Director / VP - Data Protection Officer

SMBC Group; New Delhi; On-site; INR 400,000 - 700,000; Full time

Job summary

SMBC Group is seeking a Data Protection Officer in India to lead privacy governance, establish and enhance the data protection framework, and ensure compliance with DPDP, RBI guidelines, and global privacy practices. You will advise senior management and coordinate with Legal, Risk, IT, Compliance, and Operations to embed privacy-by-design and manage DPIA/PIA processes.

The role includes managing data subject requests, privacy incidents, and reporting privacy metrics to executive forums, with a

Qualifications

• At least 15+ years of experience across data privacy, protection, information security and risk.
• Experience implementing EU GDPR and / or leading organisation-wide data privacy, data protection or data governance programmes including DPDP.
• Experience in cross-functional stakeholder management including IT/IS, operations, governance, risk & compliance.
• Graduate or postgraduate qualification; privacy certifications preferred.

Responsibilities

• Develop and maintain the Bank’s privacy governance framework, strategy, policies, standards, procedures and operating model to ensure clear ownership and formal accountability across the data privacy lifecycle.
• Interpret and monitor applicable privacy requirements; advise stakeholders on regulatory impact and actions required.
• Drive enterprise privacy programme implementation, including privacy controls, monitoring mechanisms and privacy-by-design/default integration.
• Develop policies on data governance management and enhance data preparation, information management and data utilization policies.
• Conduct privacy risk assessments, DPIA/PIA reviews and data flow assessments to mitigate privacy risks.
• Govern data subject requests, grievance redressal, privacy incidents and breach response with cross-functional collaboration.
• Oversee privacy awareness, training, third-party privacy obligations and vendor compliance monitoring.
• Prepare privacy dashboards, metrics and reports for senior management and governance committees.

Skills

Privacy governance

Data protection

Regulatory interpretation

Stakeholder management

Privacy by design

Privacy risk management

Education

Graduate / Post-graduate qualification

Privacy certifications (CIPP, CIPM, CIPT, CISSP, ISO 27701)

Job description

The Data Protection Officer will serve as the central privacy leader responsible for establishing, implementing, governing, and continuously enhancing the Bank’s data protection and privacy framework. The role is accountable for supporting compliance with applicable data protection requirements, including the Digital Personal Data Protection Act, 2023, DPDP Rules, relevant RBI expectations / guidelines, and appropriate global privacy best practices.

The DPO will advise senior management and coordinate with Business, Technology, Information Security, Data Governance, Compliance, Legal, Risk, Operations and other relevant teams to embed privacy governance, privacy-by-design, risk assessment, incident response, grievance redressal and management reporting across the Bank.

The role is also responsible for promoting effective data governance, data management, data preparation and responsible data analysis and utilization practices to support regulatory compliance, risk management and business decision-making, including policies guided by applicable regulations in the offices supervised by SMBC India.

Primary Responsibilities

• Develop and maintain the Bank’s privacy governance framework, strategy, policies, standards, procedures and operating model to ensure clear ownership and formal accountability across the data privacy lifecycle.
• Interpret and monitor applicable privacy requirements, including DPDP Act / Rules, RBI expectations and relevant global privacy practices; advise stakeholders on regulatory impact and required implementation actions.
• Drive enterprise privacy programme implementation, including privacy controls, monitoring mechanisms, privacy-by-design / default and integration of privacy requirements into products, processes, technologies and change initiatives.
• Develop and plan overall policies on data governance management based on applicable regulations in the offices supervised by SMBC India; enhance data preparation, information / data management framework and determine operating policies for data analysis and responsible data utilization.
• Conduct or oversee privacy risk assessments, DPIA / PIA reviews / audits, high-risk processing reviews, data flow assessments and data inventory maintenance to identify, assess, mitigate and monitor privacy risks.
• Govern data subject requests, grievance redressal, privacy incidents and breach response by coordinating with Legal, Compliance, Information Security, Technology, Business and Operations teams, including regulatory or data subject communication where applicable.
• Oversee privacy awareness, training, third-party privacy obligations and vendor compliance monitoring to strengthen organizational privacy capability and third-party accountability.
• Prepare privacy and data governance dashboards, metrics and periodic reports for senior management, executive / board-level forums and relevant governance committees to monitor progress, adoption, exceptions and residual risks.

Knowledge, Skills, Experience & Qualifications

Knowledge Requirements: Strong understanding of privacy laws and data governance frameworks, including DPDP Act / Rules, RBI expectations, privacy governance, data governance management, privacy risk management, DPIA / PIA, data subject rights, grievance redressal, privacy incident management and third-party data protection obligations.

Specialist / technical skills: Ability to design and implement privacy, data governance and data management frameworks, policies, controls and monitoring mechanisms; familiarity with data flow mapping, data inventory, data preparation, data quality, data analysis / utilization governance, consent management, data masking, anonymisation, security protocols, IT infrastructure and privacy management tools.

Behavioural / management skills: Executive stakeholder management, regulatory interpretation, enterprise governance, strategic leadership, programme management, risk management, communication, cross-functional collaboration and ability to develop privacy and data governance capabilities.

Relevant Experience: At least 15+ years of experience across data privacy & protection, information security and risk. Prior experience in implementing EU GDPR and / or leading and managing organisation-wide data privacy, data protection or data governance programme(s), such as DPDP. Experience in cross-functional stake-holder management including but not limited to IT/IS, operations, governance, risk & compliance.

• Education and Certifications: Relevant graduate / Post-graduate qualification. Preferred Data Privacy / Data Protection certifications include Certified Information Privacy Professional (CIPP), Certified Information Privacy Manager (CIPM), Certified Information Privacy Technologist (CIPT), Certified Information Systems Security Professional (CISSP), ISO 27701 or equivalent.