Data Protection Officer (DPO)

Hdfc Securities; Mumbai; On-site; INR 1,200,000 - 1,800,000; Full time

Job summary

Hdfc Securities is seeking a Data Protection Officer to lead governance and compliance for personal data across the organization. The role ensures secure, lawful, and transparent data processing for customers, employees, and partners, while aligning with Indian and global privacy standards.

The DPO will coordinate with regulatory bodies, internal audits, and cross-functional teams to implement privacy policies, conduct audits, and manage data subject rights and incident response.

Qualifications

• Strong understanding of DPDP Act (India) and global privacy frameworks
• Knowledge of financial services data environment
• Stakeholder management and regulatory engagement
• Risk-based thinking and governance orientation
• Strong communication and policy drafting skills

Responsibilities

• Lead implementation and ongoing compliance with the DPDP Act and evolving Indian data protection regulations
• Align internal practices with SEBI, RBI, and financial sector data handling guidelines
• Develop and maintain privacy policies, SOPs, and data handling standards
• Conduct periodic privacy audits and compliance assessments
• Define governance frameworks for data collection, consent, storage, retention and deletion
• Ensure privacy-by-design principles are integrated into processes and systems
• Act as the primary point of contact for regulatory authorities and internal audit teams
• Coordinate responses to regulatory queries, inspections, and audits
• Manage data subject rights, consent management and DSARs
• Define incident and breach management protocols and coordinate with InfoSec and Legal
• Evaluate third-party vendors for data protection compliance and add data protection clauses in contracts
• Drive training and awareness on data privacy obligations and secure data handling

Skills

DPDP Act

GDPR concepts

Data governance

Regulatory engagement

Policy drafting

Stakeholder management

Communication

Job description

Role Overview

The Data Protection Officer (DPO) will be responsible for ensuring compliance with applicable data protection and privacy regulations, including the Digital Personal Data Protection (DPDP) Act, 2023, and supporting global privacy frameworks where applicable.

The role will act as a central point of governance for personal data, ensuring that customer, employee, and partner data is processed securely, lawfully, and transparently across all business units.

Key Responsibilities

1. Data Privacy Governance & Compliance

• Lead implementation and ongoing compliance with the DPDP Act and evolving Indian data protection regulations
• Align internal practices with SEBI, RBI, and financial sector data handling guidelines
• Develop and maintain privacy policies, SOPs, and data handling standards
• Conduct periodic privacy audits and compliance assessments

2. Data Lifecycle Management

• Define governance frameworks for:
  • Data collection & consent management
  • Data classification & storage
  • Data retention & deletion
• Ensure privacy-by-design principles are integrated into business processes and systems

3. Stakeholder & Regulator Interface

• Act as the primary point of contact for:
  • Regulatory authorities
  • Internal audit and compliance teams
• Support responses to regulatory queries, inspections, and audits

4. Data Subject Rights & Consent Management

• Ensure mechanisms for managing:
  • Consent capture and withdrawal
  • Data subject access requests (DSARs)
• Monitor adherence to timelines and regulatory requirements

5. Incident & Breach Management

• Define protocols for identifying and reporting data breaches
• Coordinate with InfoSec and Legal teams to:
  • Assess impact
  • Ensure timely reporting
  • Drive corrective actions

6. Vendor & Third-Party Risk

• Evaluate third-party vendors for data protection compliance
• Ensure appropriate data protection clauses in contracts
• Monitor vendors handling sensitive customer/financial data

7. Training & Awareness

• Drive organization-wide awareness on:
  • Data privacy obligations
  • Secure data handling practices
• Conduct periodic training programs for employees and business teams

8. Cross-functional Collaboration

• Partner with:
  • Technology (for system controls and security)
  • HR (for employee data governance)
  • Business teams (customer/transaction data)
• Provide advisory on new products, digital initiatives, and analytics use cases

Key Skills & Competencies

• Strong understanding of:
  • DPDP Act (India)
  • Global frameworks (GDPR concepts are preferred)
• Knowledge of financial services data environment (trading accounts, KYC data, transaction data)
• Stakeholder management and regulatory engagement
• Risk-based thinking and governance orientation
• Strong communication and policy drafting skills