Internal & External Interactions
Internal Interaction With:
· CMD – Reporting line for DPO; receives
strategic direction and escalates critical privacy matters.
· Field Operations & Survey Teams –
Governs on-ground data collection practices, consent mechanism deployment, and
surveyor training.
· Data Analysis & Research Teams –
Oversees lawful processing, purpose limitation, and data minimisation at the
analytics layer.
· IT & Information Security Teams –
Collaborates on technical safeguards, encryption, access controls, and breach
response.
· Legal & Contract Teams – Reviews
vendor contracts, data processing agreements, and cross-border transfer clauses.
· HR & Training Teams – Co-designs and
mandates DPDP awareness training across the organisation.
· Product & Technology Teams – Provides
privacy-by-design oversight for any digital tools, apps, or platforms used in
survey operations.
External Interaction With:
· Data Protection Board of India (DPBI) –
Primary regulatory liaison; handles notices, complaints, and audit
correspondence.
· Survey Respondents (Data Principals) –
Manages grievance redressal, responds to access/correction/erasure requests
under Sections 11–13.
· Client Organisations (Brands, Institutions,
Governments) – Negotiates data processing agreements and manages
purpose-limited disclosures.
· Third-Party Vendors & Data Processors – Audits data processors for compliance and enforces contractual data
protection obligations.
· Independent Data Auditors – Facilitates
statutory annual audits as required under SDF obligations.
· Legal Counsel & External Privacy Advisors – Engages on complex regulatory matters, litigation support, and emerging
compliance questions.
· Government & Regulatory Bodies –
Engages with MeitY and sector regulators on policy consultations relevant to
consumer data intelligence.
Requirements & Skills
1. Regulatory Compliance & Legal Interpretation
- Serve
as the organisation's authoritative expert on the DPDP Act, 2023, DPDP
Rules, 2025, and all subordinate regulations, guidelines, and circulars
issued by MeitY and the Data Protection Board of India.
- Provide
binding legal interpretation on data protection obligations applicable to
AXIS MY INDIA's survey and analytics operations.
- Monitor
regulatory developments and proactively update compliance policies before
statutory deadlines.
- Advise
on lawful bases for processing — including consent management, legitimate
use, and obligations under Section 7 and Section 8 of the DPDP Act.
2. Consent Management & Data Principal Rights
- Design
and implement a robust consent management framework for field survey
operations, ensuring notices are clear, specific, and provided in the
local language of the respondent.
- Establish
mechanisms for respondents to withdraw consent, access their data, seek
correction, erasure, and grievance redressal as mandated under Sections
11–13 of the DPDP Act.
- Maintain
auditable records of consent collection across all field survey
touchpoints — both digital and paper-based.
- Respond
to Data Principal requests within the timelines stipulated by the DPDP
Rules.
3. Data Protection Impact Assessments (DPIAs)
- Lead
periodic DPIAs for all high-risk processing activities — including
large-scale village surveys, biometric data collection (if any), analytics
profiling, and cross-border data transfers.
- Identify
residual risks and design mitigation measures in collaboration with IT,
Legal, and Operations.
- Maintain
DPIA registers and ensure they are reviewed on a defined schedule or
triggered by material changes in processing activities.
4. Information Security & Technical Safeguards
- Work
with IT teams to ensure appropriate technical and organisational measures
are implemented — including encryption of survey data, role-based access
controls, data masking in analytics systems, and secure transmission of
field data.
- Oversee
the organisation's data breach detection, reporting, and response
procedures as per Section 8(6) of the DPDP Act and CERT-In Directions.
- Ensure
personal data is not retained beyond the purpose for which it was
collected — enforce data retention and deletion schedules.
5. Third-Party & Vendor Compliance
- Review
and approve all Data Processing Agreements (DPAs) entered into with
clients, sub-processors, cloud vendors, analytics partners, and government
agencies.
- Conduct
regular vendor due diligence and audits to verify that data processors
comply with AXIS MY INDIA's contractual data protection obligations.
- Maintain
a Register of Processing Activities (RoPA) documenting all internal and
external data flows.
- Manage
cross-border transfer compliance for any data shared with international
clients or processed on overseas platforms.
6. Training, Awareness & Culture
- Design
and deliver mandatory DPDP training programmes for field surveyors, data
analysts, operations staff, and senior management.
- Build
a privacy-by-design culture across product and technology development,
ensuring data minimisation is embedded from the outset.
- Publish
internal privacy bulletins and handle ad-hoc advisory queries from
business units.
7. Regulatory Liaison & Grievance Management
- Act
as the sole authorised point of contact for the Data Protection Board of
India — receive, acknowledge, and respond to regulatory notices within
prescribed timeframes.
- Maintain
and operate a structured Grievance Redressal Mechanism accessible to all
survey respondents.
- Log,
investigate, and resolve all privacy complaints within the time limits
mandated by the DPDP Rules.
- Represent
AXIS MY INDIA in any inquiry, investigation, or adjudicatory proceedings
before the Data Protection Board.
8. Independent Audits & Reporting
- Facilitate
and co-ordinate the annual Independent Data Audit as required for
Significant Data Fiduciaries under DPDP Rules.
- Prepare
and present quarterly and annual data protection compliance reports to the
Board of Directors.
- Track
and report on key privacy KPIs — consent rates, DPIA completion, breach
response times, Data Principal request resolution, and audit findings.
Roles & Responsibilities
Ensure —
✔ Full organisational compliance
with the DPDP Act, 2023 and DPDP Rules, 2025 at all times.
✔ Valid, informed, and auditable
consent is obtained from every survey respondent before personal data
collection.
✔ Data Principals' rights —
access, correction, erasure, grievance — are honoured within regulatory
timelines.
✔ Data breaches are identified,
contained, and reported to the Data Protection Board within 72 hours of
discovery.
✔ All vendors and data
processors are contractually bound and monitored for DPDP compliance.
✔ DPIAs are completed for all
new, modified, or high-risk processing activities before they go live.
✔ AXIS MY INDIA's privacy
notices are accurate, current, and available in accessible formats and local
languages.
Carry Out —
✔ Periodic internal audits and
privacy health checks across field operations, IT systems, and analytics
processes.
✔ Annual co-ordination of the
Independent Data Audit mandated for SDFs.
✔ DPDP training and
sensitisation programmes for all staff who handle personal data.
✔ Maintenance and regular update
of the Register of Processing Activities (RoPA).
✔ Review of all new contracts,
product features, or processing activities for privacy compliance before
sign-off.
✔ Regulatory correspondence and
representation before the Data Protection Board of India.
Contribute —
✔ Strategic input to the Board
on emerging privacy risks, regulatory changes, and compliance investment
priorities.
✔ Privacy-by-design
recommendations at the ideation stage of new survey methodologies, digital
tools, or analytics products.
✔ Industry-level engagement on
data protection policy in the market research and consumer intelligence sector.
✔ Continuous improvement of AXIS
MY INDIA's data governance maturity — targeting recognised frameworks such as
ISO 27701.
Competencies
Technical Competencies
Behavioural Competencies
• DPDP Act & DPDP Rules Mastery
• High Personal Integrity & Independence
• Consent Architecture & Management
• Courageous Communication — Board Advisory &
Pushbacks
• DPIA & Risk Assessment Methodology
• Stakeholder Influence & Collaboration
• Information Security Governance
• Analytical Thinking & Risk Judgement
• Data Breach Management & CERT-In Compliance
• Empathy for Data Principals (Rural/Vulnerable)
• Vendor Due Diligence & DPA Drafting
• Cross-functional Leadership
• Privacy-by-design & Data Minimisation
• Attention to Detail & Documentation Discipline
• RoPA Management & Record Keeping
Education & Experience
- Degree
(Essential): Bachelor’s degree in law, Information Technology,
Computer Science, Cybersecurity, Business Administration, or a related
field. Postgraduate diploma or Master's degree in Data Privacy,
Information Security, or Cyber Law (preferred).
- Degree
(Preferred): MBA with specialization in Compliance / Risk Management.
- Experience: Minimum 8–12 years in data protection, privacy law, information security
compliance, or regulatory affairs — of which at least 3 years in a DPO,
Privacy Counsel, or equivalent senior role.
- Sector
Exposure: Prior experience in market research, consumer intelligence,
FMCG data, telecom, healthcare, or large-scale field data operations is
highly desirable.
- Certifications
(Essential): CIPP/A (Certified Information Privacy Professional –
Asia) or equivalent; and / or FIP (Fellow of Information Privacy) from
IAPP.
- Certifications
(Preferred): CIPM, CIPT, ISO 27001 Lead Implementer / Auditor, CDPSE
(Certified Data Privacy Solutions Engineer).
- Regulatory
Knowledge: Deep expertise in DPDP Act 2023, DPDP Rules 2025; working
knowledge of IT Act 2000, IT (Amendment) Act 2008, CERT-In Directions, and
awareness of GDPR for cross-border context.
Key Metrics for Success
KPI
Target / Benchmark
Consent Collection Rate across all field surveys
100% of surveys — zero data collection without valid
consent
Data Principal Requests Resolved
100% resolved within DPDP Rules prescribed period
(Access/Correction/Erasure)
Data Breach Reporting to DPBI
100% reported within 72 hours of confirmed detection
Annual Independent Data Audit completion
Completed before regulatory deadline each year, zero
critical findings unresolved
DPIA completion for processing activities
100% completed prior to go-live of any new survey or
analytics process
Vendor / Data Processor compliance audit coverage
100% of Tier-1 data processors audited annually
Employee DPDP Training completion rate
100% of data-handling staff trained within 30 days of
joining and annually
Grievance Resolution Rate (respondents)
100% acknowledged within 48 hours; resolved within
statutory timelines
Regulatory Penalties / Adverse orders from DPBI
Zero uncontested penalty orders
Board Privacy Compliance Report
Quarterly reports submitted on time with zero critical
overdue action items