Executive Data Privacy

Company Overview:

At Online PSB Loans Limited (OPL Innovate), a leading fintech company committed to innovation and ethical data practices, we prioritize protecting personal data in compliance with Indian laws. We are

seeking a dedicated Junior Data Privacy Manager to join our compliance team and support our efforts in maintaining high standards of data protection.

Website: https://www.opinnovate.com

Location: Ahmedabad (on-site)

Position: Executive - Data Privacy

Experience: 1-2 years of relevant experience in data privacy, compliance, legal, or risk management roles. Experience in handling personal data processing, consent management, or breach responses

in a Data Fiduciary environment is highly desirable.

Job Summary:

The Executive - Data Privacy will assist in implementing and monitoring data privacy policies, ensuring compliance with the Digital Personal Data Protection Act, 2023 (DPDP Act) and the Digital Personal Data

Protection Rules, 2025 (DPDP Rules). This junior-level role involves supporting day-to-day privacy operations, conducting assessments, and collaborating with cross-functional teams to safeguard digital

personal data. The ideal candidate should possess 1-2 years of experience in data privacy, compliance, or related fields and is eager to grow in a dynamic environment.

Key Responsibilities:

• Compliance Monitoring and Implementation: Assist in ensuring the OPL's processing of digital personal data adheres to the DPDP Act and Rules, including obligations for Data Fiduciaries such as obtaining verifiable consent, providing clear notices to Data Principals, and limiting data processing to specified lawful purposes.

• Consent Management: Support the development and maintenance of consent mechanisms, including working with Consent Managers (as defined under the DPDP Rules) to enable Data Principals to give, manage, withdraw, or deny consent easily. Ensure consents are free, specific, informed, unconditional, and unambiguous, with options for withdrawal and handling of consequences.

• Data Protection Assessments: Conduct preliminary Data Protection Impact Assessments (DPIAs) for new projects or processes, especially for Significant Data Fiduciaries, identifying risks related to volume, sensitivity, and potential harm to Data Principals.

• Breach Response and Notification: Aid in detecting, investigating, and responding to personal data breaches, including timely intimations to the Data Protection Board of India and affected Data Principals within 72 hours, as per Rule 7 of the DPDP Rules. Implement remediation measures and maintain breach logs.

• Rights Management for Data Principals: Facilitate the exercise of rights under the DPDP Act, such as access to information, correction, erasure, grievance redressal, and nomination. Ensure responses to requests are provided within prescribed timelines and maintain records of such interactions.

• Child and Vulnerable Data Handling: Assist in obtaining verifiable parental/guardian consent for processing children's data (under 18 years) and data of persons with disabilities, ensuring no tracking, behavioral monitoring, or targeted advertising that could harm them, with exemptions applied where appropriate (e.g., for educational or health purposes under Rule 12).

• Security Safeguards: Contribute to implementing reasonable security measures, including encryption, access controls, monitoring, and backups, to prevent breaches and ensure data integrity, confidentiality, and availability as outlined in Rule 6.

• Data Retention and Erasure: Monitor data retention periods, ensuring erasure after purpose fulfilment or after 3 years of inactivity for specified classes of Data Fiduciaries (per Rule 8 and Third Schedule), with prior intimations to Data Principals.

• Training and Awareness: Help to develop and deliver internal training programs on data privacy best practices, DPDP compliance, and employee duties to avoid impersonation or false grievances.

• Audits and Reporting: Support periodic audits, independent data auditors for Significant Data Fiduciaries, and preparation of reports for the Data Protection Board, as per requirements.

• Cross-Border Data Transfers: Assist in reviewing data transfers outside India, ensuring compliance with government notifications and restrictions under Section 16 of the DPDP Act.

• Policy Development: Collaborate on updating and reviewing privacy policies, notices, and contracts with Data Processors to align with DPDP requirements, including exemptions for research, archiving, or state functions.

• Grievance Redressal: Manage initial grievance handling, ensuring resolution within 90 days, and escalate to the Data Protection Board if needed.

Qualifications:

• Bachelor"s degree in law, Information Technology, Computer Science, or a related field.

• Any one certification in data privacy: DCPP or DCPLA of DSCI, CIPP, CIPM by IAPP), ISO 27701 PIMS Certification is preferred.

• Understanding of Indian data protection laws, including the DPDP Act, 2023, and DPDP Rules, 2025.

Skills and Competencies:

• Strong knowledge of key DPDP concepts: Data Principals, Data Fiduciaries, Consent Managers, Significant Data Fiduciaries, personal data breaches, and legitimate uses.

• Proficiency in tools for data mapping, risk assessment, and compliance tracking (e.g., privacy management software).

• Excellent analytical, communication, and problem-solving skills.

• Ability to work collaboratively with legal, IT, and business teams.

• Attention to detail and a commitment to ethical data practices.

• Familiarity with IT Act, 2000, and related regulations is a plus.

Preferred Attributes:

• Experience in sectors like technology, finance, or e-commerce where data processing volumes are high.

• Awareness of international data protection frameworks (e.g., GDPR) for comparative insights.

• Willingness to keep updated on evolving privacy regulations and Board notifications.