DPDP- Functional Subject Matter Expert Banking Domain

Role Summary

We are seeking a Banking Subject Matter Expert to lead the domain advisory workstream for our DPDP (Digital Personal Data Protection Act, 2023) compliance platform as deployed in the banking and financial-services sector. The role provides authoritative guidance on how personal-data obligations under the DPDP Act 2023 and the Draft Rules 2025 apply to banking operations, products, and data flows.

The SME ensures the platform's consent, rights-fulfilment, breach, and data-lifecycle modules are designed around the realities of banking core banking, lending, cards, payments, KYC, and the sector's existing regulatory and record-retention obligations so the solution is both compliant under DPDP and consistent with banking regulation, data-security and confidentiality expectations, and practice.

Key Responsibilities

Domain Advisory & Interpretation

• Lead interpretation of how DPDP Act 2023 and Draft Rules 2025 obligations apply across banking products and processes — accounts, lending, cards, payments, KYC / onboarding, and customer servicing.
• Advise on the interplay between DPDP and existing financial-sector regulation and guidance (e.g., RBI directions, KYC / AML norms, and statutory record-retention requirements), flagging conflicts and precedence.
• Advise on banking data-security and customer-confidentiality expectations (e.g., RBI cyber-security framework, data-localisation, and secrecy obligations) and how the platform's security controls should reflect them.
• Define what 'good' looks like for banking personal-data handling, and guide the team on sector-appropriate consent, notice, and purpose definitions.

Data Flows & Use Cases

• Map banking personal-data flows across core banking, loan management, cards, digital channels, and third-party / fintech integrations, identifying where personal data is collected, processed, shared, and retained.
• Define realistic banking use cases for the platform's modules — consent capture and withdrawal, data principal/customer rights, breach notification, and retention/erasure.
• Advise on data retention and erasure where DPDP's minimisation intersects with banking record-keeping obligations, ensuring lawful and defensible handling.

Solution & Requirements Support

• Partner with the Business Analyst and architects to validate that requirements, domain entities, and workflows reflect banking reality.
• Review functional designs, privacy notices, and process flows for sector accuracy and regulatory soundness.
• Support breach-handling and DPO / DPBI-readiness reporting from a banking-supervision perspective.

Stakeholder & Assurance

• Act as the trusted advisor and primary domain point of contact between bank stakeholders (business, compliance, risk, IT) and the delivery team.
• Support proposal and RFP responses with banking-domain context, use cases, and credibility.
• Provide domain sign-off during UAT and milestone acceptance, confirming the solution fits banking operations.

Required Qualifications

• Bachelor's / Master's degree in Banking, Finance, Business, Law, or a related field.
• 10+ years in banking or financial services, with deep exposure to operations, compliance, risk, or data-governance functions.
• Strong understanding of banking personal data flows across core banking, lending, cards, payments, and KYC.
• Working knowledge of the DPDP Act 2023 and Draft Rules 2025 (or a comparable privacy regime such as GDPR), and how they interact with financial-sector regulation.
• Familiarity with applicable banking regulation and guidance (e.g., RBI directions, KYC / AML, record-retention norms, and data-security / confidentiality expectations).
• Excellent stakeholder-engagement, advisory, and documentation skills.

Preferred Qualifications

• Experience in data privacy, data governance, or regulatory-change programmes within a bank or for banking clients.
• Exposure to consent management, customer-rights handling, breach response, or data retention/erasure in a financial context.