Data Protection Officer
Role Title: Data Protection Officer (DPO)
Department: Legal, Risk & Compliance
Reporting to: CMD
Location: India (Mandatory – as per DPDP Act, 2023)
Employment Type: Full-Time | Senior Leadership
Regulatory Basis: Section 10(2), Digital Personal Data Protection Act, 2023
Department: Legal, Risk & Compliance
Reporting to: CMD
Location: India (Mandatory – as per DPDP Act, 2023)
Employment Type: Full-Time | Senior Leadership
Regulatory Basis: Section 10(2), Digital Personal Data Protection Act, 2023
About the Company
Axis My India Limited is India’s leading consumer data intelligence company, committed to enabling data-driven decision-making. It has launched the "A" App, a people empowerment platform designed to enhance the lives of a billion citizens by providing access to authentic information and practical solutions for everyday needs. The app follows a PHYGITAL model, leveraging Axis My India’s vast network of 5,000+ locations across 700 districts. Powered by Google Cloud and Google Gen AI, it continuously learns and improves to deliver better user experiences. The company is spearheaded by Mr. Pradeep Gupta who is a leading name in market research and is India’s top psephologist.
Purpose of the Function
The Data Protection Officer (DPO) is a senior, independent compliance leader mandated under Section 10(2) of the DPDP Act, 2023 for Significant Data Fiduciaries (SDFs) . The DPO serves as the company's primary authority on data protection, acting as the internal conscience on privacy matters and the external point of contact for the Data Protection Board of India (DPBI) and all Data Principals (survey respondents) .
The DPO will be responsible for building, operating, and continuously improving AMIL's data protection framework — from field-level data collection to analytics delivery — ensuring that personal data is processed lawfully, transparently, and with the full respect of individuals' rights under the DPDP Act. This role reports directly to the Board of Directors and holds the authority to independently escalate compliance concerns, halt data processing activities found to be unlawful, and represent the organization before regulatory authorities.
Requirements
Internal & External Interactions
Internal Interaction With:
· CMD – Reporting line for DPO; receives strategic direction and escalates critical privacy matters.
· Field Operations & Survey Teams – Governs on-ground data collection practices, consent mechanism deployment, and surveyor training.
· Data Analysis & Research Teams – Oversees lawful processing, purpose limitation, and data minimisation at the analytics layer.
· IT & Information Security Teams – Collaborates on technical safeguards, encryption, access controls, and breach response.
· Legal & Contract Teams – Reviews vendor contracts, data processing agreements, and cross-border transfer clauses.
· HR & Training Teams – Co-designs and mandates DPDP awareness training across the organisation.
· Product & Technology Teams – Provides privacy-by-design oversight for any digital tools, apps, or platforms used in survey operations.
External Interaction With:
· Data Protection Board of India (DPBI) – Primary regulatory liaison; handles notices, complaints, and audit correspondence.
· Survey Respondents (Data Principals) – Manages grievance redressal, responds to access/correction/erasure requests under Sections 11–13.
· Client Organisations (Brands, Institutions, Governments) – Negotiates data processing agreements and manages purpose-limited disclosures.
· Third-Party Vendors & Data Processors – Audits data processors for compliance and enforces contractual data protection obligations.
· Independent Data Auditors – Facilitates statutory annual audits as required under SDF obligations.
· Legal Counsel & External Privacy Advisors – Engages on complex regulatory matters, litigation support, and emerging compliance questions.
· Government & Regulatory Bodies – Engages with MeitY and sector regulators on policy consultations relevant to consumer data intelligence.
Requirements & Skills
1. Regulatory Compliance & Legal Interpretation
Internal Interaction With:
· CMD – Reporting line for DPO; receives strategic direction and escalates critical privacy matters.
· Field Operations & Survey Teams – Governs on-ground data collection practices, consent mechanism deployment, and surveyor training.
· Data Analysis & Research Teams – Oversees lawful processing, purpose limitation, and data minimisation at the analytics layer.
· IT & Information Security Teams – Collaborates on technical safeguards, encryption, access controls, and breach response.
· Legal & Contract Teams – Reviews vendor contracts, data processing agreements, and cross-border transfer clauses.
· HR & Training Teams – Co-designs and mandates DPDP awareness training across the organisation.
· Product & Technology Teams – Provides privacy-by-design oversight for any digital tools, apps, or platforms used in survey operations.
External Interaction With:
· Data Protection Board of India (DPBI) – Primary regulatory liaison; handles notices, complaints, and audit correspondence.
· Survey Respondents (Data Principals) – Manages grievance redressal, responds to access/correction/erasure requests under Sections 11–13.
· Client Organisations (Brands, Institutions, Governments) – Negotiates data processing agreements and manages purpose-limited disclosures.
· Third-Party Vendors & Data Processors – Audits data processors for compliance and enforces contractual data protection obligations.
· Independent Data Auditors – Facilitates statutory annual audits as required under SDF obligations.
· Legal Counsel & External Privacy Advisors – Engages on complex regulatory matters, litigation support, and emerging compliance questions.
· Government & Regulatory Bodies – Engages with MeitY and sector regulators on policy consultations relevant to consumer data intelligence.
Requirements & Skills
1. Regulatory Compliance & Legal Interpretation
- Serve as the organisation's authoritative expert on the DPDP Act, 2023, DPDP Rules, 2025, and all subordinate regulations, guidelines, and circulars issued by MeitY and the Data Protection Board of India.
- Provide binding legal interpretation on data protection obligations applicable to AXIS MY INDIA's survey and analytics operations.
- Monitor regulatory developments and proactively update compliance policies before statutory deadlines.
- Advise on lawful bases for processing — including consent management, legitimate use, and obligations under Section 7 and Section 8 of the DPDP Act.
2. Consent Management & Data Principal Rights
- Design and implement a robust consent management framework for field survey operations, ensuring notices are clear, specific, and provided in the local language of the respondent.
- Establish mechanisms for respondents to withdraw consent, access their data, seek correction, erasure, and grievance redressal as mandated under Sections 11–13 of the DPDP Act.
- Maintain auditable records of consent collection across all field survey touchpoints — both digital and paper-based.
- Respond to Data Principal requests within the timelines stipulated by the DPDP Rules.
3. Data Protection Impact Assessments (DPIAs)
- Lead periodic DPIAs for all high-risk processing activities — including large-scale village surveys, biometric data collection (if any), analytics profiling, and cross-border data transfers.
- Identify residual risks and design mitigation measures in collaboration with IT, Legal, and Operations.
- Maintain DPIA registers and ensure they are reviewed on a defined schedule or triggered by material changes in processing activities.
4. Information Security & Technical Safeguards
- Work with IT teams to ensure appropriate technical and organisational measures are implemented — including encryption of survey data, role-based access controls, data masking in analytics systems, and secure transmission of field data.
- Oversee the organisation's data breach detection, reporting, and response procedures as per Section 8(6) of the DPDP Act and CERT-In Directions.
- Ensure personal data is not retained beyond the purpose for which it was collected — enforce data retention and deletion schedules.
5. Third-Party & Vendor Compliance
- Review and approve all Data Processing Agreements (DPAs) entered into with clients, sub-processors, cloud vendors, analytics partners, and government agencies.
- Conduct regular vendor due diligence and audits to verify that data processors comply with AXIS MY INDIA's contractual data protection obligations.
- Maintain a Register of Processing Activities (RoPA) documenting all internal and external data flows.
- Manage cross-border transfer compliance for any data shared with international clients or processed on overseas platforms.
6. Training, Awareness & Culture
- Design and deliver mandatory DPDP training programmes for field surveyors, data analysts, operations staff, and senior management.
- Build a privacy-by-design culture across product and technology development, ensuring data minimisation is embedded from the outset.
- Publish internal privacy bulletins and handle ad-hoc advisory queries from business units.
7. Regulatory Liaison & Grievance Management
- Act as the sole authorised point of contact for the Data Protection Board of India — receive, acknowledge, and respond to regulatory notices within prescribed timeframes.
- Maintain and operate a structured Grievance Redressal Mechanism accessible to all survey respondents.
- Log, investigate, and resolve all privacy complaints within the time limits mandated by the DPDP Rules.
- Represent AXIS MY INDIA in any inquiry, investigation, or adjudicatory proceedings before the Data Protection Board.
8. Independent Audits & Reporting
- Facilitate and co-ordinate the annual Independent Data Audit as required for Significant Data Fiduciaries under DPDP Rules.
- Prepare and present quarterly and annual data protection compliance reports to the Board of Directors.
- Track and report on key privacy KPIs — consent rates, DPIA completion, breach response times, Data Principal request resolution, and audit findings.
Roles & Responsibilities
Ensure —
✔ Full organisational compliance
with the DPDP Act, 2023 and DPDP Rules, 2025 at all times.
✔ Valid, informed, and auditable
consent is obtained from every survey respondent before personal data
collection.
✔ Data Principals' rights —
access, correction, erasure, grievance — are honoured within regulatory
timelines.
✔ Data breaches are identified,
contained, and reported to the Data Protection Board within 72 hours of
discovery.
✔ All vendors and data
processors are contractually bound and monitored for DPDP compliance.
✔ DPIAs are completed for all
new, modified, or high-risk processing activities before they go live.
✔ AXIS MY INDIA's privacy
notices are accurate, current, and available in accessible formats and local
languages.
Carry Out —
✔ Periodic internal audits and
privacy health checks across field operations, IT systems, and analytics
processes.
✔ Annual co-ordination of the
Independent Data Audit mandated for SDFs.
✔ DPDP training and
sensitisation programmes for all staff who handle personal data.
✔ Maintenance and regular update
of the Register of Processing Activities (RoPA).
✔ Review of all new contracts,
product features, or processing activities for privacy compliance before
sign-off.
✔ Regulatory correspondence and
representation before the Data Protection Board of India.
Contribute —
✔ Strategic input to the Board
on emerging privacy risks, regulatory changes, and compliance investment
priorities.
✔ Privacy-by-design
recommendations at the ideation stage of new survey methodologies, digital
tools, or analytics products.
✔ Industry-level engagement on
data protection policy in the market research and consumer intelligence sector.
✔ Continuous improvement of AXIS
MY INDIA's data governance maturity — targeting recognised frameworks such as
ISO 27701.
Competencies
Technical Competencies | Behavioural Competencies |
• DPDP Act & DPDP Rules Mastery | • High Personal Integrity & Independence |
• Consent Architecture & Management | • Courageous Communication — Board Advisory &
Pushbacks |
• DPIA & Risk Assessment Methodology | • Stakeholder Influence & Collaboration |
• Information Security Governance | • Analytical Thinking & Risk Judgement |
• Data Breach Management & CERT-In Compliance | • Empathy for Data Principals (Rural/Vulnerable) |
• Vendor Due Diligence & DPA Drafting | • Cross-functional Leadership |
• Privacy-by-design & Data Minimisation | • Attention to Detail & Documentation Discipline |
• RoPA Management & Record Keeping |
Education & Experience
- Degree (Essential): Bachelor’s degree in law, Information Technology, Computer Science, Cybersecurity, Business Administration, or a related field. Postgraduate diploma or Master's degree in Data Privacy, Information Security, or Cyber Law (preferred).
- Degree (Preferred): MBA with specialization in Compliance / Risk Management.
- Experience: Minimum 8–12 years in data protection, privacy law, information security compliance, or regulatory affairs — of which at least 3 years in a DPO, Privacy Counsel, or equivalent senior role.
- Sector Exposure: Prior experience in market research, consumer intelligence, FMCG data, telecom, healthcare, or large-scale field data operations is highly desirable.
- Certifications (Essential): CIPP/A (Certified Information Privacy Professional – Asia) or equivalent; and / or FIP (Fellow of Information Privacy) from IAPP.
- Certifications (Preferred): CIPM, CIPT, ISO 27001 Lead Implementer / Auditor, CDPSE (Certified Data Privacy Solutions Engineer).
- Regulatory
Knowledge: Deep expertise in DPDP Act 2023, DPDP Rules 2025; working
knowledge of IT Act 2000, IT (Amendment) Act 2008, CERT-In Directions, and
awareness of GDPR for cross-border context.
Key Metrics for Success
KPI | Target / Benchmark |
Consent Collection Rate across all field surveys | 100% of surveys — zero data collection without valid
consent |
Data Principal Requests Resolved | 100% resolved within DPDP Rules prescribed period
(Access/Correction/Erasure) |
Data Breach Reporting to DPBI | 100% reported within 72 hours of confirmed detection |
Annual Independent Data Audit completion | Completed before regulatory deadline each year, zero
critical findings unresolved |
DPIA completion for processing activities | 100% completed prior to go-live of any new survey or
analytics process |
Vendor / Data Processor compliance audit coverage | 100% of Tier-1 data processors audited annually |
Employee DPDP Training completion rate | 100% of data-handling staff trained within 30 days of
joining and annually |
Grievance Resolution Rate (respondents) | 100% acknowledged within 48 hours; resolved within
statutory timelines |
Regulatory Penalties / Adverse orders from DPBI | Zero uncontested penalty orders |
Board Privacy Compliance Report | Quarterly reports submitted on time with zero critical
overdue action items |
AXIS MY INDIA Consumer Data Intelligence | Data
Protection & Privacy | Confidential
Regulatory Note: This role is constituted in compliance with Section
10(2)(a) of the Digital Personal Data Protection Act, 2023. This role carries
statutory authority and cannot be subject to conflict of interest through
assignment of operational data processing responsibilities.
Benefits
- Travel and daily allowance
- Make a significant contribution to the company's success.
- Stay up to date on the latest industry trends and best practices
At Axis My India, we value discipline and focus. Our team members wear brand on sleeves, adhere to a no-mobile policy during work hours, and work from our office. If you thrive in a structured environment and are committed to excellence, we encourage you to apply