Staff Data Privacy

Job description

**Key Responsibilities:** **A. Privacy Programme Management & Regulatory Operations** - Own the operationalisation of DPDP Act 2023 and GDPR requirements across Razorpay products, systems, and vendor stack — in coordination with the Head - Manage and continuously improve the Record of Processing Activities (RoPA), consent framework, data subject rights workflows, and data classification register - Lead execution of Privacy Impact Assessments (PIAs) and Data Protection Impact Assessments (DPIAs) — with increasing automation over time - Oversee cross-border data transfer compliance: SCCs, adequacy decisions, and DPDP cross-border transfer rules - Coordinate with the Head for regulatory audits (RBI/SEBI), data privacy reviews, and incident reporting timelines - Enforce consent, purpose limitation, data minimisation, and retention policies in live production systems **B. Technical Privacy Posture & Assessment Delivery** - Lead and conduct infrastructure privacy reviews of cloud environments (AWS/GCP/Azure) — access controls, encryption, data residency, audit logging - Drive vendor and SaaS tool assessments beyond standard questionnaires — review actual data flows, API integrations, and technical configurations - Own the technical quality of privacy assessments produced by the team — review, calibrate, and ensure regulatory alignment - Monitor control effectiveness across production systems; identify gaps and partner with engineering to define remediation - Build and maintain the team's assessment methodology, templates, and scoring frameworks **C. AI Systems Privacy & Governance (LLM-Focused)** - Own Razorpay's AI tool onboarding and privacy review process — from intake to sign-off - Lead privacy assessments of LLM-powered tools, internal AI agents, and third-party AI integrations, with focus on data input, storage, retention, and cross-border sharing - Build and maintain the AI privacy onboarding framework: checklists, risk registers, approval workflows, and exception management - Define and document AI-specific privacy risks: prompt data leakage, model memory, third-party AI provider data usage, and agentic system data access - Embed Privacy-by-Design into AI product lifecycles — engaging product and engineering teams from ideation through to inference - Track third-party AI provider privacy policies (OpenAI, Anthropic, Google, etc.) and maintain a current compliance alignment register **D. Compliance Automation & AI-Powered Privacy Operations** - Design, build, and maintain AI-assisted compliance workflows — DPIA generation, evidence collection, control testing, and risk flagging - Create and maintain compliance dashboards that give engineering, product, and leadership real-time visibility into privacy posture - Develop standardised playbooks, checklists, and templates that enable product teams to self-serve privacy reviews with confidence - Evaluate and validate the accuracy and regulatory alignment of AI-generated compliance outputs before they are accepted as formal evidence - Continuously improve the team's tooling stack — GRC platforms, privacy management tools, AI assistants — for maximum operational leverage **E. Team Leadership & Stakeholder Management** - Directly manage, mentor, and develop the Lead Compliance Engineer — Privacy; set clear goals, unblock work, and drive their professional growth - Act as the primary point of contact for engineering, product, legal, and business teams on day-to-day privacy matters - Translate privacy requirements and risk findings into actionable, prioritised guidance for technical and non-technical stakeholders - Support the Head with board-level and leadership reporting — prepare data, evidence packages, and risk summaries - Maintain the privacy incident register, manage incident response timelines, and ensure regulatory reporting deadlines are met - Drive a culture of privacy-as-enabler within the organisation — position compliance as a feature, not a gate **Skills Required :** - 6–8 total years in privacy, compliance, or security — with at least 2 years in a hands-on technical capacity - Has operationalised both frameworks in production — not just mapped policies. Can identify gaps without being prompted. - Can assess LLM data handling, prompt pipelines, model memory, RAG architectures, and third-party AI provider risks. - Can assess cloud infra, APIs, and SaaS integrations for privacy risk — going beyond questionnaires to actual technical evidence. - Has designed or significantly improved automated compliance workflows using AI tools, scripting, or GRC platforms. - Has managed IC-level compliance or security professionals; can communicate privacy risk clearly to both engineers and executives. - Working knowledge of FinTech-specific data obligations applicable to a payment aggregator context - Understands data flow design, pseudonymisation, tokenization, encryption-at-rest and in transit, and SDLC privacy gates. - Can read AWS/GCP/Azure architecture diagrams to identify data egress risks, misconfigured IAM, and storage issues. - Developing familiarity with AI fairness, explainability, consent, and auditability frameworks for regulated contexts