Manager- Data Governance and Responsible AI

Position: Manager – Data Governance and Responsible AI Location: India- Chennai, New Delhi or Bengaluru. Hybrid, with travel to Athena offices, project sites and field partners in India and occasionally abroad Position Type: Full Time Experience: 8–12 years
About Athena Athena Infonomics is a research, advisory and implementation firm working with governments, multilateral institutions, foundations and companies on development and public-policy problems. We operate across India, the United States, EU, Asia and Africa. The group also includes TolaData, an impact-measurement software platform, and early-stage work in AI and digital public infrastructure. Our work runs on data that is often personal, sensitive or confidential: household and beneficiary surveys, qualitative interviews with vulnerable groups, health and social-protection records, government administrative datasets, and proprietary client data. Much of it is collected in the field by our staff, enumerators and partners, then stored, analysed, shared and archived across several countries and tools. Our teams also use AI every day, on that same data.
Two things make this role necessary now. India's Digital Personal Data Protection Act and its Rules take effect in stages through 2026 and 2027, alongside GDPR and other regimes we already work under. And our use of AI has grown faster than the guardrails around it. We want one organisation-wide way of governing, protecting and using data that is practical for field teams and credible to clients, regulators and investors. This role builds and owns it.
The role You will own how the Athena group governs, protects and uses data, including how it uses AI on client and participant data. You will design the framework, write the policies and tools, put them into daily use across practices and offices, and keep them current as law, clients and technology change. You will be the person clients, auditors and regulators talk to about our data practices, and the person our project teams call when a hard case comes up in the field.
This is a build-and-own role, not a compliance desk. You start with an independent diagnostic of where we stand; your job is to turn its findings into a working system and then run it. The measure of success is that a project manager in Chennai, a field coordinator in Nairobi and a product engineer at TolaData each know what they may do with data, do it without asking, and can show it if asked.
What you will do 1. Build and own the data governance framework •    Take the findings of the independent diagnostic and turn them into a right-sized policy suite: data governance, data protection and privacy, information security, classification and handling, retention and disposal, third-party and field-partner data, breach and incident response, data sharing and publication. •    Set the governance model: who owns which data, who decides, and how the policies are kept current. Run the Data Governance Steering Group's cadence. •    Build the operating toolkit teams actually use: project data management plans (with a light version for low-risk work), consent frameworks for written, verbal, digital and low-literacy settings, DPIA and screening checklists, data sharing and processing agreement templates, field data protocols, project start-up and close-out checklists. •    Maintain the data inventory and record of processing activities across entities.
2. Make the group compliant and keep it there •    Own readiness for India's DPDP Act and Rules across their phased deadlines, and for GDPR, UK GDPR, Kenya's Data Protection Act and client-specific requirements in the countries where we work. •    Act as, or stand up, the Data Protection Officer function; be the named contact for clients, data principals and regulators. •    Review data clauses in client contracts, sub-contracts and vendor agreements, working with external counsel where needed. •    Run breach and incident response when it is needed, and the drills before it is. •    Prepare TolaData for the certifications its customers and investors will expect (ISO 27001 and SOC 2 readiness), working with the product and engineering team and specialist consultants.
3. Govern how we use AI •    Build and maintain the AI tool register and approval process: which tools, which data classes, under what vendor terms, with what human oversight. •    Write and keep current the Responsible AI policy, covering staff use of generative AI on client and participant data and the AI features in products we build for clients and in TolaData. •    Design AI risk assessment into the project lifecycle so teams can use AI productively with clear guardrails rather than being blocked by default. •    Stay close to how our teams and products actually use AI, and keep the rules practical as the tools change. 4. Put it into daily practice •    Train leaders, project managers, data analysts, field coordinators and partner enumerators, using our own cases; build the short modules new staff and partners go through before they handle data. •    Work alongside project teams on live engagements: review data management plans, sit in on field design, resolve hard cases quickly. •    Run a light audit cycle: sample projects each year, trace data from collection to disposal, publish what was found and what changed. •    Track a small set of indicators the Co-Founders review each quarter, and report to clients and auditors when asked.
How the role works •    Scope. You are employed by Athena Infonomics, but the mandate spans the group. Expect a substantial share of your time on TolaData, which processes client monitoring data as a software platform and is preparing for institutional investment, and some on the group's AI ventures and its US federal work. •    Reporting. You report to the Co-Founder and a small Data Governance Steering Group that meets monthly. Practice heads, IT, the TolaData product lead and legal counsel sit on it. You set its agenda. •    Independence. You are expected to say no, in writing, when a project, product or client request cannot be done safely, and to propose what can. The Co-Founders will back that. •    Proportionate by design. Controls must match the sensitivity of the data and the risk. Low-risk work stays light. A framework field teams cannot follow in a low-connectivity, multi-language setting is a failed framework. •    Specialists on call. You will have a budget for external counsel, penetration testing and certification consultants. You decide when to use them; you do not need to be a lawyer or a security engineer yourself. •    Time zones and travel. The group works across India, East Africa, Europe and the United States. Some early-morning or evening calls are part of the job, as is travel to Athena offices, project sites and field partners. •    Discretion. You will see client data, contracts, incident reports and investor material from day one. Judgement about what to share, with whom, and when is a core requirement. •    Tools. We use AI tools every day for research, drafting and analysis. You should already work this way, and be able to govern it from the inside.
Who we are looking for Must have •    8–12 years of experience, with a substantial part spent building or running a data protection, privacy or data governance programme inside an organisation or for clients. You have implemented, not only advised. •    Working command of India's DPDP Act and Rules and of GDPR, and the ability to read a new regime or a client's data requirements and turn them into practice. •    Experience writing policies, procedures and templates that people actually used, and training people to use them. •    Enough information security literacy to run an ISO 27001 or SOC 2 readiness effort and to manage a security consultant well. You do not need to be the engineer. •    Practical understanding of how generative AI tools handle data (training, retention, hosting, account types) and of what responsible use looks like in an organisation. •    Excellent written English. Policies, guidance and client responses that a non-specialist can follow and a specialist cannot fault. •    Judgement and steadiness: comfortable taking a firm position with senior colleagues and clients, and finding the workable answer rather than the safest-sounding one. •    Fluent daily use of AI tools in your own work.
Strongly preferred •    A recognised privacy or AI governance credential: CIPP/E, CIPM, DSCI DCPP or DCPLA, AIGP. •    Experience with research or development-sector data: informed consent, field data collection, enumerator partners, ethics review, vulnerable participants. •    Exposure to a software or SaaS business, including vendor security questionnaires, data processing agreements and certification audits. •    Experience working across several countries and legal regimes, including Kenya or other East African markets. •    Experience with donor and client data requirements from multilateral institutions, foundations and government clients. What success looks like
Horizon What is visibly true First 90 days You have absorbed the independent diagnostic, met every practice and office, and the Steering Group has agreed a prioritised plan with owners and dates. The data classification standard and the AI tool register are in use. The DPDP obligations that take effect in November 2026 are covered. By 12 months The policy suite and toolkit are approved, published and in use on every new project. Leaders, project managers and field coordinators have been trained on Athena's own cases. Clients receive a standard answer to data and AI questions within days, not weeks. TolaData has a dated path to ISO 27001 or SOC 2 and the first controls are in place. The remaining DPDP obligations are covered ahead of May 2027. By 24 months A sample audit of live projects finds practice matching policy. At least one client or investor diligence has passed on our data and AI practices without remediation. AI is used more widely across the group than today, with fewer incidents and clearer rules. The system runs on its cycle without the Co-Founders in the loop.

What this role is not •    Not an IT or security engineering role. You will set requirements and check they are met; IT and TolaData engineering will implement them. •    Not a legal counsel role. You will work with external counsel on contracts and regulatory questions; you will not be the firm's lawyer. •    Not a policy-writing exercise that ends at publication. The job is the practice, not the documents. •    Not a gatekeeper. The brief is to let the group use data and AI more, more safely, not less.
Where this leads This is designed as a two- to three-year build. People who succeed in it grow into a group-wide risk and compliance leadership role, a senior operating role at TolaData as it scales, or a client-facing practice advising governments and development organisations on data governance and responsible AI, an area where Athena already works and intends to do more. You will leave knowing how a multi-country research, software and AI business handles sensitive data, from the village to the investor data room.
Athena’s Work Culture At Athena, we function in an outcomes-based work environment with flexible hours and a high level of autonomy. Professional development and thought leadership are key elements of our business model: we support our team members' professional growth through on-the-job training, and we encourage the cultivation of our colleagues’ personal brands through participation in panels, events, publications, and other thought-leadership opportunities. We embrace a transparent, open work environment with meaningful leadership pathways for those with inventive ideas and initiatives.
Athena Infonomics is an Equal Opportunities Employer Athena Infonomics is an equal opportunity employer with a commitment to diversity. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, pregnancy, sexual orientation, gender identity, national origin, age, protected veteran status, or disability status.

AI Proficiency and Responsible Use Proficiency in the responsible and sophisticated use of AI is a mandatory requirement for all roles, across all levels and functions at Athena Infonomics