Legal Compliance Manager - APMEA

Sodexo; Mumbai; On-site; INR 1,500,000 - 2,500,000; Full time

Job summary

Sodexo in Mumbai is seeking a Legal & Compliance Manager to lead data protection, RBC compliance and India GBS legal support. You will drive privacy programs, advise on regulatory matters, and manage a small India-based team delivering contract reviews and compliance services.

The role requires a qualified lawyer with strong English, experience in data protection and corporate compliance, and the ability to coordinate across regional teams and regulators. Occasional travel may be required.

Qualifications

• Qualified lawyer with admission to practise in India or a common law jurisdiction.
• Hands-on experience in data protection, privacy and RBC compliance.
• Experience with GDPR or comparable privacy frameworks.
• Leadership of a small legal/compliance team in a shared services or GBS environment.
• Experience in contract reviews, RFP support and commercial negotiations.

Responsibilities

• Advise the business in APMEA on data protection and privacy laws, including GDPR where relevant.
• Draft, review and negotiate data processing agreements and data sharing provisions.
• Lead or review DPIAs, privacy impact assessments and privacy-by-design reviews.
• Manage data subject requests, privacy complaints and data breaches with regulatory notification.
• Lead local RBC policy implementation, training, monitoring and remediation.
• Provide practical legal advice on contractual risks and ESG compliance within India GBS.
• Coach and develop junior legal/compliance staff and ensure timely delivery.
• Coordinate with regulators, external counsel and Group Data Protection Office as needed.

Skills

Data protection

Privacy compliance

Regulatory knowledge

Stakeholder management

English proficiency

Education

Law degree

Tools

OneTrust

Job description

Position Title: Legal & Compliance Manager

Scope: Primary responsibility for data protection and privacy in APMEA deployment of RBC compliance policies and programs in the region and the local implementation in India, and for provision of legal support to India GBS. The role may also support English-speaking countries in the APMEA region, as designated by the Regional General Counsel.

Reports to: Regional General Counsel, APMEA

Team Leadership: A small India GBS-based team covering data protection, RBC compliance, and junior legal support for contract and RFP reviews.

Key interfaces: Regional and country Legal & Compliance teams; Group Data Protection Office; Group Compliance and Ethics; local management; HR; Finance; Procurement; IS&T and Information Security; operational leadership; external counsel and regulators.

Employment type: Full time

Purpose of the Role:

The Legal & Compliance Manager is a qualified lawyer who supports Sodexo's data protection and Responsible Business Conduct (RBC) compliance agenda. The role has primary responsibility for data protection and privacy matters within APMEA, driving the rollout and deployment of RBC compliance policies in the region and local implementation in India, and provision of legal support to India GBS. The role may also support countries in the APMEA region, depending on business priorities and as designated by the Regional General Counsel.

The role has three complementary dimensions: (i) data protection and privacy; (ii) RBC compliance; (iii) legal matters of India GBS; (iv) leadership of a small India GBS-based legal, compliance and data protection team. The role holder will provide practical, risk-growth balanced advice; drive and deploy designated Group programs; implement relevant policies and controls; deliver training; monitor compliance; and report material risks to appropriate stakeholders.

Key Responsibilities:

2.1 Data Protection and Privacy

• Advise the business in APMEA (English-speaking markets), on applicable data protection and privacy laws, including Australia’s Privacy Act 1988, India’s Digital Personal Data Protection Act 2023 and, where relevant, the GDPR and other local privacy laws.
• Interpret and implement Sodexo's global data protection policies, standards and Binding Corporate Rules (BCR), identifying where local laws impose additional or different requirements.
• Advise on privacy notices, lawful bases, consent, data subject rights, employee privacy, monitoring, biometrics, CCTV, direct marketing and privacy implications of emerging technologies, including AI.
• Draft, review and negotiate data processing agreements, data sharing arrangements, international data transfer provisions and privacy clauses in client, supplier and technology contracts.
• Support vendor privacy due diligence and third-party privacy risk assessments in collaboration with Procurement, IS&T and Information Security.
• Lead or review Data Protection Impact Assessments and privacy-by-design reviews for new projects, systems and service offerings.
• Manage data subject requests, privacy complaints and personal data breaches, including assessment of regulatory and individual notification obligations.
• Lead data retention implementation for in-scope markets, including defining local retention periods with business owners, recording requirements in OneTrust, facilitating working groups, and monitoring deletion, archiving and remediation actions.
• Support BCR monitoring, quarterly and annual reporting, risk registers, audits, transfer assessments and corrective actions requested by the Group Data Protection Office.
• Cooperate with relevant data protection authorities and coordinate external counsel support where required.

2.2 Responsible Business Conduct (RBC) Compliance

• Drive and deploy Sodexo's Group RBC and compliance programs within the scope designated by the Regional General Counsel, working in coordination with Group Compliance and relevant regional and country stakeholders.
• Serve as the legal and compliance business partner for designated Group compliance programs, including the Third-Party Risk Evaluation Policy, Gifts and Hospitality Policy, Sanctions Policy, and other RBC or ethics-related initiatives assigned by the Regional General Counsel.
• Lead the local implementation, rollout and operationalization of these RBC policies and compliance programs in India, including local procedures, stakeholder guidance, training and awareness, monitoring, remediation and reporting. Ensure that local implementation in India is aligned with Group standards and applicable Indian legal and regulatory requirements.
• Advise management and business teams on compliance risks and controls, including anti-bribery and anti-corruption, conflicts of interest, gifts and hospitality, third-party integrity, competition law, sanctions and other RBC topics within the role’s remit.
• Conduct compliance risk assessments and support integrity due diligence and risk evaluation of relevant third parties, business partners and proposed transactions for the region as directed by regional GC, including HRTP risk assessment/sanction screening, in accordance with group compliance requirements.
• Identify root causes and lessons learned from compliance incidents and support proportionate remediation, control enhancement and disciplinary or contractual follow-up as appropriate.
• Monitor relevant legal and regulatory developments and enforcement trends and assess their potential impact on Sodexo’s operations in India.
• Provide compliance training for the RBC policies for the designated stakeholders.

2.3 Team Leadership and India GBS Legal Support

• Lead, coach and develop a small India GBS-based team whose responsibilities may include data protection, RBC compliance and other legal support activities.
• Provide oversight, guidance and quality assurance to junior legal counsel supporting commercial contract reviews, RFP and bid reviews, and related legal matters handled through India GBS.
• Draft, review and negotiate commercial contracts, supplier contracts and related legal documents for India GBS, and provide practical legal advice on associated contractual risks and issues.
• Plan resources, allocate and prioritize work, manage workloads and establish appropriate service standards to ensure timely and high-quality delivery.
• Build team capability through regular coaching, knowledge sharing, templates, playbooks, training and professional development.
• Foster a collaborative, solution-oriented and business-partnering culture while maintaining strong legal, risk management and compliance standards.

2.4 Training, Awareness and Stakeholder Engagement

• Design and deliver practical training and awareness activities covering data protection, RBC compliance and relevant legal topics.
• Build effective working relationships with local management and key functions, and support a network of privacy, compliance and legal contacts across the in-scope markets.
• Provide timely, commercially aware advice that enables business objectives while protecting Sodexo’s legal, regulatory and reputational interests.
• Escalate material privacy, compliance or legal risks promptly to the Regional General Counsel and relevant Group functions.

3. Qualifications and Experience

• Law degree and admission to practise as a lawyer, preferably in India or another common law jurisdiction.
• Approximately 6-8 years’ post-qualification experience gained in-house in a multinational company and/or with a leading law firm.
• Demonstrated hands-on experience in data protection and privacy, including GDPR or comparable privacy frameworks, DPIAs, international data transfers, retention, processor arrangements and breach management.
• Meaningful experience advising on corporate compliance or ethics matters, including deployment and local implementation of compliance policies and controls, risk assessment, training, third-party risk management, sanctions compliance and/or investigations.
• Experience supervising or developing junior legal, compliance or data protection professionals, preferably within a shared services or GBS environment.
• Experience in commercial contract review and RFP or bid support, with the ability to oversee junior legal counsel performing such work.
• Working knowledge of Australian and Indian legal and regulatory requirements relevant to data protection, together with Indian legal and regulatory requirements relevant to corporate compliance, and the ability to support additional APMEA English-speaking markets where assigned.
• Strong drafting, analytical and communication skills, with excellent written and spoken English.
• Ability to work independently across countries, cultures, functions and time zones, and to manage sensitive matters with discretion and sound judgment.
• Professional privacy certification such as CIPP/E, CIPP/A, CIPM or CIPT.
• Recognized compliance, ethics, anti-bribery, sanctions or investigations training/certification.
• Experience in a multi-site services, facilities management, food services or HR-intensive business.
• Familiarity with OneTrust, compliance case-management or third-party due-diligence tools.
• Experience engaging with regulators, supporting compliance audits.
• Pragmatic, business-focused and risk-based judgment.
• High integrity, independence, discretion and professional courage.
• People leadership, coaching and team development.
• Strong stakeholder management, influencing and cross-cultural collaboration skills.
• Ability to translate legal and policy requirements into practical controls and business guidance.
• Strong organizational skills and ability to manage competing priorities across data protection, compliance and legal service delivery.
• Clear, concise communication suitable for operational teams, senior management and Group stakeholders.

5. Key Performance Indicators

• Timely, high-quality and practical advice on data protection, RBC compliance and related legal matters.
• Effective deployment of designated Group compliance programs and implementation of relevant RBC policies in India.
• Effective leadership, workload management and capability development of the India GBS-based team.
• Consistent quality and timely delivery of direct and supervised commercial contract, supplier contract and RFP review support for India GBS.
• DPIAs, data subject requests, incidents and breach notifications handled within applicable timelines.
• Data retention and BCR reporting obligations completed on schedule, with remediation actions tracked to closure.
• Compliance risk assessments, third-party evaluations, sanctions and gifts and hospitality controls, monitoring reviews and investigation support delivered in accordance with agreed priorities and procedures.
• Training and awareness activities completed, with identified gaps and follow-up actions addressed.
• Material risks and incidents escalated promptly and accurately.
• Positive stakeholder feedback and demonstrable improvement in privacy, compliance and legal service delivery maturity.

6. Working Conditions

The role is based in Mumbai. Flexibility is required to support data protection stakeholders in Australia and India, RBC compliance implementation in India, and stakeholders in other assigned APMEA English-speaking markets, including calls across Asia-Pacific and European time zones. Occasional regional travel may be required.