Data Risk Advisor (DRA)

Standard Chartered India; Maharashtra; On-site; INR 900,000 - 1,300,000; Full time

Job summary

Standard Chartered India is seeking a Data Risk Advisor to monitor compliance with the DPDP Act, 2023, and data protection laws. You will be the primary liaison for the DPBI and data principals, steering a governance framework that aligns regulatory requirements with business objectives.

You will lead DPIAs, incident response, and privacy training, while collaborating with regulators and internal stakeholders to uphold the bank's commitment to data protection and ethical conduct.

Qualifications

• Degree in law, cybersecurity, IT or a related field.
• Professional certifications such as Certified (as applicable) may be considered an advantage.

Responsibilities

• Act as the nodal officer for addressing grievances and requests from Data Principals.
• Oversee DPIAs for new processing activities with high risk to data principals.
• Interface with the Data Protection Board of India and regulators.
• Develop and implement incident management and breach response protocols.
• Educate employees on DPDP Act obligations and privacy by design principles.

Skills

Data Protection

Compliance

Legal

Cybersecurity

Risk Management

Education

Degree in law, cybersecurity, IT or related field

Job description

Job Summary

The Data Risk Advisor (DRA) is responsible for monitoring compliance with the Digital Personal Data Protection (DPDP) Act, 2023, and other applicable data protection laws. The DRA will serve as the primary point of contact for the Data Protection Board of India (DPBI) and data principals (individuals whose data is being processed) regarding all data privacy matters. This role requires a strategic leader who can implement and oversee an effective data privacy governance framework while balancing compliance with business objectives.

Key Responsibilities

Strategy

Support Head, CFCR Governance to

• Proactively develop regulatory relationships with regulators in Country through a structured engagement programme with consistent adherence to regulatory expectations.
• Ensure that Standard Chartered Bank's operations in the country are in line with regulatory expectations and Group requirements.
• to set and implement the vision, strategy, direction and leadership, consistent with the vision and strategy for CFCR and in support of the Group's strategic direction and growth aspirations.
• Promote the culture and practice of compliance with compliance standards (including conducting business within regulatory requirements, and to high ethical standards) within the Bank and embed a Here for good culture and the Group Code of Conduct.

Business

• Support relevant stakeholders to make decisions based on current and possible future policies, practices, and trends.
• In conjunction with the relevant stakeholders, analyse the impact of regulatory compliance matters on the bank and its operations.
• Use general knowledge of business products undertaken in the jurisdiction to work with business compliance specialists to respond to regulatory questions and keeps the in-Country regulators updated on developments in the Bank.

Processes

Data Principal rights and grievance redressal

• Handle requests: Act as the nodal officer for addressing grievances and requests from Data Principals.
• Manage rights: Ensure the organization has procedures in place to honor data principal rights, such as the right to access, correct, and erase personal data.
• Ensure timely responses: Supervise processes for responding to Data Principal requests within the statutory timelines.
• Transparent grievance redressal - Ensure effective and transparent grievance redressal mechanisms are in place and followed.

Data protection impact assessments (DPIA)

• Oversee DPIAs: Supervise and advise on Data Protection Impact Assessments for any new processing activities that pose a high risk to data principals.
• Mitigate risk: Advise on appropriate risk mitigation strategies for new and existing projects.
• Integrate privacy by design: Ensure that data protection principles are integrated into the design and development of new products, systems, and services.

Regulatory liaison and reporting

• Interface with the Board: Act as the single point of contact for the Data Protection Board of India.
• Collaborate with authorities: Collaborate with the Data Protection Board during any audits, investigations, or inquiries.
• Report data breaches: Oversee the development and implementation of an incident management and breach response protocol. Ensure timely notification of breaches to the Data Protection Board and affected Data Principals.
• Data Security: Oversee the investigation and remediation of data security incidents.

Advisory and Training

• Educate employees: Inform and advise the organization and its employees on data protection obligations under the DPDP Act.
• Develop training programs: Create and deliver targeted training and awareness programs to foster a company-wide culture of privacy and data protection.
• Privacy by Design: Integrate the principles of "Privacy by Design" into the development of new products, services and systems.
• Data Advisory: Provide advisory to stakeholders in country and Group on the requirement and the obligations under the DPDP Act.

Policy Development and Management

• Policies and Procedures: Develop, implement and maintain internal data protection policies, guidelines, and procedures.
• Third Party Contracts: Ensure all vendor and third-party contracts include appropriate data protection.

Compliance oversight and governance

• Monitor compliance: Regularly monitor and enforce compliance with the DPDP Act and other applicable data protection laws.
• Establish frameworks: Develop, implement, and maintain a robust data privacy governance framework and internal policies to ensure efficient data utilization.
• Record processing activities: Maintain a comprehensive and verifiable record of all data processing activities.
• Audit data practices: Work closely with the Compliance Testing and Internal Audit team for review of data privacy and risk assessments to identify and rectify compliance gaps.

Regulatory & Business Conduct

• Display exemplary conduct and live by the Group's Values and Code of Conduct.
• Take personal responsibility for embedding the highest standards of ethics, including regulatory and business conduct, across Standard Chartered Bank. This includes understanding and ensuring compliance with, in letter and spirit, all applicable laws, regulations, guidelines and the Group Code of Conduct.
• Effectively and collaboratively identify, elevate, mitigate and resolve risk, conduct and compliance matters.

Key stakeholders

Internal

• Region CFCR; Group CFCR; Business; GIA; GBS

External

• RBI; Auditors , Data Protection Board

Skills And Experience

• Data Protection
• Compliance
• Legal
• Cybersecurity
• Risk Management

Qualifications

• Education: A degree in law, cybersecurity, IT or a related field. Professional certifications such as Certified