Harsh Verma

About Harsh Verma

Currently working as Deputy Manager – Data Privacy & GRC at Max Healthcare, where I contribute to strengthening privacy governance and compliance frameworks within the healthcare ecosystem.In my role, I focus on building robust privacy programs, conducting risk and compliance assessments, and driving governance initiatives that align with both regulatory and organizational objectives.Prior to this, I worked as a Consultant at EY, where I led privacy and strategy transformation engagements for clients across the public and private sectors. My experience includes designing and operationalizing privacy compliance frameworks aligned with global standards such as UAE PDPL, ISO 27701, DESC-ISR, GDPR, and domestic regulations like India’s Digital Personal Data Protection Act (DPDPA).Key highlights from my experience include:Conducting privacy gap and risk assessments across multiple industriesDeveloping core privacy artefacts such as RoPA, DFDs, and PDIsImplementing governance structures to integrate data privacy into enterprise operationsDelivering 20+ awareness sessions on data privacyPerforming 50+ DPIAs for high-risk processing activitiesAn MBA graduate from Symbiosis Institute of Digital and Telecom Management (Batch 2022–24), with a major in Analytics and a minor in Finance, I bring a blend of analytical thinking, technical understanding, and governance expertise to help organizations achieve sustainable privacy and compliance maturity.

Experience

1. Consultant

   EY

   Jul 2024 — Present · Mumbai, IN

   Project 1: UAE Power & Energy Government Entity (On-Site)- Designed a Unified Compliance Framework integrating UAE Decree Law 45, ISO 27701 & DESC ISR, enabling scalable privacy compliance across the organization- Established a Privacy Governance Framework and supported the launch of an Office of Data Protection & Privacy (ODPP)- Delivered 60+ DPIAs, including for GenAI-based solutions, advising on AI ethics, cross-border transfers & risk mitigation- Created RoPA, DFDs, PDIs, and drafted core privacy policies (DSR, breach, internal), aligning legal and business goals- Led 20+ stakeholder trainings to build buy-in and privacy awareness across the enterprise.Project 2: Leading Telecom & Media Org- Documented RoPA, DFDs & PDIs for 50+ processing activities- Drafted consent notices, cookie banners & user-facing policies tailored to multiple data principal categories.Project 3: Renewable Energy Org – India DPDPA Compliance- Developed privacy notices, cookie banners & internal policies compliant with the India DPDPA and aligned them with other global regulations- Conducted DPIAs, drafted intra-group DPAs, and built a privacy governance framework aligned with global standards.Project 4: Global Pharma Org- Designed a Unified Compliance Framework across laws (New Jersey DPA, UK DPA, Australian Privacy Act)- Conducted privacy assessments to uncover root compliance issues using data-driven analysis.

Education

• Lucknow public school

  SSE (12th), PCM

  2015 — 2016

• Lucknow Public School, Lucknow

  HSC (10th)

  2013 — 2014

• Symbiosis Institute of Digital & Telecom Management (SIDTM), Pune

  MBA - DTM