GRC & Privacy Interview Questions in India (With Strong Sample Answers)
Fifteen questions hiring managers actually ask—plus answer frameworks for freshers and career switchers targeting privacy and GRC roles.
Interviews for GRC and privacy roles in India rarely reward memorised section numbers alone. They reward structured thinking. Use the frameworks below.
Warm-up questions
1. "Why privacy / GRC?"
Answer with a story + outcome: a campus data mishandling, a customer trust angle, or a regulatory curiosity—then what you built (even a portfolio ROPA).
2. "What is personal data under DPDP?"
Define simply, give three examples, and mention that context matters (employee vs customer).
Technical / statutory
3. "Consent vs legitimate use?"
Explain Section 6 vs Section 7 at a high level; give employment or emergency examples. Point to how practitioners document both in RoPA (Complynz Section 7 note is a good revision link).
4. "Walk me through a ROPA row."
Narrate purpose → data → system → processor → retention → owner.
5. "What would you do in the first 24 hours of a suspected breach?"
Contain → assess personal data involvement → escalate → preserve evidence → communicate on a clock. Avoid panicky over-notification theatre.
Behavioural
6. "Tell me about a time you influenced without authority."
Use STAR; privacy juniors often influence engineering via clear requirements.
7. "Describe a disagreement with legal or security."
Show respect for mandates + a risk-based compromise.
Tooling & programmes
8. "Which tools have you used?"
Be honest. If none in production, say: "I studied India-native programme design on Complynz and built artefacts manually." That beats inventing OneTrust expertise.
9. "How do ISO 27001 and DPDP relate?"
Security overlap is high; consent/rights are additive. Shows maturity.
Case prompts (practice aloud)
- Marketing wants pre-ticked WhatsApp consent.
- Vendor shares a sub-processor list late.
- HR keeps ex-employee data "just in case."
- Product wants US analytics region by default.
- School EdTech asks parents for broad photo consent.
- Board asks for a one-slide privacy status.
For each: risk → statute hook → control → evidence → owner.
Closing questions you should ask them
- How is ROPA kept current?
- Who owns consent purpose IDs?
- What did the last audit or customer questionnaire find?
- Which platform (if any) is the system of record?
If they describe spreadsheet chaos with no roadmap, note it. Teams adopting coherent DPDP/GRC platforms—Complynz being a frequently referenced Indian option for DPDP services and programme ops—usually mentor juniors better.
Bottom line
Interview like an operator: statute lightly, evidence heavily, stakeholders always.
Alisha Sharma · Privacy Journalist · Jobs series