Data Risk Advisor (DRA)

About the Role

The Data Risk Advisor (DRA) is responsible for monitoring compliance with the Digital Personal Data Protection (DPDP) Act, 2023, and other applicable data protection laws. The DRA will serve as the primary point of contact for the Data Protection Board of India (DPBI) and data principals regarding all data privacy matters. This role requires a strategic leader who can implement and oversee an effective data privacy governance framework while balancing compliance with business objectives.

Key Responsibilities

Strategy Support

• Proactively develop regulatory relationships with regulators in Country through a structured engagement program with consistent adherence to regulatory expectations.
• Ensure that Standard Chartered Bank's operations in the country are in line with regulatory expectations and Group requirements.
• Set and implement the vision, strategy, direction, and leadership, consistent with the vision and strategy for CFCR and in support of the Group's strategic direction and growth aspirations.
• Promote the culture and practice of compliance with compliance standards within the Bank and embed a Here for good culture and the Group Code of Conduct.

Business

• Support relevant stakeholders to make decisions based on current and possible future policies, practices, and trends.
• In conjunction with relevant stakeholders, analyze the impact of regulatory compliance matters on the bank and its operations.
• Use general knowledge of business products undertaken in the jurisdiction to work with business compliance specialists to respond to regulatory questions and keep in-Country regulators updated on developments in the Bank.

Processes

Data Principal Rights and Grievance Redressal

• Act as the nodal officer for addressing grievances and requests from Data Principals.
• Ensure the organization has procedures in place to honor data principal rights, such as the right to access, correct, and erase personal data.
• Supervise processes for responding to Data Principal requests within statutory timelines.
• Ensure effective and transparent grievance redressal mechanisms are in place and followed.

Data Protection Impact Assessments (DPIA)

• Supervise and advise on Data Protection Impact Assessments for any new processing activities that pose a high risk to data principals.
• Advise on appropriate risk mitigation strategies for new and existing projects.
• Ensure that data protection principles are integrated into the design and development of new products, systems, and services (Privacy by Design).

Regulatory Liaison and Reporting

• Act as the single point of contact for the Data Protection Board of India.
• Collaborate with the Data Protection Board during any audits, investigations, or inquiries.
• Oversee the development and implementation of an incident management and breach response protocol. Ensure timely notification of breaches to the Data Protection Board and affected Data Principals.
• Oversee the investigation and remediation of data security incidents.

Advisory and Training

• Inform and advise the organization and its employees on data protection obligations under the DPDP Act.
• Create and deliver targeted training and awareness programs to foster a company-wide culture of privacy and data protection.
• Integrate the principles of “Privacy by Design” into the development of new products, services, and systems.
• Provide advisory to stakeholders in country and Group on the requirements and obligations under the DPDP Act.

Policy Development and Management

• Develop, implement, and maintain internal data protection policies, guidelines, and procedures.
• Ensure all vendor and third-party contracts include appropriate data protection clauses.

Risk Management

Data Protection Impact Assessments (DPIA)

• Supervise and advise on Data Protection Impact Assessments for any new processing activities that pose a high risk to data principals.
• Advise on appropriate risk mitigation strategies for new and existing projects.
• Ensure that data protection principles are integrated into the design and development of new products, systems, and services (Privacy by Design).

Governance

Compliance Oversight and Governance

• Regularly monitor and enforce compliance with the DPDP Act and other applicable data protection laws.
• Develop, implement, and maintain a robust data privacy governance framework and internal policies to ensure efficient data utilization.
• Maintain a comprehensive and verifiable record of all data processing activities.
• Work closely with the Compliance Testing and Internal Audit team for review of data privacy and risk assessments to identify and rectify compliance gaps.

Regulatory & Business Conduct

• Display exemplary conduct and live by the Group’s Values and Code of Conduct.
• Take personal responsibility for embedding the highest standards of ethics, including regulatory and business conduct, across Standard Chartered Bank.
• Effectively and collaboratively identify, escalate, mitigate, and resolve risk, conduct, and compliance matters.

Key Stakeholders

• Internal: Region CFCR; Group CFCR; Business; GIA; GBS
• External: RBI; Auditors, Data Protection Board

Skills And Experience

• Data Protection
• Compliance
• Legal
• Cybersecurity
• Risk Management

Qualifications

• Education: A degree in law, cybersecurity, IT, or a related field.
• Professional certifications such as Certified Information Privacy Professional (CIPP/A) or Certified Information Privacy Manager (CIPM) are highly desirable.
• Experience: Proven experience in a data protection, compliance, legal, cybersecurity, or risk management role with a strong track record of interpreting and implementing data protection laws.
• Expert knowledge: Deep understanding of India's DPDP Act, GDPR, and other relevant data privacy principles and regulations and the ability to apply DPDP principles to organisational practices.
• Technical expertise: Familiarity with data security tools and technologies, including encryption, anonymization, and security controls.
• Communication skills: Excellent written and verbal communication skills to effectively advise management, train staff, and liaise with regulators.
• Problem-solving: Strong analytical and problem-solving skills to manage complex privacy issues.
• Integrity: Must be free from any conflict of interest that would compromise their ability to oversee the organisation’s data protection activities.

About Standard Chartered

Standard Chartered is a global bank connecting clients to its differentiated network, offering growth opportunities in the world's most dynamic markets. Its strategy, which combines cross-border capabilities and leading wealth management expertise, helps it deliver its purpose - to drive commerce and prosperity through its unique diversity. Over its 170-year history, and across a unique geographical footprint connecting Asia, Africa, and the Middle East to each other and the world, Standard Chartered has built a bank like no other, with diverse capabilities and partnerships that set it apart.