Data Protection Consultant

About this role

This role is for one of Weekday’s clients

Min Experience: 2+ years

Location: Mumbai, Maharashtra, India

JobType: full-time

We are looking for a Data Protection Consultant with a minimum of 2 years of hands-on experience in Data Privacy and Data Protection , with strong practical exposure to Records of Processing Activities (ROPA) and Data Protection Impact Assessments (DPIA) .

The ideal candidate should have experience working on privacy compliance programs, risk and gap assessments, privacy documentation, and regulatory requirements such as GDPR, India’s DPDPA, and CCPA .

Requirements

Key Responsibilities

• Design, implement, and support Privacy and Data Protection Programs for clients.
• Independently prepare, review, and maintain Records of Processing Activities (ROPA) .
• Conduct Data Protection Impact Assessments (DPIA) and identify privacy risks and appropriate mitigation measures.
• Conduct privacy risk assessments, gap assessments, audits, and compliance reviews .
• Perform data privacy assessments across business processes, systems, applications, and third-party relationships.
• Work with information security and privacy frameworks including ISO 27001, ISO 27701, NIST, and HITRUST .
• Advise internal teams and clients on privacy regulations including GDPR, DPDPA, and CCPA/CPRA .
• Draft and review privacy policies, procedures, assessment reports, compliance documentation, and implementation roadmaps.
• Assist organizations with establishing and improving privacy governance frameworks.
• Support cybersecurity governance and ISMS documentation .
• Identify privacy and security compliance gaps and recommend remediation measures.
• Work with stakeholders across Legal, IT, Information Security, Compliance, HR, and business functions.
• Support client meetings, workshops, assessments, and privacy-related consulting engagements.

Mandatory Requirements

• Minimum 2 years of relevant experience in Data Privacy, Data Protection, Information Security, GRC, or related domains.
• Hands-on experience in ROPA is mandatory.
• Hands-on experience in conducting DPIAs is mandatory.
• Good working knowledge of GDPR .
• Working knowledge of India's DPDPA and CCPA/CPRA .
• Understanding of privacy risk assessments, gap assessments, and compliance audits.
• Knowledge of privacy principles, data lifecycle, data processing activities, and privacy risk management.
• Familiarity with ISO 27001 and ISO 27701 .
• Strong documentation, analytical, communication, and stakeholder-management skills.
• Ability to prepare professional reports, policies, assessment documents, and compliance roadmaps.

Preferred Skills

• Exposure to NIST and HITRUST frameworks.
• Experience working in a consulting or client-facing environment.
• Understanding of cybersecurity governance and ISMS.
• Experience with privacy management or GRC tools will be an added advantage.
• Experience conducting privacy workshops and stakeholder interviews.
• Preferred Certifications
• Candidates holding one or more of the following certifications will be preferred:
• CIPM – Certified Information Privacy Manager
• CIPP/E – Certified Information Privacy Professional/Europe
• CIPT – Certified Information Privacy Technologist
• ISO 27001 / ISO 27701 certifications will be an added advantage.
• Ideal Candidate

We are particularly interested in candidates who have actually prepared ROPAs and conducted DPIAs as part of their current or previous roles , rather than candidates with only theoretical knowledge of these activities.

• The candidate should be comfortable explaining:
• How a ROPA is created and maintained.
• What information is collected from business/process owners for a ROPA.
• When a DPIA is required.
• How privacy risks are identified and assessed during a DPIA.
• How remediation and risk mitigation actions are documented and tracked.
• How GDPR/DPDPA requirements are translated into practical organizational controls.

Must-have skills

• data protection, GDPR, Data Protection Impact Assessment

Good-to-have skills

• Data Privacy, Records of Processing Activities