PTS Consulting
Website:
ptsconsulting.in
Job details:
We are expanding our DPDP delivery team for upcoming implementation engagements and are looking for Two Data Privacy Leads. This is a hands-on leadership role: you will personally carry out discovery, mapping, RoPA and DPIA work, and you will lead the engagement end to end – from scoping through to hardening, consent and incident-readiness deliverables.
Engagement Snapshot:
Role - Data Privacy Lead (DPDP)
Engagement type - Contract
6-month rolling; extension subject to project waves and performance
Experience
8–12 years overall, with at least 4 years in data privacy / data protection
Location
One position is based in Chennai and the Second position is based in Bengauru. Local candidates preferred.
Mostly On-site with some hybrid
Reporting to
Engagement Lead / Project Partner, PTS Consulting LLP
Start
November 1st Week; start date to be confirmed with shortlisted candidates
Key Responsibilities:
The Data Privacy Lead will be expected to perform the following personally and to a consulting-deliverable standard.
• Process map review. Review business process maps and SIPOC documentation, identify where personal data is collected, used, shared, stored and disposed of, and validate findings with process owners.
• Data discovery and classification. Independently plan and run data discovery across applications, databases, file shares and collaboration tools; classify personal data elements by category and sensitivity, using discovery tooling and manual techniques.
• Data-to-process mapping and DPDP scope. Map discovered data to business processes and activities, and clearly articulate the scope of DPDP coverage for each activity – including applicability, legal basis, exemptions and the roles of data fiduciary and data processor.
• Record of Processing Activities (RoPA). Prepare and maintain a complete, defensible RoPA linked to processes, systems, data elements, purposes, retention and third-party sharing.
• DPIA and hardening. Conduct Data Protection Impact Assessments, and oversee the resulting privacy hardening and security hardening work – tracking recommendations, owners and closure through to verified completion.
• Consent management. Oversee consent management design and rollout – notices, purpose-wise consent, preference and withdrawal handling, and records of consent – working with legal, product and technology teams.
• Incident response and breach notification. Manage the personal data breach response lifecycle: triage, containment, assessment, notification to the Data Protection Board and affected Data Principals as required, and post-incident corrective action.
• Engagement leadership. Lead the engagement team, own the work plan and quality of deliverables, and manage client stakeholders up to senior leadership.
What we are looking for:
Essential:
• 8–12 years of overall experience, including 4 or more years of hands-on data privacy or data protection delivery (DPDP Act).
• Demonstrated, in-depth experience in every one of the responsibilities listed above – not a subset. You should be able to describe what you personally did on each.
• Experience of independently running data discovery and classification and translating the output into process-level scope and a RoPA.
• Experience of conducting DPIAs and taking the outcomes through to implemented privacy and security controls.
• Practical experience of consent management and of handling a personal data breach including regulator and individual notification.
• Proven record of leading a privacy engagement successfully with client leadership, a delivery team and defined deadlines.
• Clear, structured written and verbal communication; strong, well-organised documentation.
Preferred / nice to Have:
• Certifications such as CIPP/E, CIPM, DCPP (DSCI), ISO/IEC 27001 Lead Auditor or Implementer, ISO/IEC 27701, CISA or CISSP.
• Familiarity with data discovery, consent management or privacy management platforms.
• Exposure to multi-entity corporate groups and to manufacturing, healthcare, financial services, technology or consumer-facing businesses.
• Working knowledge of information security controls (access control, encryption, logging, retention and disposal).
A note on Fit
This is a delivery role. We are looking for practitioners who have done the work themselves. Candidates whose experience is primarily in policy drafting, awareness training or advisory review without hands-on discovery, mapping and assessment work may find the role is not the right fit.
How to express Interest:
Please send your CV and a short note (half a page) describing one privacy engagement in which you personally carried out data discovery, RoPA preparation and a DPIA, and what your role was in leading it.
Apply to: [insert application email / LinkedIn application link]
Only shortlisted candidates will be contacted.
Click on Apply to know more.
