Open to opportunities

Shubham Singh

@shubhamsingh25

Message

I build practical data privacy governance frameworks across regulated businesses.

India

Message

I'm currently supporting BTSE Holdings as a Senior Privacy Governance Consultant, where I execute privacy assessments, strengthen vendor controls, and build audit-ready governance across business functions.

I operationalized BTSE's customer DSR/DSAR framework with an SLA tracker and RACI escalation model, leading a 13-system dry run across OneTrust, Sumsub, Databricks, and AWS. I also assess privacy risks across KYC/AML and sanctions-screening vendors and advise on cross-border transfer requirements.

Previously at RateGain Travel Technologies and Eshopbox, I built data inventories and RoPAs, conducted DPIAs and transfer assessments, and drafted privacy policies, DPAs, retention standards, incident-response processes, and DSAR workflows. I worked closely with Infosec, IT, GRC, Product, Engineering, and Operations teams to embed privacy by design.

My legal foundation includes privacy governance for financial-services systems at SMC Global Securities, alongside litigation, arbitration, and legal research experience. I'm a CIPP/E-certified lawyer focused on translating GDPR, DPDPA, and related requirements into workable controls.

Experience

Work history, roles, and key accomplishments

Current

Senior Privacy Governance Consultant

Current

BTSE Holdings Limited

Apr 2026 - Present (5 months)

Executed RoPA, PIA, LIA, and TIA assessments across business functions, identifying compliance gaps and documenting remediation actions. Led third-party privacy risk assessments, drafted DPAs, and built a customer DSR/DSAR framework.

GDPR CCPA DPDPA Privacy By Design Data Mapping Consent Management OneTrust DPIAs Risk Assessment SCCs Vendor Risk Management Data Breach Response RoPA

Data Privacy Specialist

Rategain Travel Technologies

Oct 2025 - Mar 2026 (5 months)

Built enterprise-wide data inventory, processing maps, and RoPA across all functions. Conducted DPIAs, TPIAs, and product-level privacy reviews for SaaS/DaaS and internal systems.

Data Mapping RoPA DPIAs TPIA GRC Privacy Policies NIST Cybersecurity Framework BAA DPA Negotiation International Payments and Cross Border Transfers SCCs TIAs

Corporate Lawyer

Eshopbox E-commerce Pvt Ltd.

Jul 2025 - Oct 2025 (3 months)

Led enterprise-wide data privacy implementation aligned with India DPDPA and ISO 27701 across logistics, SaaS platforms, and corporate functions. Drafted and operationalized privacy policies, DPAs, and vendor privacy clauses.

DPDPA ISO 27701 Data Mapping RoPA DPIAs Vendor Risk Assessment DSAR Breach Response Privacy By Design International Payments and Cross Border Transfers

Senior Legal Executive

SMC Global Securities

Jun 2023 - Apr 2025 (1 year 10 months)

Led data protection and privacy governance across trading platforms, CRM, KYC/AML systems, and financial transaction workflows. Reviewed and negotiated DPAs, client contracts, and vendor agreements.

GDPR SEBI IT Act DPDPA Data Flow Mapping Privacy Impact Assessment Access Control Incident Response Arbitration Legal Notices DIAC

Legal Associate

Manish Verma, Advocate

May 2022 - Apr 2023 (11 months)

Represented banks in cases related to Section 138 of the Negotiable Instruments Act, and execution of decrees and awards. Handled matters under the SARFAESI Act and the Consumer Protection Act.

Legal Research Negotiable Instruments Act SARFAESI Act Consumer Protection Law Litigation