The ideal candidate should have experience working on privacy compliance programs, risk and gap assessments, privacy documentation, and regulatory requirements such asGDPR, India’s DPDPA, and CCPA.

Requirements

Key Responsibilities

• Design, implement, and supportPrivacy and Data Protection Programsfor clients.
• Independently prepare, review, and maintainRecords of Processing Activities (ROPA).
• ConductData Protection Impact Assessments (DPIA)and identify privacy risks and appropriate mitigation measures.
• Conduct privacyrisk assessments, gap assessments, audits, and compliance reviews.
• Perform data privacy assessments across business processes, systems, applications, and third-party relationships.
• Work with information security and privacy frameworks includingISO 27001, ISO 27701, NIST, and HITRUST.
• Advise internal teams and clients on privacy regulations includingGDPR, DPDPA, and CCPA/CPRA.
• Draft and review privacy policies, procedures, assessment reports, compliance documentation, and implementation roadmaps.
• Assist organizations with establishing and improving privacy governance frameworks.
• Supportcybersecurity governance and ISMS documentation.
• Identify privacy and security compliance gaps and recommend remediation measures.
• Work with stakeholders across Legal, IT, Information Security, Compliance, HR, and business functions.
• Support client meetings, workshops, assessments, and privacy-related consulting engagements.

Mandatory Requirements

• Minimum2 years of relevant experiencein Data Privacy, Data Protection, Information Security, GRC, or related domains.
• Hands-on experience in ROPA is mandatory.
• Hands-on experience in conducting DPIAs is mandatory.
• Good working knowledge ofGDPR.
• Working knowledge ofIndia's DPDPA and CCPA/CPRA.
• Understanding of privacy risk assessments, gap assessments, and compliance audits.
• Knowledge of privacy principles, data lifecycle, data processing activities, and privacy risk management.
• Familiarity withISO 27001 and ISO 27701.
• Strong documentation, analytical, communication, and stakeholder-management skills.
• Ability to prepare professional reports, policies, assessment documents, and compliance roadmaps.

Preferred Skills

• Exposure toNIST and HITRUSTframeworks.
• Experience working in a consulting or client-facing environment.
• Understanding of cybersecurity governance and ISMS.
• Experience with privacy management or GRC tools will be an added advantage.
• Experience conducting privacy workshops and stakeholder interviews.

Preferred Certifications

• Candidates holding one or more of the following certifications will be preferred:
• CIPM – Certified Information Privacy Manager
• CIPP/E – Certified Information Privacy Professional/Europe
• CIPT – Certified Information Privacy Technologist
• ISO 27001 / ISO 27701 certifications will be an added advantage.

Ideal Candidate

We are particularly interested in candidates who haveactually prepared ROPAs and conducted DPIAs as part of their current or previous roles, rather than candidates with only theoretical knowledge of these activities.

The candidate should be comfortable explaining:

How a ROPA is created and maintained.

What information is collected from business/process owners for a ROPA.

When a DPIA is required.

How privacy risks are identified and assessed during a DPIA.

How remediation and risk mitigation actions are documented and tracked.

How GDPR/DPDPA requirements are translated into practical organizational controls.

Must-have skills

data protection, GDPR, Data Protection Impact Assessment

Good-to-have skills

Data Privacy, Records of Processing Activities