DPDP Officer / Data Protection Officer

About the Role

Presidency University is seeking a Data Protection Officer to establish, operate, and continuously improve its personal-data governance program.

Key Responsibilities

• Governance and Compliance Programme: Maintain the University's DPDP compliance framework, implementation roadmap, policies, registers, controls, and evidence of compliance.
• Data Inventory and Mapping: Coordinate an institution-wide inventory of personal data, purposes, systems, data sources, recipients, processors, retention periods, locations, and cross-border flows.
• Purpose and Lawful Processing Review: Review collection and processing for clear lawful purposes and appropriate documentation of consent or other legally permitted grounds.
• Privacy Notices and Consent: Standardize notices and consent language for various university functions and platforms.
• Children's Data: Identify processing involving children and coordinate legally required consent, safeguards, and restrictions.
• Data-Principal Rights: Establish and supervise workflows for access, correction, completion, updating, erasure, grievance redressal, and nomination requests.
• Grievance Management: Act as or supervise the published privacy/grievance point of contact, ensuring requests are logged, assigned, investigated, responded to, and escalated.
• Security Safeguards: Work with IT/CISO functions to ensure reasonable security safeguards, access controls, logging, backup, vulnerability management, encryption, and vendor controls appropriate to personal-data risk.
• Personal Data Breaches: Coordinate privacy aspects of breach triage, containment, evidence preservation, impact assessment, communications, and legally required notifications.
• Vendor/Processor Governance: Review personal-data clauses in contracts, maintain processor/vendor records, and ensure processing on behalf of the University is governed by valid contracts and appropriate controls.
• Retention and Deletion: Develop and monitor retention schedules and defensible deletion/anonymisation processes, subject to statutory, academic, research, accreditation, employment, and litigation requirements.
• DPIA/Risk Assessments: Establish DPIA and privacy-risk assessment procedures for high-risk or material new processing, and perform/coordinate periodic DPIAs if the University becomes an SDF.
• Audit and Assurance: Coordinate internal compliance reviews, remediation tracking, and independent data audits where required; maintain auditable evidence.
• Privacy by Design: Review new applications, digital platforms, AI tools, analytics, biometric systems, research projects, and major system changes before deployment where they materially process personal data.
• Training and Awareness: Conduct role-based awareness for faculty, admissions, HR, finance, examinations, IT, research, placements, security, and student-facing teams.
• Regulatory Interface: Coordinate responses to lawful regulatory requests and, if the University is an SDF, represent it under the DPDP Act as required.
• Committee Secretariat: Serve as Member-Secretary/privacy secretariat for the Data Protection Committee, preparing agendas, risk reports, action trackers, and compliance dashboards.

Authority of the DPDP Officer

• Direct access to senior governance for material privacy and compliance risks.
• Access, on a need-to-know basis, to records, systems, contracts, process owners, and information necessary to perform the role.
• Authority to require business/process owners to complete data inventories, risk assessments, and remediation actions.
• Authority to recommend temporary suspension or restriction of a processing activity where an imminent and material privacy or security risk exists, subject to emergency governance procedures.
• Authority to convene an urgent Data Protection Committee meeting following a material breach or high-risk event.
• Independence to record dissent or unresolved compliance risk in Committee minutes and escalate it to the competent governing authority.

Qualifications

• A Bachelor’s degree from a recognised university in Law, Information Technology, Computer Science, Cybersecurity, Information Systems, Management, Public Administration, or a related discipline.
• Preferably, a postgraduate degree or professional qualification in Law, Data Protection, Privacy, Cybersecurity, Information Security, Compliance, Risk Management, Technology Law, or a related field.
• For candidates with a predominantly technology or cybersecurity background, demonstrable experience in privacy governance, regulatory compliance, and stakeholder management should be considered important.

Professional Certifications – Desirable

One or more recognised certifications in privacy, data protection, cybersecurity, information security, governance or compliance would be advantageous, including certifications relating to:

• Data Protection and Privacy
• Information Privacy Management
• Privacy Programme Management
• Information Security
• Cybersecurity
• Information Security Management Systems
• Risk Management
• Governance, Risk and Compliance
• ISO/IEC 27001 and/or ISO/IEC 27701

Relevant certifications from recognised professional bodies such as IAPP, ISACA, (ISC)², ISO-accredited training/certification organisations, or equivalent institutions may be considered favourably. Professional certification should, however, ordinarily be treated as desirable rather than an absolute substitute for appropriate practical experience and understanding of Indian data protection law.