About the role

Data Protection – Governance & Risk

1. JOB DETAILS

Reports to: CISO

Location: Chennai, Tamil Nadu

An AVP is responsible for leading the implementation and monitoring of Northern Arc’s data privacy and protection framework. The role requires hands-on expertise in data privacy regulations, including the GDPR and SDPI Rules and understanding of DPDP Act with experience in privacy impact assessments, consent management, third-party privacy risk assessments, responding to privacy requests and managing incident response to breaches.

2. ORGANIZATIONAL OVERVIEW

Northern Arc Capital's mission is to provide efficient and reliable access to debt capital markets for institutions that impact low-income households. These include rural & urban micro finance institutions, retail NBFCs, and housing finance companies. Northern Arc Capital connects these institutions with capital markets and investors such as banks, insurance companies, and mutual funds through financial tools such as securitization, credit enhancement and debt structuring.

KEY RESPONSIBILITIES

Review and update data privacy policy and procedures in alignment with ISO 27701, DPDPA, SDPI Rules and all applicable regulatory requirements.
Lead and approve Privacy Impact Assessments (PIA) / Data Protection Impact Assessments (DPIA) for new projects/ systems, and critical third-party engagements.
Review personal data classification levels, ensure consistent implementation across business functions, and maintain the privacy risk register with timely updates and tracking.
Oversee compliance with data subject rights management, including access, correction, erasure, portability, etc., for SLA adherence and regulatory compliance.
Oversee consent management processes, including collection, recording, tracking, and withdrawal of consent for personal data processing; ensure alignment with Records of Processing Activities (RoPA), privacy policy, and applicable regulations.
Perform privacy risk assessments of third-party vendors during onboarding, periodic evaluation, and continuous monitoring.
Manage and track all privacy-related regulatory requirements, including DPDPA obligations, sectoral guidelines, cross-border data transfer rules, and internal audit observations.
Govern data classification, retention, minimization, and risk registers, ensuring consistent implementation across all business units.
Establish and manage key privacy risk and compliance metrics (KRIs, KPIs) and report them to senior management/committees.
Lead enterprise-wide privacy awareness initiatives, including campaigns, simulations, mandatory training.
Review IT and security systems/ product evaluations from a privacy compliance standpoint, guiding teams on data protection requirements during procurement and implementation.
Formulate strategies and initiatives to foster engagement with key internal and external stakeholders.
Oversee and lead the annual review cycle for all privacy and related policy documents, ensuring version control, regulatory alignment, and organizational adoption.
Collaborate with the Information Security team to maintain comprehensive records of all data assets and exports, while managing a data security incident response plan to ensure timely remediation. This includes conducting impact assessments, responding to security breaches, handling complaints and claims, managing notifications, and addressing data subject requests.
Monitor privacy-related alerts, incidents and breaches and ensure resolution in coordination with the respective teams.
Collaborate with IT, Information Security, and business teams to manage privacy risks across processes, systems, and third-party integrations.
Support the compliance department in regulatory reporting, incident notifications/ updates and compliance documentation, as required.
Involve in preparing privacy compliance dashboards, regulatory updates, and management committee decks for periodic management review meetings with senior management/ committee.

SKILLS AND QUALIFICATIONS

6+ years of hands-on experience in implementation of data privacy and protection frameworks, including audits and compliance monitoring.
Strong understanding of applicable privacy and data protection standard and regulatory requirements (DPDPA, SDPI Rules, ISO 27701, etc.).
ISO 27701 PIMS LI Certified (Preferred).
Professional certifications such as CIPP, CDPO or CIPM are beneficial.
Ability to understand and align with NBFC business processes.
Ability to work collaboratively across departments and manage multiple projects simultaneously.
Ability to handle confidential and sensitive information with the appropriate discretion.
Conceptual knowledge of IT infrastructure and security technologies (e.g., servers, development platforms, firewalls, NAC, routers).
Excellent verbal communication skills and proactive.

5. SPECIFICATIONS: QUALIFICATIONS, EXPERIENCE, & COMPETENCIES

Minimum Qualification: Graduate/ Post-Graduate

Minimum Experience: 6–8 years in data privacy and protection.

Competencies:

Result-oriented and persistent.
Analytical and detail oriented.
Strong communication and stakeholder management skills.