9 hrs free live training on
How to become the Data Protection Officer your organisation will need in 2027, or start as a privacy analyst
India's new privacy law, the Digital Personal Data Protection (DPDP) Act, 2023, has a date. From 13 May 2027, every Indian company must follow it. 83% of companies EY surveyed had not begun, and 76.4% named a lack of expertise as a key challenge. The field is new for everyone, so nobody has years of head start on you. We teach you the 20 skills employers are hiring for. No law degree. No coding. Works beside your job.
SkillArbitrage · NSE Emerge-listed · Recognised NSDC Training Partner
No cost, no card. Live only, no recordings, so come live.
What you will learn in the training
Data privacy work means deciding how an organisation collects, stores, shares and deletes people's personal data, and proving that it follows the law. Three working evenings; you leave each one holding something.
The 7 kinds of privacy work, and the roles from privacy analyst to Data Protection Officer
What has to be implemented now under the DPDP Act and Rules, and the obligations that actually bind an Indian company
A live impact assessment on a simulated company, starting with where the data goes, and the 10 questions to run on your own organisation
The 20 skills that give you a head start in data privacy, as a plan of 2 hours a day for 6 months
10 differences between India's DPDP Act and Europe's GDPR
How to review a privacy policy and find the gaps
How to handle a person's request to access, correct or delete their data
How to respond to a data breach
How to build your initial credibility, and a track record at your current job
How to position yourself for out of turn promotions and hikes, and negotiate your terms as a DPO
…and live questions answered on the call
From 13 May 2027: 6 duties that land on every organisation
The core duties of the DPDP Rules 2025, which switch on 18 months after the Rules were notified. Someone in every organisation has to own these answers.
A clear notice
People are told, in plain language, what is collected and why.Consent that can be withdrawn
As easy to take back as it was to give.Safeguards
Encryption, access control and a log of who viewed a document.Breach reporting
Affected people and the Data Protection Board are informed, with a detailed report within 72 hours.Deletion on time
Held only as long as the purpose or another law requires.A person who answers
A published contact for people's questions about their data.The new law asks one thing at every stage: was there a reason to hold this, and was it kept safe?
Every organisation needs this. Very few people can do it.
When demand runs ahead of supply like this, hikes and promotions come ahead of turn.
And there is no incumbent class
India's privacy regulator is still being staffed. Nobody has ten years of experience in this law, because the law has not existed for ten years. Everyone starts level, whatever their seniority in other work.
This profession recruits from outside itself, on purpose.
Two ways into the work
The officer seat: the person who writes the consent, retention and access rules everyone follows, and answers management and the regulator on personal data.
The analyst start: start as a privacy analyst in your own organisation, an NBFC or a consulting firm, and move up fast.
Both routes start with the same 20 skills. Neither needs a law degree or a new job to begin.
One new law. Every background starts level.
Wherever you work, you probably already handle personal data. That is the head start.
Hospitals, healthcare & pharma
NABH, pharmacovigilance, clinical research, medical coding, RCM and AR calling. India's new data law applies to every hospital from May 2027, and health data is the most sensitive category in it. Clinical research coordinators already take documented consent for a living. In transcription and RCM you already work to a foreign health privacy standard every day.
Lawyers
Firm associates, litigators, cyber lawyers, independent practice and in-house counsel. Data protection practice has no veterans in India, because the law is too new for anyone to be one. Associates can become the firm's privacy practice; litigators can build a retainer practice beside court work; in-house counsel can step up to the data privacy lead role.
KYC, banking, NBFC, insurance & broking
Every account starts with an Aadhaar copy, a PAN and a photo, and the privacy rules sit on top of the same files. Broking firms already hold investor identity documents under their market regulator. Insurance agents collect health declarations over chat apps every day.
IT, security, data analysts & GCC staff
India's data protection rules read like a security standard: encryption, access control, logging and a 72 hour clock. You already operate most of it. Data analysts know where data lives. In a capability centre, a privacy mandate is the rare thing the centre can hold rather than assemble.
Company secretaries, CAs & compliance
Every company a CS serves now owes a notice, a consent basis, retention limits, a grievance route and a 72 hour breach report. CAs already test their clients' controls once a year. For compliance professionals, it is one more regime on the desk you already run.
Background verification staff
You already check other people's documents. India's new data law applies to every company that holds personal data from May 2027, and privacy consultants set the rules for how employers collect, keep and delete candidate data.
Logistics & fleet operations
Riders carry names, phone numbers and live location all day. Masked numbers, location retention and what a rider can see on the app are decisions somebody has to make and write down, and the operations lead who does becomes the owner of the seat.
Returning after a break
Privacy operations is document based, structured and often done from home. It is one of the few new professions with no seniority gate, so the break does not count against you.
- You work in healthcare, law, banking, insurance, broking, IT, compliance, background verification or logistics, or held any professional role before a break: operations, banking, HR, law, science, teaching.
- You want a bigger role, not a bigger pile of files.
- You can give 2 hours a day for 6 months, and want to be ready before May 2027.
No law degree and no coding needed. The field is new for everyone, which is exactly the point.
What privacy roles pay in India
Published figures from Indian employers, consultancies and the profession's own survey. Nothing modelled.
State Bank of India's Data Protection Officer
And an Assistant Data Protection Officer at ₹45 lakh.SIDBI's DPO Office, May 2026
A Consent Manager at around ₹40 lakh and a Data Auditor at around ₹35 lakh.At one to three years of privacy experience
The DPO Club India Privacy Salary Report 2025-26, from 132 Indian privacy professionals, puts 75% of in-house DPOs above ₹35 lakh.Entry into privacy work
Where the ladder starts in India. It runs up to the officer seat.Gap assessments by consultancies
Usually the door opener. Implementation support commonly runs ₹75,000 to ₹2.5 lakh depending on scope.A named dedicated officer retainer
Fractional officer retainers for smaller companies run ₹80,000 to ₹1.5 lakh a quarter. Enterprise retainers start around ₹6 lakh a quarter.These are market figures and the direction of travel, not a promise of income. What you earn depends on your own effort and your market.
Your three evenings, in detail
9 hours, live, with questions answered on the call. Free resources go out every single day.
What the work is, and an impact assessment done live
- The 7 kinds of privacy work, and the roles from privacy analyst to Data Protection Officer
- What has to be implemented now under the DPDP Act and Rules
- A live impact assessment on a simulated company, starting with where the data goes
- You leave able to run the same 10 questions on your own organisation
Your plan, and India's law next to Europe's
- The 20 skills, as 2 hours a day for 6 months
- 10 differences between the DPDP Act and the GDPR
- Reviewing a privacy policy and finding the gaps
- You leave with the plan in your hands
Data requests, breaches and your track record
- Handling a request to access, correct or delete personal data
- Responding to a data breach
- Building a track record at your current job, and negotiating your terms as a DPO
- You leave with request forms and the DPO agreement template
Live only. There are no recordings, by design. You keep the notes, the templates, the attendee WhatsApp group and a certificate.
People who made this move
Named, with employers, from our own learner records.
Dipti Sawant
She was a risk verification officer. She is now Data Protection Manager at Gentrack, a global software company.
Shreya Pandey
She is now Senior Analyst, Privacy and Data Protection at Infosys.
Sonal Joshi
An M.Sc in pharmaceutical chemistry, now a Data Privacy Consultant at Capgemini.
Sandip Singh
A 2012 BTech graduate from Cuttack, now a Senior Consultant at Capgemini working as a privacy professional.
Stephen George Zachariah
Now on the Legal and Cybersecurity team at Volvo Group.
Who teaches it
Holds CIPP/E, CIPM, CIPT and AIGP from the IAPP, and is an ISO 27001 Lead Auditor and ISO 27701 Lead Implementer.
What you take home
Free giveaways for attending. Each day's set is shared by email after you attend that evening live for at least 2.5 hours.
- A guide to the GDPR: does it apply to you?
- A guide to whether you are a data controller or a data processor
- A guide to the consequences of GDPR violations
- A guide to cross-border transfer of data
- A guide to creating a personal data asset inventory list
- A guide to drafting a cookie policy for a website
- A guide to the rights of customers, employees and other data subjects
- Your 6-month plan: the 20 skills, 2 hours a day
- An introduction to workplace privacy in the US
- Template: GDPR compliant privacy policy
- Template: Canadian privacy policy
- Template: privacy notice
- Sample right to erasure (deletion) request form
- Data access request form
- A guide to when and how to conduct a data protection impact assessment
- A guide to how to succeed as a Data Protection Officer (DPO) in an organisation
- Transfer impact assessment checklist
- Compliance checklist under the California Consumer Privacy Act
- Data subject request form, and a personal data flow map
- Template: GDPR impact assessment report
- Templates: privacy policy, and a privacy policy compliant with US laws
- Template: DPO agreement
Questions
Do I need to know the law already?
No. Everything is taught in plain words for people who work in operations. The skills are process skills: registers, checklists, requests and reports.
I have no legal background. Is that a problem?
No. The bootcamp assumes no law degree and no coding. Sonal Joshi came from pharmaceutical chemistry and consults on privacy at Capgemini today.
Does every company have to appoint a Data Protection Officer?
No, and do not rely on anyone who says it does. That duty applies to significant data fiduciaries once the government notifies those categories, and it has not yet done so. What binds every company today is the notice, consent, retention limits, grievance handling and breach reporting.
Do I need to change jobs?
No. The first route is inside your own organisation. Day 3 covers building a track record there.
We already follow HIPAA. Is the Indian law not redundant?
No, and that is the opportunity. India's law adds its own consent, retention, grievance and breach duties on the processing done here, and clients now ask for proof of both.
Will employers hold a career break against me?
In established fields they often do. In privacy the entire Indian profession is new, 44 per cent of privacy teams transferred in from other fields, and what employers ask for is evidence you know the regime. That evidence is buildable, and building it is what the bootcamp starts.
Is there any cost?
No. Registration is free and there is nothing to pay to attend.
Is it recorded?
No. The bootcamp is live by design. You keep the notes, the templates, the WhatsApp group and a certificate.
Do I still get the templates if I miss part of a session?
Templates and guides go to people who attend live, for at least 2.5 hours of that evening. Plan to stay for the whole session.
The field is new. Get your head start before the law's date arrives.
Three live evenings give you the 20 skills, the plan and a head start before the law's date arrives. 4, 5 & 6 November · 7–10 PM IST · free · live only.
DISCLAIMER: The figures mentioned above are based on examples and should be viewed as such. Although many professionals have achieved successful outcomes, individual results will vary and depend on factors including prior experience, background, dedication, and consistent effort. This program is designed to provide practice-building and career guidance, and success will require personal effort and action.
This site and program are not affiliated with or endorsed by Facebook, Google, or any social media platform. FACEBOOK is a trademark of META PLATFORMS, Inc. YOUTUBE and GOOGLE are trademarks of ALPHABET, Inc.
This is an educational training course intended to help aspiring learners gain valuable insights and hands-on skills. It is not a business opportunity or a "get-rich-quick" scheme. Testimonials, success stories, and examples provided on this page are not meant to imply guaranteed results, and your experience may differ.
Skill Arbitrage — © 2026 All Rights Reserved
Space Creattors Heights, 3rd floor, Landmark Cyber Park, Golf Course Extension Sector 67, Gurgaon, Haryana - 122102
📞 +91 8046971133 ✉ [email protected]