Manager- Data Governance and Responsible AI

Position: Manager – Data Governance and Responsible AI
Location: India- Chennai, New Delhi or Bengaluru. Hybrid, with travel to Athena offices, project sites and field partners in India and occasionally abroad
Position Type: Full Time
Experience: 8–12 years
About Athena
Athena Infonomics is a research, advisory and implementation firm working with governments, multilateral institutions, foundations and companies on development and public-policy problems. We operate across India, the United States, EU, Asia and Africa. The group also includes TolaData, an impact-measurement software platform, and early-stage work in AI and digital public infrastructure.
Our work runs on data that is often personal, sensitive or confidential: household and beneficiary surveys, qualitative interviews with vulnerable groups, health and social-protection records, government administrative datasets, and proprietary client data. Much of it is collected in the field by our staff, enumerators and partners, then stored, analysed, shared and archived across several countries and tools. Our teams also use AI every day, on that same data.
Two things make this role necessary now. India's Digital Personal Data Protection Act and its Rules take effect in stages through 2026 and 2027, alongside GDPR and other regimes we already work under. And our use of AI has grown faster than the guardrails around it. We want one organisation-wide way of governing, protecting and using data that is practical for field teams and credible to clients, regulators and investors. This role builds and owns it.
The role
You will own how the Athena group governs, protects and uses data, including how it uses AI on client and participant data. You will design the framework, write the policies and tools, put them into daily use across practices and offices, and keep them current as law, clients and technology change. You will be the person clients, auditors and regulators talk to about our data practices, and the person our project teams call when a hard case comes up in the field.
This is a build-and-own role, not a compliance desk. You start with an independent diagnostic of where we stand; your job is to turn its findings into a working system and then run it. The measure of success is that a project manager in Chennai, a field coordinator in Nairobi and a product engineer at TolaData each know what they may do with data, do it without asking, and can show it if asked.
What You Will Do
Build and own the data governance framework
Take the findings of the independent diagnostic and turn them into a right-sized policy suite: data governance, data protection and privacy, information security, classification and handling, retention and disposal, third-party and field-partner data, breach and incident response, data sharing and publication.
Set the governance model: who owns which data, who decides, and how the policies are kept current. Run the Data Governance Steering Group's cadence.
Build the operating toolkit teams actually use: project data management plans (with a light version for low-risk work), consent frameworks for written, verbal, digital and low-literacy settings, DPIA and screening checklists, data sharing and processing agreement templates, field data protocols, project start-up and close-out checklists.
Maintain the data inventory and record of processing activities across entities.
Make the group compliant and keep it there
Own readiness for India's DPDP Act and Rules across their phased deadlines, and for GDPR, UK GDPR, Kenya's Data Protection Act and client-specific requirements in the countries where we work.
Act as, or stand up, the Data Protection Officer function; be the named contact for clients, data principals and regulators.
Review data clauses in client contracts, sub-contracts and vendor agreements, working with external counsel where needed.
Run breach and incident response when it is needed, and the drills before it is.
Prepare TolaData for the certifications its customers and investors will expect (ISO 27001 and SOC 2 readiness), working with the product and engineering team and specialist consultants.
Govern how we use AI
Build and maintain the AI tool register and approval process: which tools, which data classes, under what vendor terms, with what human oversight.
Write and keep current the Responsible AI policy, covering staff use of generative AI on client and participant data and the AI features in products we build for clients and in TolaData.
Design AI risk assessment into the project lifecycle so teams can use AI productively with clear guardrails rather than being blocked by default.
Stay close to how our teams and products actually use AI, and keep the rules practical as the tools change.
Put it into daily practice
Train leaders, project managers, data analysts, field coordinators and partner enumerators, using our own cases; build the short modules new staff and partners go through before they handle data.
Work alongside project teams on live engagements: review data management plans, sit in on field design, resolve hard cases quickly.
Run a light audit cycle: sample projects each year, trace data from collection to disposal, publish what was found and what changed.
Track a small set of indicators the Co-Founders review each quarter, and report to clients and auditors when asked.
How The Role Works
Scope. You are employed by Athena Infonomics, but the mandate spans the group. Expect a substantial share of your time on TolaData, which processes client monitoring data as a software platform and is preparing for institutional investment, and some on the group's AI ventures and its US federal work.
Reporting. You report to the Co-Founder and a small Data Governance Steering Group that meets monthly. Practice heads, IT, the TolaData product lead and legal counsel sit on it. You set its agenda.
Independence. You are expected to say no, in writing, when a project, product or client request cannot be done safely, and to propose what can. The Co-Founders will back that.
Proportionate by design. Controls must match the sensitivity of the data and the risk. Low-risk work stays light. A framework field teams cannot follow in a low-connectivity, multi-language setting is a failed framework.
Specialists on call. You will have a budget for external counsel, penetration testing and certification consultants. You decide when to use them; you do not need to be a lawyer or a security engineer yourself.
Time zones and travel. The group works across India, East Africa, Europe and the United States. Some early-morning or evening calls are part of the job, as is travel to Athena offices, project sites and field partners.
Discretion. You will see client data, contracts, incident reports and investor material from day one. Judgement about what to share, with whom, and when is a core requirement.
Tools. We use AI tools every day for research, drafting and analysis. You should already work this way, and be able to govern it from the inside.
Who We Are Looking For
Must have
8–12 years of experience, with a substantial part spent building or running a data protection, privacy or data governance programme inside an organisation or for clients. You have implemented, not only advised.
Working command of India's DPDP Act and Rules and of GDPR, and the ability to read a new regime or a client's data requirements and turn them into practice.
Experience writing policies, procedures and templates that people actually used, and training people to use them.
Enough information security literacy to run an ISO 27001 or SOC 2 readiness effort and to manage a security consultant well. You do not need to be the engineer.
Practical understanding of how generative AI tools handle data (training, retention, hosting, account types) and of what responsible use looks like in an organisation.
Excellent written English. Policies, guidance and client responses that a non-specialist can follow and a specialist cannot fault.
Judgement and steadiness: comfortable taking a firm position with senior colleagues and clients, and finding the workable answer rather than the safest-sounding one.
Fluent daily use of AI tools in your own work.
Strongly Preferred
A recognised privacy or AI governance credential: CIPP/E, CIPM, DSCI DCPP or DCPLA, AIGP.
Experience with research or development-sector data: informed consent, field data collection, enumerator partners, ethics review, vulnerable participants.
Exposure to a software or SaaS business, including vendor security questionnaires, data processing agreements and certification audits.
Experience working across several countries and legal regimes, including Kenya or other East African markets.
Experience with donor and client data requirements from multilateral institutions, foundations and government clients.
What Success Looks Like
HorizonWhat is visibly trueFirst 90 daysYou have absorbed the independent diagnostic, met every practice and office, and the Steering Group has agreed a prioritised plan with owners and dates. The data classification standard and the AI tool register are in use. The DPDP obligations that take effect in November 2026 are cov

Work arrangement
No