Role Purpose

The Legal Compliance Lead Analyst supports Cigna International Health’s global privacy program and serves as the designated in-country representative of the Chief International Privacy Officer in engagements with competent data protection and other relevant authorities in India. The role combines privacy advisory expertise with disciplined, process and project driven delivery across core privacy operations.

The role partners with business, Legal, Compliance, Information Protection and other relevant functions, acts within defined governance and escalation frameworks, and promptly escalates complex, high-risk or material regulatory matters to the International Privacy Officer referent.

Key Responsibilities

1. Regulatory representation and governance

• Act as the designated representative of the International Privacy Officer in communications and engagements with competent data protection and other relevant authorities in India, within formally delegated authority and approved positions.
• Coordinate regulatory enquiries, information requests, meetings and follow-up actions, maintaining complete and accurate records and escalating material, sensitive or high-risk matters without delay.
• Monitor relevant privacy and data protection developments in India and contribute to the development of legal expertise for strategic markets.
• Support governance reporting, including the annual data protection report, management updates and evidence required for oversight.
• Own and drive global, cross-jurisdictional International Privacy Office projects end to end, engaging directly with internal stakeholders as needed to move work forward without requiring escalation of routine coordination.

2. Privacy advisory and risk assessments

• Act as a data protection subject matter expert for the business, providing practical advice on privacy issues and cross-border matters.
• Lead or support Data Protection Impact Assessments (DPIAs), Transfer Impact Assessments (TIAs) and periodic reviews, ensuring that decisions, risks, mitigations and approvals are documented.
• Identify potential data protection issues and opportunities for improvement, and contribute to structural, procedural and policy enhancements.
• Identify matters requiring specialist legal, security or executive input and apply defined escalation protocols.
• Conduct and progress AI assessments, reviewing respondent submissions, applying risk-tiering and classification criteria, aligning DPIA conclusions with AI Assessment findings, and advancing initiatives through the approval workflow.

3. Core privacy operations

• Oversee and support the processing of Data Subject Rights requests using approved workflows, templates, intake channels, ticketing and tracking tools.
• Maintain privacy registers, logs, trackers, review schedules and closure records, with a strong focus on quality, consistency and auditability.
• Coordinate the administrative handling of personal data breaches and privacy incidents, working with Information Protection and relevant stakeholders.
• Support shared privacy mailbox management and ensure that requests are triaged, assigned, tracked and closed appropriately.

4. Privacy framework, records and compliance monitoring

• Support the implementation and maintenance of Records of Processing Activities (ROPA) for controller and processor activities.
• Ensure that privacy policies, guidelines and procedures are defined, implemented, periodically reviewed and kept current.
• Test and monitor compliance with applicable privacy requirements, including relevant Indian requirements and, where applicable to International Health activities, GDPR, UK, DIFC, Asian, Middle Eastern and African data protection frameworks.
• Support audit readiness through evidence collection, document organization, implementation tracking and remediation follow-up.

5. Vendor, contracting and cross-border support

• Conduct or oversee first-pass privacy reviews of vendor questionnaires and due diligence documentation, and coordinate the escalation of non-standard or high-risk issues.
• Support the Legal team in drafting and negotiating internal and external privacy terms, including Standard Contractual Clauses where applicable.
• Coordinate contract intake, routing, records and follow-up, and support approved template-based privacy clauses.
• Advise on privacy considerations associated with international data transfers and cross-border processing.

6. Consent, training, reporting and continuous improvement

• Support cookie and consent management activities and maintain records of implementation status.
• Develop privacy training and awareness content for relevant employees and support delivery of targeted awareness initiatives.
• Prepare dashboards, metrics and reports covering privacy operations, including rights requests, assessments, vendor reviews, incidents and operational KPIs.
• Promote scalable and consistent processes, identify control gaps and support implementation of agreed corrective actions.

Authority, accountability and escalation

• Represent the Chief International Privacy Officer within the scope of documented delegation, approved legal positions and applicable internal governance.
• Do not make commitments, admissions or regulatory representations outside delegated authority.
• Escalate significant incidents, enforcement risks, complex legal interpretations, potential material non-compliance and matters with cross-border or enterprise-wide impact.
• Maintain a clear audit trail of advice, decisions, communications, evidence and follow-up actions.

Experience and Qualifications

• Law degree from India or another recognized jurisdiction.
• 8+ years of relevant professional experience in data protection or privacy compliance within an international organization; experience in health insurance, financial services or another regulated sector is preferred.
• Demonstrated experience with Indian data protection matters, regulatory engagement and cross-border privacy issues.
• Working knowledge of applicable privacy frameworks in India and relevant international regimes, including GDPR and data protection requirements across Asia (notably Singapore and Hong Kong) and the Middle East (notably UAE, KSA, Bahrain, Oman, Kuwait, Lebanon) and Africa (notably Kenya).
• Practical experience with DPIAs, TIAs, ROPA, data subject rights, vendor due diligence, privacy incidents, contracts and compliance monitoring.
• Experience working with ticketing systems, workflow tools and high-volume, process-driven operations.
• Data protection certification, such as CIPP or a comparable qualification, is an advantage.
• Fluent English; proficiency in an additional language is an advantage.

Core Capabilities

• Sound legal judgement, with the ability to distinguish operational issues from matters requiring escalation.
• Clear, credible and professional communication with authorities, directors, managing directors and cross-functional teams, reflecting the seniority and visibility expected of a lead-level role.
• Strong attention to detail, documentation discipline and commitment to audit-ready records.
• Ability to manage competing priorities, follow standard operating procedures and deliver consistently in a high-volume environment.
• Ability to independently identify blockers and structural issues, and to bring forward a recommended course of action together with viable alternatives
• Ability to work autonomously on tasks, while maintaining transparent, timely reporting on both progress and issues to enable oversight and informed decision-making.

About The Cigna Group