Axis My India Limited logo

Data Protection Officer

Axis My India Limited
13 days ago
Full-time
On-site
Mumbai Suburban District, Maharashtra, India
Data Protection Officer
Role Title: Data Protection Officer (DPO)
Department: Legal, Risk & Compliance
Reporting to: CMD
Location: India (Mandatory – as per DPDP Act, 2023)
Employment Type: Full-Time | Senior Leadership
Regulatory Basis: Section 10(2), Digital Personal Data Protection Act, 2023

About the Company
Axis My India Limited is India’s leading consumer data intelligence company, committed to enabling data-driven decision-making. It has launched the "A" App, a people empowerment platform designed to enhance the lives of a billion citizens by providing access to authentic information and practical solutions for everyday needs. The app follows a PHYGITAL model, leveraging Axis My India’s vast network of 5,000+ locations across 700 districts. Powered by Google Cloud and Google Gen AI, it continuously learns and improves to deliver better user experiences. The company is spearheaded by Mr. Pradeep Gupta who is a leading name in market research and is India’s top psephologist.

Purpose of the Function
The Data Protection Officer (DPO) is a senior, independent compliance leader mandated under Section 10(2) of the DPDP Act, 2023 for Significant Data Fiduciaries (SDFs) . The DPO serves as the company's primary authority on data protection, acting as the internal conscience on privacy matters and the external point of contact for the Data Protection Board of India (DPBI) and all Data Principals (survey respondents) .
The DPO will be responsible for building, operating, and continuously improving AMIL's data protection framework — from field-level data collection to analytics delivery — ensuring that personal data is processed lawfully, transparently, and with the full respect of individuals' rights under the DPDP Act. This role reports directly to the Board of Directors and holds the authority to independently escalate compliance concerns, halt data processing activities found to be unlawful, and represent the organization before regulatory authorities.

Requirements

Internal & External Interactions
Internal Interaction With:
·         CMD – Reporting line for DPO; receives strategic direction and escalates critical privacy matters.
·         Field Operations & Survey Teams – Governs on-ground data collection practices, consent mechanism deployment, and surveyor training.
·         Data Analysis & Research Teams – Oversees lawful processing, purpose limitation, and data minimisation at the analytics layer.
·         IT & Information Security Teams – Collaborates on technical safeguards, encryption, access controls, and breach response.
·         Legal & Contract Teams – Reviews vendor contracts, data processing agreements, and cross-border transfer clauses.
·         HR & Training Teams – Co-designs and mandates DPDP awareness training across the organisation.
·         Product & Technology Teams – Provides privacy-by-design oversight for any digital tools, apps, or platforms used in survey operations.
External Interaction With:
·         Data Protection Board of India (DPBI) – Primary regulatory liaison; handles notices, complaints, and audit correspondence.
·         Survey Respondents (Data Principals) – Manages grievance redressal, responds to access/correction/erasure requests under Sections 11–13.
·         Client Organisations (Brands, Institutions, Governments) – Negotiates data processing agreements and manages purpose-limited disclosures.
·         Third-Party Vendors & Data Processors – Audits data processors for compliance and enforces contractual data protection obligations.
·         Independent Data Auditors – Facilitates statutory annual audits as required under SDF obligations.
·         Legal Counsel & External Privacy Advisors – Engages on complex regulatory matters, litigation support, and emerging compliance questions.
·         Government & Regulatory Bodies – Engages with MeitY and sector regulators on policy consultations relevant to consumer data intelligence.
 
Requirements & Skills
1. Regulatory Compliance & Legal Interpretation
  • Serve as the organisation's authoritative expert on the DPDP Act, 2023, DPDP Rules, 2025, and all subordinate regulations, guidelines, and circulars issued by MeitY and the Data Protection Board of India.
  • Provide binding legal interpretation on data protection obligations applicable to AXIS MY INDIA's survey and analytics operations.
  • Monitor regulatory developments and proactively update compliance policies before statutory deadlines.
  • Advise on lawful bases for processing — including consent management, legitimate use, and obligations under Section 7 and Section 8 of the DPDP Act.
2. Consent Management & Data Principal Rights
  • Design and implement a robust consent management framework for field survey operations, ensuring notices are clear, specific, and provided in the local language of the respondent.
  • Establish mechanisms for respondents to withdraw consent, access their data, seek correction, erasure, and grievance redressal as mandated under Sections 11–13 of the DPDP Act.
  • Maintain auditable records of consent collection across all field survey touchpoints — both digital and paper-based.
  • Respond to Data Principal requests within the timelines stipulated by the DPDP Rules.
3. Data Protection Impact Assessments (DPIAs)
  • Lead periodic DPIAs for all high-risk processing activities — including large-scale village surveys, biometric data collection (if any), analytics profiling, and cross-border data transfers.
  • Identify residual risks and design mitigation measures in collaboration with IT, Legal, and Operations.
  • Maintain DPIA registers and ensure they are reviewed on a defined schedule or triggered by material changes in processing activities.
4. Information Security & Technical Safeguards
  • Work with IT teams to ensure appropriate technical and organisational measures are implemented — including encryption of survey data, role-based access controls, data masking in analytics systems, and secure transmission of field data.
  • Oversee the organisation's data breach detection, reporting, and response procedures as per Section 8(6) of the DPDP Act and CERT-In Directions.
  • Ensure personal data is not retained beyond the purpose for which it was collected — enforce data retention and deletion schedules.
5. Third-Party & Vendor Compliance
  • Review and approve all Data Processing Agreements (DPAs) entered into with clients, sub-processors, cloud vendors, analytics partners, and government agencies.
  • Conduct regular vendor due diligence and audits to verify that data processors comply with AXIS MY INDIA's contractual data protection obligations.
  • Maintain a Register of Processing Activities (RoPA) documenting all internal and external data flows.
  • Manage cross-border transfer compliance for any data shared with international clients or processed on overseas platforms.
6. Training, Awareness & Culture
  • Design and deliver mandatory DPDP training programmes for field surveyors, data analysts, operations staff, and senior management.
  • Build a privacy-by-design culture across product and technology development, ensuring data minimisation is embedded from the outset.
  • Publish internal privacy bulletins and handle ad-hoc advisory queries from business units.
7. Regulatory Liaison & Grievance Management
  • Act as the sole authorised point of contact for the Data Protection Board of India — receive, acknowledge, and respond to regulatory notices within prescribed timeframes.
  • Maintain and operate a structured Grievance Redressal Mechanism accessible to all survey respondents.
  • Log, investigate, and resolve all privacy complaints within the time limits mandated by the DPDP Rules.
  • Represent AXIS MY INDIA in any inquiry, investigation, or adjudicatory proceedings before the Data Protection Board.
8. Independent Audits & Reporting
  • Facilitate and co-ordinate the annual Independent Data Audit as required for Significant Data Fiduciaries under DPDP Rules.
  • Prepare and present quarterly and annual data protection compliance reports to the Board of Directors.
  • Track and report on key privacy KPIs — consent rates, DPIA completion, breach response times, Data Principal request resolution, and audit findings.
Roles & Responsibilities
Ensure —
✔ Full organisational compliance with the DPDP Act, 2023 and DPDP Rules, 2025 at all times.
✔ Valid, informed, and auditable consent is obtained from every survey respondent before personal data collection.
✔ Data Principals' rights — access, correction, erasure, grievance — are honoured within regulatory timelines.
✔ Data breaches are identified, contained, and reported to the Data Protection Board within 72 hours of discovery.
✔ All vendors and data processors are contractually bound and monitored for DPDP compliance.
✔ DPIAs are completed for all new, modified, or high-risk processing activities before they go live.
✔ AXIS MY INDIA's privacy notices are accurate, current, and available in accessible formats and local languages.
Carry Out —
✔ Periodic internal audits and privacy health checks across field operations, IT systems, and analytics processes.
✔ Annual co-ordination of the Independent Data Audit mandated for SDFs.
✔ DPDP training and sensitisation programmes for all staff who handle personal data.
✔ Maintenance and regular update of the Register of Processing Activities (RoPA).
✔ Review of all new contracts, product features, or processing activities for privacy compliance before sign-off.
✔ Regulatory correspondence and representation before the Data Protection Board of India.
Contribute —
✔ Strategic input to the Board on emerging privacy risks, regulatory changes, and compliance investment priorities.
✔ Privacy-by-design recommendations at the ideation stage of new survey methodologies, digital tools, or analytics products.
✔ Industry-level engagement on data protection policy in the market research and consumer intelligence sector.
✔ Continuous improvement of AXIS MY INDIA's data governance maturity — targeting recognised frameworks such as ISO 27701.
Competencies

Technical Competencies

Behavioural Competencies

• DPDP Act & DPDP Rules Mastery

• High Personal Integrity & Independence

• Consent Architecture & Management

• Courageous Communication — Board Advisory & Pushbacks

• DPIA & Risk Assessment Methodology

• Stakeholder Influence & Collaboration

• Information Security Governance

• Analytical Thinking & Risk Judgement

• Data Breach Management & CERT-In Compliance

• Empathy for Data Principals (Rural/Vulnerable)

• Vendor Due Diligence & DPA Drafting

• Cross-functional Leadership

• Privacy-by-design & Data Minimisation

• Attention to Detail & Documentation Discipline

• RoPA Management & Record Keeping
Education & Experience
  • Degree (Essential): Bachelor’s degree in law, Information Technology, Computer Science, Cybersecurity, Business Administration, or a related field. Postgraduate diploma or Master's degree in Data Privacy, Information Security, or Cyber Law (preferred).
  • Degree (Preferred): MBA with specialization in Compliance / Risk Management.
  • Experience: Minimum 8–12 years in data protection, privacy law, information security compliance, or regulatory affairs — of which at least 3 years in a DPO, Privacy Counsel, or equivalent senior role.
  • Sector Exposure: Prior experience in market research, consumer intelligence, FMCG data, telecom, healthcare, or large-scale field data operations is highly desirable.
  • Certifications (Essential): CIPP/A (Certified Information Privacy Professional – Asia) or equivalent; and / or FIP (Fellow of Information Privacy) from IAPP.
  • Certifications (Preferred): CIPM, CIPT, ISO 27001 Lead Implementer / Auditor, CDPSE (Certified Data Privacy Solutions Engineer).
  • Regulatory Knowledge: Deep expertise in DPDP Act 2023, DPDP Rules 2025; working knowledge of IT Act 2000, IT (Amendment) Act 2008, CERT-In Directions, and awareness of GDPR for cross-border context.

Key Metrics for Success

KPI

Target / Benchmark

Consent Collection Rate across all field surveys

100% of surveys — zero data collection without valid consent

Data Principal Requests Resolved

100% resolved within DPDP Rules prescribed period (Access/Correction/Erasure)

Data Breach Reporting to DPBI

100% reported within 72 hours of confirmed detection

Annual Independent Data Audit completion

Completed before regulatory deadline each year, zero critical findings unresolved

DPIA completion for processing activities

100% completed prior to go-live of any new survey or analytics process

Vendor / Data Processor compliance audit coverage

100% of Tier-1 data processors audited annually

Employee DPDP Training completion rate

100% of data-handling staff trained within 30 days of joining and annually

Grievance Resolution Rate (respondents)

100% acknowledged within 48 hours; resolved within statutory timelines

Regulatory Penalties / Adverse orders from DPBI

Zero uncontested penalty orders

Board Privacy Compliance Report

Quarterly reports submitted on time with zero critical overdue action items

AXIS MY INDIA Consumer Data Intelligence | Data Protection & Privacy | Confidential
Regulatory Note: This role is constituted in compliance with Section 10(2)(a) of the Digital Personal Data Protection Act, 2023. This role carries statutory authority and cannot be subject to conflict of interest through assignment of operational data processing responsibilities.



Benefits

  • Travel and daily allowance
  • Make a significant contribution to the company's success.
  • Stay up to date on the latest industry trends and best practices
 
At Axis My India, we value discipline and focus. Our team members wear brand on sleeves, adhere to a no-mobile policy during work hours, and work from our office. If you thrive in a structured environment and are committed to excellence, we encourage you to apply