Sarib Khan

Privacy and regulatory governance professional with 6+ years of experience leading global privacy operations, data protection compliance, and technology risk advisory for a multinational organization. Proven expertise across GDPR, CCPA/CPRA, KSA PDPL, UAE PDPL, India DPDP, and emerging global regulatory frameworks, with hands-on leadership in Privacy by Design, DPIAs, vendor risk governance, and cross-border data transfers. Trusted advisor to product, security, and business teams on AI governance, regulatory readiness, and contractual risk, translating complex legal requirements into practical, business-aligned controls.

Experienced in operating at the intersection of privacy, GRC, and technology, with strong stakeholder management and commercial acumen in regulated, fast-moving environments.

Global Data Privacy Counsel II at Progress Software (2024-11 – Present)

Lead global privacy operations using OneTrust, supporting compliance with GDPR, CCPA/CPRA, and other global privacy regulations.

• Provide end-to-end privacy advisory across products and business operations using a risk-based, business-aligned approach.
• Led the implementation and operationalization of India's Digital Personal Data Protection Act (DPDP) requirements across the organization.
• Drive Privacy by Design (PbD) reviews to embed privacy, data minimization, and security controls into products and systems.
• Conduct and oversee PIAs and DPIAs, advising on mitigation, documentation, and accountability requirements.
• Lead vendor and third-party privacy risk assessments, including data protection due diligence for onboarding and renewals.
• Act as a second-level reviewer for commercial agreements, finalizing privacy and data protection positions.
• Draft, review, and negotiate IT and commercial contracts, including MSAs, DPAs, software licensing agreements, SLAs, and NDAs.
• Advise on cross-border data transfers, data protection obligations, and risk allocation in commercial arrangements.
• Support compliance with EU DORA concepts, SEC cybersecurity guidance, and FTC privacy and security enforcement principles.
• Advise on AI governance and responsible use, including privacy, transparency, and data usage considerations for AI-enabled products.
• Provide advisory support on Middle East data protection regimes, including UAE PDPL and Saudi PDPL, in global compliance contexts.
• Partner with cross-functional teams (Sales, Product, IT, Procurement, Marketing) to align privacy and regulatory risk with business objectives.

Privacy Analyst at iCIMS (2023-08 – 2024-11)

Key responsibility areas

• Led the privacy operations for iCIMS India, liaising with key internal (Legal, Risk, Infosec, etc.) and external (Regulators, advisors, vendors, partners, etc.) stakeholders as required.
• Conducted vendor reviews and Third-Party Risk Management (TPRM), contributing to a comprehensive privacy risk assessment framework at iCIMS.
• Ensured iCIMS compliance with global privacy regulations, such as GDPR, CCPA, DPDPA, HIPAA, PDPA, and CPRA.
• Implemented and designed DPDPA framework for iCIMS from the scratch.
• Led incident response efforts, minimizing risks and maintaining data integrity, while also overseeing and implementing the data privacy strategy for all entities within the group.
• Collaborated on privacy audits, addressing findings and tracking corrective actions, and communicated the operating data protection framework across the group at iCIMS.
• Maintained detailed records and generated reports on privacy assessments and compliance activities, including reviewing and signing off DPIA and other PIA at both project and organizational levels.
• Developed and delivered privacy training sessions to labs, internal stakeholders, fostering a culture of privacy by design, and worked closely with the business to ensure records of processing were kept up to date.
• Provided timely legal guidance on data privacy matters at iCIMS, implementing process improvements that reduced PIA & vendor reviews completion time by 20%.
• Collaborated with cross-functional teams at iCIMS India to ensure alignment of data processing activities with legal requirements, and reviewed and signed off Data Protection Impact Assessments and privacy risk assessments.
• Championed the integration of privacy by design principles in new and existing business processes, ensuring robust data protection from the outset of project development.
• Utilized OneTrust and TrustArc for streamlined privacy operations.

Legal Associate - Disputes & Investigations at Elevate (2021-12 – 2023-07)

Key responsibility areas

• Worked on data protection projects for US & EMEA, complying with GDPR, UK Data Protection Act, CCPA, HIPPA, PDPA, and Australian Privacy Law.
• Collaborated with Data & Privacy Project team to improve systems and processes.
• Managed data protection projects tailored specifically for the healthcare sector, focusing on compliance with HIPAA and other critical healthcare-related privacy regulations.
• Ensured secure communication of information per InfoSec and Privacy guidelines.
• Provided expert guidance and leadership during critical data breach incidents, ensuring swift and compliant responses that minimized impact and upheld the company's reputation.
• Handling Data Breach Incidents, which includes identifying and extracting Personally Identifiable Information (PII) and Protected Health Information (PHI) from large volumes of compromised data, as well as preparing Notification Lists as part of due diligence and regulatory compliances.
• Assisted in conducting Data Privacy Impact Assessments and handling Data Subject Access Requests.
• Reviewed and analyzed legal documents for relevance, responsiveness, privilege, and confidentiality, conducted E-Discovery using Relativity and Canopy, and created privilege and redaction logs.
• Conducted training sessions, performed quality checks, and provided feedback to peers

Associate : Legal and Business Development at Diestro Infotech Pvt. Ltd. (2018-08 – 2021-11)

Key responsibility areas

• Reviewed and analyzed contracts to ensure compliance with legal requirements and company policies, using document management software and other tools.
• Prepared Non-Disclosure Agreements (NDA's) for clients, ensuring confidentiality and protection of their sensitive information.
• Developed and enhanced customer relationship management strategies, focusing on compliance and data protection during digital marketing initiatives.
• Provided clear and concise information to clients regarding the secure handling of their personally identifiable and protected health information, in accordance with relevant regulations and compliance standards.
• Worked on digital marketing sales campaigns with US-based digital marketing agency Major Tom, developing and managing client portfolios, analyzing customer data to improve customer experience, and holding product demonstrations for customers.
• Upsold and cross-sold on existing accounts, piping opportunities to forecast deals and improving onboarding processes.
• Evaluated and improved tutorials and other communication infrastructure, mediating between clients and the organization, drafting business proposals and negotiating terms.
• Handled and resolved customer requests and complaints in a timely and professional manner.

LLM in Corporate & Financial Laws – O.P. Jindal Global University (2021-08 – 2022-07)

B.B.A. LL.B. – Guru Gobind Singh Indraprastha University (2016-08 – 2021-05)