Sonal Joshi · from a science degree into privacy
An M.Sc in pharmaceutical chemistry, now a Data Privacy Consultant at Capgemini. Science backgrounds like yours are moving into this field.
You file case safety reports, code adverse events, run the safety database, or keep the hospital's records. Every one of those files has a named patient in it. Here are seven facts, each from a named source, on why the privacy seat in pharma and hospitals is opening now, and why it should go to you.
India notified the Digital Personal Data Protection Rules on 13 November 2025 and gave companies 18 months. Full compliance is due on 13 May 2027. From that day every marketing authorisation holder, pharmacovigilance outsourcer, CRO, hospital and lab that holds patient data must follow the notice, consent, retention, grievance and breach rules. A case safety report is personal data. A discharge summary is personal data. Penalties run up to ₹250 crore per breach.
Source: DPDP Rules, 2025 (notified 13 Nov 2025) and the DPDP Act, 2023, penalty schedule.
Healthcare took 21.82 per cent of all cyberattacks in India in 2024, the most of any sector, up 8 points on 2023. Indian healthcare organisations face 8,614 attacks a week each, more than four times the global average of 1,847. Healthcare and pharma logged 3.79 million detections in the year to September 2025. You have seen the results: AIIMS Delhi ran on paper for about two weeks after its 2022 ransomware attack, and in 2024 the medical records of over 3.1 crore Star Health customers were offered for sale on Telegram.
Sources: DSCI, India Cyber Threat Report 2025. Check Point, The State of Global Cyber Security 2025. Seqrite, India Cyber Threat Report 2026 (Mar 2026). Reuters and Business Today reporting on AIIMS (Nov 2022) and Star Health (Sep 2024).
The Rules are less than a year old. The Data Protection Board is still being staffed. As of July 2026 the government had not yet notified a single Significant Data Fiduciary. Nobody in India has ten years of experience in this work, because the rules have not existed for ten years. The work itself is records, registers, consent forms, vendor checks and a breach plan. A pharmacovigilance associate and a hospital records manager start at the same line as everyone else, and they start ahead on the records.
Source: ICLG, Data Protection Laws and Regulations, India chapter, 20 Jul 2026.
EY India asked nearly 150 senior and mid-level professionals across sectors in January 2026. 76.4 per cent named lack of subject matter expertise as a key challenge. 83 per cent had not yet started implementation across their processes and systems. Healthcare showed "limited progress across most compliance areas". Globally, 47 per cent of privacy teams say their technical roles are understaffed, and 48 per cent are training non-privacy staff to move into privacy roles. Companies are filling the gap by training people like you.
Sources: EY India, India's digital privacy crossroads, Jan 2026. ISACA, State of Privacy 2026 (1,800+ privacy professionals).
There is no "healthcare privacy" job title. Employers post Data Protection Officer, Privacy Analyst and DPDP Compliance Analyst, and put pharma or healthcare in the job description as the domain. Look at what a pharmacovigilance floor already does every day: pseudonymised case reports, controlled access to the safety database, audit trails, retention schedules, identifiable health data sent to a global safety database outside India, and reporting to a clock. That is the vocabulary of a data protection programme, already in your hands. The pool is large and short-staffed: India has 250 functioning ADR monitoring centres, 9,803 pharmacovigilance vacancies were live on Naukri in August 2026, and 72 per cent of pharmacovigilance professionals say their teams are understaffed. On the hospital side, 67.19 crore health records are now linked to ABHA across 4.18 lakh registered facilities. Companies will look first at the people who already know the records.
Sources: Indian Pharmacopoeia Commission, PvPI (ADR monitoring centres). Naukri India, pharmacovigilance jobs, indexed Aug 2026. Taggd, Pharmacovigilance hiring trends in India, 21 May 2026, citing the Drug Safety Alliance survey 2024. PIB, Ayushman Bharat Digital Mission update, 12 Aug 2025 (figures as of 5 Aug 2025).
Start with your own field. Mid-level pharmacovigilance roles that paid ₹8 to 12 lakh two years ago are now benchmarked at ₹14 to 20 lakh in Hyderabad and Bengaluru; add data protection to that and you have a skill very few people on the floor have. Now the ceiling of the privacy seat itself: State Bank of India advertised its Data Protection Officer at ₹60 lakh CTC and an Assistant Data Protection Officer at ₹45 lakh. Companies that cannot hire pay outside advisers for the same work: gap assessments from ₹50,000, implementation ₹75,000 to ₹2.5 lakh, named-officer retainers ₹2.5 to ₹5 lakh a quarter. Entry into privacy work in India starts around ₹4.5 to ₹6.5 lakh a year. These are market figures. What you earn depends on your own effort and your market.
Sources: Taggd, 21 May 2026, citing Frost and Sullivan 2024. SBI advertisement CRPD/SCO/2023-24/21. Published Indian consultancy fee schedules, as on our August pages. AmbitionBox, Data Privacy Analyst pay, 2026.
Rule 7 of the DPDP Rules says a company must tell the Data Protection Board about a breach without delay, and file the full report within 72 hours: what happened, what was done, and who was told. Every affected patient must be notified too. A safety database holds thousands of named patients; a hospital information system holds every patient who ever walked in. Someone in every safety team and every records department has to own that sequence before it is needed. Writing that runbook is one of the 20 skills.
Source: DPDP Rules, 2025, Rule 7.
This is a step up in your career, not a side task on your current desk.
How you get there. You learn the 20 skills, you mark your own floor or hospital against the rules, and you take the gap list to management. That note is how an associate becomes the owner. This is the step up, not more work on the same desk.
The tasks that land first, in the two places this page is written for. Nobody has to leave their job to pick them up.
Free resources go out every single day, whether or not you go any further with us.
The obligations that actually bind a healthcare organisation, mapped onto the records you handle: case safety reports, the safety database, the HIMS, consent, retention, access, the grievance process. You mark your own institution and finish holding the gap list.
Yours that evening: the obligation checklist and the records gap sheet.The breach reporting runbook with owners filled in, the patient-facing notice and consent formats, and the vendor clauses for labs, insurers, software providers and global safety databases.
Yours that evening: the breach runbook, the notice and consent formats and the vendor clause set.The compliance calendar, how to present the gap list so administration gives you the go-ahead instead of getting alarmed, and the honest route from records or pharmacovigilance work to the privacy seat.
Yours that evening: the compliance calendar, the management note format and the role plan.This is a live camp. There are no recordings, by design. You also get the attendee WhatsApp group and a certificate on completion.
Named, with employers, from our own learner records.
An M.Sc in pharmaceutical chemistry, now a Data Privacy Consultant at Capgemini. Science backgrounds like yours are moving into this field.
She was a risk verification officer. She is now Data Protection Manager at Gentrack, a global software company.
Our course anchor, Aishvarya Joshi, holds CIPP/E, CIPM, CIPT and AIGP from the IAPP, and is an ISO 27001 Lead Auditor and ISO 27701 Lead Implementer.
Knowing the records is the qualification.
Yes. The duties are about records, consent, retention and process, and the person who knows where the records live is ahead of any outsider. IT implements controls; someone must decide what the rules require, and that person should know the wards.
Yes, today. No country has been notified as restricted, so transfers are allowed. But the company stays fully accountable for that data wherever it goes, the transfer must be documented, and the Rules let the government put extra limits on Significant Data Fiduciaries later. Health data is exactly the kind of data such limits would target. Knowing how to document a transfer is one of the 20 skills.
No. Filing the records and owning data protection for the organisation are different grades. The owner writes the rules, signs the breach report and answers the regulator. That seat is being created now, and the camp gives you the plan to move into it. The head start is the point.
No. Day one maps the obligations onto your records. Days two and three produce the runbook, the consent set and the note you take to administration.
No, and do not rely on anyone who says it does. That duty applies to significant data fiduciaries once the government notifies those categories, and it has not yet done so. What binds every company today is the notice, consent, retention limits, grievance handling and breach reporting.
No. The camp is live by design. You keep the notes, the templates, the WhatsApp group and a certificate.
DISCLAIMER: The figures mentioned above are based on examples and should be viewed as such. Although many professionals have achieved successful outcomes, individual results will vary and depend on factors including prior experience, background, dedication, and consistent effort. This program is designed to provide practice-building and career guidance, and success will require personal effort and action.
This site and program are not affiliated with or endorsed by Facebook, Google, or any social media platform. FACEBOOK is a trademark of META PLATFORMS, Inc. YOUTUBE and GOOGLE are trademarks of ALPHABET, Inc.
This is an educational training course intended to help aspiring learners gain valuable insights and hands-on skills. It is not a business opportunity or a "get-rich-quick" scheme. Testimonials, success stories, and examples provided on this page are not meant to imply guaranteed results, and your experience may differ.
Skill Arbitrage — © 2026 All Rights Reserved
Space Creattors Heights, 3rd floor, Landmark Cyber Park, Golf Course Extension Sector 67, Gurgaon, Haryana - 122102
📞 +91 8046971133 ✉ [email protected]