REGIONAL DATA PRIVACY OFFICER - EUROPE

Dr. Reddy’s Laboratories Ltd. (“Dr. Reddy’s”) is a leading multinational pharmaceutical company based across global locations. Each of our 24,000 plus employees comes to work every day for one collective purpose: to accelerate access to affordable and innovative medicines because Good Health Can’t Wait.Location of the offices:Spain (Barcelona)Germany (Augsburg)UK (Cambridge)The position offers hybrid model of work. Role overviewIn this role, you will partner with Dr. Reddy's business teams on a day-to-day basis and support them in complying with both Dr. Reddy's internal Data Privacy (DP) Policy, processes and standards as well as General Data Protection Regulation (GDPR) in all the EU/EEA countries as well as in UK and Switzerland where DRL operates from directly or in partnership with its third parties. You will also interpret the requirements of the law of each country, observe evolving trends and regulatory developments and engage with Regulatory authorities, where required.Role & ResponsibilitiesBusiness PartneringPartner closely with business and functional teams in the region and provide necessary support to ensure compliance with both DRL's internal Data Privacy processes/ requirements as well as applicable Data Protection laws.Privacy Impact Assessment and Risk ManagementDrive a culture of Privacy by design and default by ensuring completion of Privacy Impact Assessment of all new Projects and business processes in the early stages.Ensure re-assessment of all high-risk projects and business processes based on a pre-determined frequency.Identify and register Data Privacy risks and issues associated with various business processes/ projects and initiatives and enable its management by identifying the right owners and tracking them to closure against mutually agreed due dates.Ensure availability of complete and accurate Records of Processing Activities for all countries in the region.Personal Data Incident and Breach ManagementTrain business and functional teams on how to identify and report Data Security Incidents.Manage reported personal data incidents for the countries in the region to closure by identifying root causes, proposing corresponding corrective and preventive actions, and tracking actions to closure. Adhere to any Breach Management and Notification requirements under applicable DP laws in the region.Data Subject RequestsManage Data Subject Requests received for the countries in compliance with any requirements laid down under respective laws.Local SOPs, DPAs, ICAs, Notices / Consent Assess the need, develop local Data Privacy procedures and provide necessary training to help business comply with specific requirements under local law.Where required, adapt global notices or consents to meet local requirements ensuring notices on DRL Corporate as well as product specific websites are current and accurate.Provide inputs to help create Standard Contractual Clauses, Agreements/ BCR to enable cross-border transfer of data to third parties as well as within DRL entities etc.Training and AwarenessDevelop content for ad hoc and function specific Data Privacy trainings and deliver them to business teams on a periodic basis. Ensure that the effectiveness of trainings is also assessed.Facilitate Data privacy awareness campaigns and initiatives for the countries within the region to raise overall awareness levels around Data Privacy.Monitoring, testing and reportingPerform periodic monitoring/ testing of controls to identify level of compliance to the requirements under applicable law.Do periodic reporting for the region as required for Steercos and other Review meetings. Present the outcomes to top leadership.Internal / External Audits and ReviewFacilitate all internal / external DP audits and reviews for the countries in scope.Work closely with business and functional teams to track all findings identified during such audits and reviews, to closure.External InterfaceBe the face of Dr.Reddy’s to the Data Protection Regulatory Authorities in the countries (where applicable) including register/nominate self as a DPO, and ensure compliance with any other notification or registration requirements under the DP laws e.g. registration of Processing systems, notification related to data transfers, data breach etc.Post alignment with Functional leadership, identify and work with external law or consulting firms to fulfil obligations under the law, if any.Global Data Privacy Governance and Projects (Corporate level)Ensure participation in relevant meetings and forums such as DP Governance calls, All-hands meet, Regional forums and meetings etc.Lead or participate in any global Data Privacy projects initiative to develop or improve DRLs Data Privacy Program.Represent privacy in any cross-functional projects.RequirementsLaw or Management graduate and a certified Privacy Professional (CIPP/E preferred) with ability to interpret Data Protection laws and experience in interacting with Regulatory bodies.Experience of 8-12 years in Data Privacy roles with large multinational organizations of which at least 3-5 years hands-on experience in managing GDPR across multiple EU countries.Experience in conducting Data Privacy monitoring, testing, and reviews.Good understanding of Risk Management and controls concepts and Information Security Management System (ISO 27001, Cloud Security etc).Experience and and understanding of use of data and technology and how it impacts data privacy.Experience in handling privacy enabling tools and solutions (One Trust, Securiti.ai etc).Experience in leading or participating in global DP projects involving professionals from multiple jurisdictions.Robust stakeholder management and interaction across all levels (including CXOs).Ability to understand business demands and how privacy requirements should be applied in a changing environment including both at a process as well as in technology related setups.Understanding and prior experience in Pharmaceutical and Generics business will be an added advantage.Legal knowledge as it relates to Data Protection laws including contracting, drafting Data Processing Agreements/ EU Model Clauses, Binding Corporate Rules.In-depth understanding and hands-on experience in GDPR and emerging trends and challenges in the region.Data Privacy Training and Awareness building skills and experience.Fluency in English language is mandatory, candidates with additional language proficiency (German, French, Italian, Spanish) will be given preference.About the departmentThe Legal & Compliance function has three broad verticals which cut across global geographies. The verticals provide advice and documentation relating to Intellectual property matters, commercial contracts and business arrangements, corporate structures and registrations, Compliance with industry specific laws, rules, and regulations and Data Privacy and Protection compliance across 75+ countries.