Head - Legal/Compliance & Data Privacy - Insurance Firm

CTC- upto 75LPA fixed

Education - LLB

Location - Pune / Bangalore

Candidate's profile -

- Degree in Indian law (minimum qualification LLB, knowledge or certificate on French law is a plus); Commercial legal experience in law firm(s) and/or in-house.

- A previous Data Privacy / Compliance experience (at least Master graduate or equivalent - Legal or IT Security) is preferable, Minimum 20 years' solid legal experience in negotiation of contracts, with strong background in negotiating IT contracts (e.g. with software editors).

Position mission and main activities

1) Legal - Contract Management:

- Design, negotiate and monitor the conclusion of a wide range of agreements with vendors/suppliers, other third parties (IT and non-IT, General Expenses, Real Estate, trademarks, etc.) and customers in accordance with the Indian Law.

- Animate and support Group initiatives where dedicated Legal expertise is requested on various projects (large contracts negotiation, intellectual property, etc.).

- Train and raise awareness about Legal/Regulatory items to non-expert people or external families (Knowledge Management).

- Maintain technical expertise in field and promote it internally.

- The above activities cover the management of a wide range of commercial and financial transactions and issues on a recurring basis as well as frequent one-off projects, in particular IT and Outsourcing projects.

2) Compliance:

- Regulatory watch of the legislations under the perimeter.

- Guarantee the compliance with local applicable regulations under surveillance,

- Implement and maintain the different processes assigned to compliance: Ethics, Anti-bribery, Sanctions, Conflicts of interest, Criminal laws.

- Review and follow up the compliance risks (evaluate the impact on the operational risks model of the entity).

- Raise awareness to all employees regarding the risk associated of non-compliance,

- Report and escalate any relevant change in regulations subject to generate additional risks or needs inside firms Services perimeter.

3) Data Privacy policies and governance:

- Develop and adapt firms Services policies on data privacy in accordance with relevant international and local laws.

- Adherence to the Data Protection framework to ensure compliance with applicable regulations

- Develop and be the custodian of Data privacy policies, guidelines and strategies

- Develop and create appropriate privacy confidentiality consent forms, authorization forms, and information notices and materials reflecting current organization and legal practices and requirements.

- Adopting and implementing detailed requirements or guidelines to assure a compliant handling of specific matters as deemed necessary such as:

- IT Project Management when personal data is involved,

4) Third party management: risk assessment and contract management,

- Sensitive Personal Data: Greater emphasis on whether and how to process this type of data.

- Design complaints procedure. Detailed guidance as to how employees and non-employees.

- Data Privacy management and governance

- Training and providing juridical consultative advice to all the areas and departments of the entity in question with regards to Data Privacy matters.

- Supporting and controlling a general data protection register (both as Data Controller and Processor) containing all data processing in use and current information about purpose).

- Support to the different projects providing Data Privacy assessment and sign-off when satisfied on compliancy with local applicable laws.

- Collaborates with the teams in charge to respond to requests for access to and correction of personal information and general issues concerning personal information (i.e. rights of access, rectification, cancellation and similar requests).

5) Support on drafting internal or external data privacy agreements.

- Reviewing and monitoring business activities and vendor contracting and negotiations.

- Attendance at Data Privacy, Security, or similar Committees.

- Coordination and management of responses to incidents involving Personal Data (e.g. Unauthorized access or disclosure).

- Permanent Control: Ensuring on a regular basis that data processing applications and processes are still compliant.

6) Interface with Corporate Governance Bodies

- Communication and reporting to the local data protection authority (if existing) and other relevant regulators, attendance at data protection authority inspections, handling audit submissions and other information submission requirements.

- Build on a strong working relationship with the management of the compliance & governance function, guaranteeing the global needs of the organization.

- Build on the relation with the firms Services local governance bodies,

- Coordination with the local Risk, Security, Legal, HR, Physical Security, IT Operations, Finance, and Internal Audit function.. on Data Privacy matters.

- Keeping Senior and Business Management informed about their responsibilities regarding Data Privacy.

Others:

- Management of team of highly skilled professionals

- Communicate and interact with internal and external stakeholders (regulators, external counsel, public authority etc.), creating relations of trust

- Keep abreast of changes in various laws and statutes applicable to the company, conduct legal research and promptly inform the impact of changes to concerned stakeholders.