Data Protection Officer

About the role

Medanta is seeking a Data Protection Officer to lead privacy compliance across its network of hospitals and clinics in India. The DPO will ensure adherence to the Digital Personal Data Protection Act 2023 and related regulations, acting as the primary liaison with regulators and data subjects.

Key responsibilities

• Serve as the statutory DPO under the DPDP Act, GDPR and applicable healthcare regulations.
• Act as the main contact for the Data Protection Board of India, CERT‑In and other regulators.
• Embed privacy‑by‑design principles in clinical, administrative and digital initiatives.
• Conduct Privacy Impact Assessments, vendor risk assessments and manage breach response and notifications.
• Oversee data‑subject‑rights processes including access, correction, erasure, consent management and grievance handling.
• Develop and maintain privacy policies, governance frameworks and compliance controls for healthcare data.
• Review privacy obligations in contracts with vendors, insurers, laboratories and technology partners.
• Lead privacy incident investigations, regulatory reporting, root‑cause analysis and corrective actions.
• Establish monitoring, audit, logging and reporting mechanisms for privacy compliance.
• Deliver privacy awareness and training programmes to clinical, administrative and technology teams.

Required profile

• Bachelor’s degree in Law, Information Security, Computer Science, Healthcare Administration or a related field.
• 2–14 years of experience in data protection, healthcare compliance, information security or risk management within a hospital environment.
• Hands‑on experience with healthcare data breaches, regulatory audits and investigations is preferred.
• Relevant certifications such as CIPP/A, CIPM, ISO IEC 27701 Lead Implementer/Auditor or ISO 27001 Lead Implementer/Auditor are advantageous.

Required skills