Dipti Sawant · risk verification to data protection manager
She was a risk verification officer, a controls and evidence job, the kind banks and insurers run on. She is now Data Protection Manager at Gentrack, a global software company.
Every account you open starts with an Aadhaar copy, a PAN and a photo, and RBI already makes you keep them for years after the account closes. The new data protection rules add consent, retention limits, a grievance route and a 72-hour breach clock to the same files. You already know how to show an inspector the file. The step up is to become the person who writes the rules for those files and signs the report when something goes wrong.
This is a step up in your career, not a side task on your current desk.
How you get there. You learn the 20 skills, you mark your own KYC process against the rules, and you take the gap list to management. That note is how an onboarding officer becomes the owner. This is the step up, not more work on the same desk.
RBI tells you what to collect and how long to keep it. The data protection rules now ask what the customer was told, what they agreed to, and what happens when they ask for their data. Both questions land on the same file, and banks are deciding right now who owns it.
Your desk collects the identity documents of every customer, under one of the strictest regulators in the country. Consent, retention limits and deletion are new, and they land on onboarding, because that is where the documents come in. 83 per cent of the companies EY surveyed had not begun implementation, and 76.4 per cent name a lack of subject matter expertise as a key challenge.
India's privacy regulator is still being staffed. Nobody has ten years of experience in this work, because the rules have not existed for ten years. Everyone starts level, whatever their seniority in other work.
Published figures from Indian employers and advisers.
These are market figures and the direction of travel. What you earn depends on your own effort and your market.
Free resources go out every single day, whether or not you go any further with us.
The obligations that actually bind a bank or an NBFC, mapped onto the account opening, KYC and record-keeping steps you already run.
Yours that evening: the obligation checklist and the operations gap sheet.The breach reporting sequence with owners and decision points filled in, the record of processing, the consent and retention tests, and the vendor clauses for the outsourcing chain.
Yours that evening: the breach runbook, the data inventory sheet and the vendor clause set.The compliance calendar, how to present the gap list so management gives you the go-ahead instead of getting alarmed, and the honest route from operations to the privacy seat.
Yours that evening: the compliance calendar, the management note format and the role plan.This is a live camp. There are no recordings, by design. You also get the attendee WhatsApp group and a certificate on completion.
Named, with employers, from our own learner records.
She was a risk verification officer, a controls and evidence job, the kind banks and insurers run on. She is now Data Protection Manager at Gentrack, a global software company.
Our course anchor, Aishvarya Joshi, holds CIPP/E, CIPM, CIPT and AIGP from the IAPP, and is an ISO 27001 Lead Auditor and ISO 27701 Lead Implementer.
You already know how to prove a file is complete. That is the skill.
Compliance owns the obligation on paper. The work lives at the onboarding desk: which documents are collected, where they sit, how long they stay, what happens when a customer asks. Banks are solving this by training an onboarding person in the rules.
No. Processing files and owning data protection for the company are different grades. The owner writes the rules, signs the breach report and answers the regulator. That seat is being created now, and the camp gives you the plan to move into it. The head start is the point.
No. Day one maps the obligations onto processes you already run. Days two and three produce the runbook, the registers and the note for management.
No, and do not rely on anyone who says it does. That duty applies to significant data fiduciaries once the government notifies those categories, and it has not yet done so. What binds every company today is the notice, consent, retention limits, grievance handling and breach reporting.
No. The camp is live by design. You keep the notes, the templates, the WhatsApp group and a certificate.
DISCLAIMER: The figures mentioned above are based on examples and should be viewed as such. Although many professionals have achieved successful outcomes, individual results will vary and depend on factors including prior experience, background, dedication, and consistent effort. This program is designed to provide practice-building and career guidance, and success will require personal effort and action.
This site and program are not affiliated with or endorsed by Facebook, Google, or any social media platform. FACEBOOK is a trademark of META PLATFORMS, Inc. YOUTUBE and GOOGLE are trademarks of ALPHABET, Inc.
This is an educational training course intended to help aspiring learners gain valuable insights and hands-on skills. It is not a business opportunity or a "get-rich-quick" scheme. Testimonials, success stories, and examples provided on this page are not meant to imply guaranteed results, and your experience may differ.
Skill Arbitrage — © 2026 All Rights Reserved
Space Creattors Heights, 3rd floor, Landmark Cyber Park, Golf Course Extension Sector 67, Gurgaon, Haryana - 122102
📞 +91 8046971133 ✉ [email protected]