Six substantive guides
Educational guidance for clearer privacy hiring—without salary claims, credentials, legal advice or compliance guarantees.
A DPO or privacy lead coordinates accountability and escalation; engineering builds controls into systems; counsel interprets legal questions; GRC tests governance and assurance. State overlaps and conflicts clearly.
Section 10 of the DPDP Act sits in the notified 18-month commencement cohort for 13 May 2027 as of this review. Do not treat this guide as a claim that those future obligations are operative today.
State the decisions the role owns, reporting line, data and process interfaces, geographic scope, escalation path and evidence expected. Avoid credential inflation or vague compliance guarantees.
Use consistent scenarios: map a data flow, explain a notice, identify a trade-off, plan a rights workflow and work across legal and technical stakeholders. Score the work, not personal history.
A careful process map, plain-language notice critique, retention decision log or risk-assessment outline can show judgement without exposing confidential employer material.
Build a panel that can evaluate legal reasoning, implementation constraints and operational usability. Make hand-offs between tracks explicit.
Explain why each field is requested, who may see it, what is optional, the retention trigger and how to withdraw or correct. Candidate choice should remain visible after onboarding.