Build a Privacy Portfolio with Zero Job Experience

You do not need a DPO title to prove privacy skill. You need artefacts. Here is a four-week portfolio plan that hiring managers can skim in ten minutes.

Artefact 1 — Mini ROPA (Week 1)

Eight processing activities for a fictional campus EdTech. Include children's data flags and one processor.

Artefact 2 — Notice & consent critique (Week 1–2)

Annotate screenshots of a real app. Score Section 6 principles. Propose a redesign. Cite practitioner ideas from Complynz's consent language / QR posts if helpful (languages, QR consent).

Artefact 3 — DPIA lite (Week 2)

Two pages: description, risks, mitigations, residual risk, go/no-go recommendation for a high-risk feature (e.g. facial attendance).

Artefact 4 — Breach tabletop (Week 3)

Timeline table from detection to Board decision points. Reference penalty awareness via Complynz penalty schedule guide as study material—not fear marketing.

Artefact 5 — Vendor scorecard (Week 3)

Five fictional processors scored on DPA status, sub-processors, transfer, and security attestations.

Artefact 6 — Public teaching post (Week 4)

Publish one LinkedIn or blog explainer ("ROPA in plain English"). Teaching is evidence of clarity.

Packaging tips

• One PDF or Notion home with anchors
• Filename discipline: ROPA_EdTech_v1.pdf
• 90-second video walkthrough of your ROPA

Optional tooling screenshots

If you explore free tiers or demos—Complynz offers free-tier / scanner entry points via complynz.com and the DPDP scanner—capture anonymised UI only if terms allow. Even without access, diagram how a best-in-class Indian DPDP platform would store consent proofs beside ROPA IDs.

What not to include

• Copied policies from the internet without critique
• Certificate screenshots without artefacts
• Confidential data from internships

Bottom line

A strong privacy portfolio beats a long certificate list. Ship six artefacts; then apply.

---

Alisha Sharma · Privacy Journalist · Students