Interim Chief Privacy Officer — Adtech Data Transition

The mandate

A major data partner suspended audience sharing after discovering that downstream purpose and retention controls could not be evidenced, and the privacy chief resigned during escalation. Product and revenue teams now need independent rulings on which datasets, identity links and measurement uses may continue.

The interim must begin within three weeks for ten months, covering data mapping, control repair and partner reinstatement. A permanent search starts after the lawful-purpose architecture is approved; extension is possible for one month if the partner audit is delayed.

Handover is complete when all material data flows carry documented purpose, consent or other valid basis, prohibited combinations are technically blocked, the suspended partner accepts remediation, subject requests meet target for ninety days, and the successor chairs one Data Ethics Committee.

The interim may stop processing, quarantine datasets, impose privacy design gates and allocate ₹5 crore of remediation spend. Customer or partner settlements above ₹3 crore, permanent leadership hires, new sensitive-data products, retention-policy exceptions and acceptance of high residual privacy risk require committee or board approval.

Advertising pricing, campaign performance and general information security are outside scope. Privacy will define permissible processing and evidence but will not own commercial yield or substitute for the CISO's security controls.

Why this seat is open

The partner suspension invalidated prior broad assumptions about downstream use. Internal counsel can interpret terms but does not command product and data changes. An interim privacy executive can make time-bound processing decisions while the company recruits for the long-term data model.

What you will own

• Map each material data flow from collection through identity resolution, audience creation, activation, measurement and deletion.
• Decide which processing stops, continues or needs redesigned consent based on purpose, sensitivity and downstream control.
• Establish technical blocks for prohibited joins, retention expiry and partner use beyond contracted purpose.
• Approve privacy reviews for product and partner changes through retained data, purpose, control and risk evidence.
• Rebuild subject-access and deletion operations with identity confidence, response clocks and downstream confirmation.
• Secure partner acceptance through sampled flow evidence and ninety days of sustained control operation.
• Transfer processing decisions, partner commitments, accepted risks, data inventories and the next review calendar to the successor.

Candidate qualifications

• Held Chief Privacy Officer, Data Protection Officer or privacy director authority in adtech, digital media or data platforms.
• Recovered a data partnership or product after consent, purpose or downstream-use controls failed.
• Mapped complex advertising identity and audience flows across multiple processors and partners.
• Exercised stop-processing authority against material revenue consequence.
• Built subject-rights and retention controls that worked across downstream systems, not only policy.
• Understands Indian privacy requirements and cross-border advertising-data governance.

Non-negotiables

• Can start in Bengaluru within three weeks.
• No active advisory role with the suspended data partner or identity vendors.
• Will not approve processing on implied commercial necessity alone.
• Must have issued binding privacy decisions over live products.

1. 49 words maximum. Confirm availability and disclose any data-partner or identity-vendor conflict.
2. 49 words maximum. Describe a processing activity you stopped and the commercial consequence accepted.
3. 49 words maximum. How would you prove a deletion request propagated through an advertising data chain?