Lesley Rajan

Conducted Privacy Impact Assessments (PIAs) for various FinTech clients engaged in Banking-as-a- Service (BaaS) operations. These assessments include when Peoples Bank acting as an issuer of cards, for money movement like Electronic Fund Transfer(EFT) or INTERAC transfers, for payment services and for API services. ● Managed data breach incidents, analyzed real risk of significant harm requirements (RRSH), and drafted breach notifications. Investigated the breach incident and prepared final report on breach incidents. Reviewed all the regulatory notification requirement under federal and provincial privacy legislations. ● Reviewed the privacy program of Peoples Bank which includes third-party vendor questionnaire, client intake forms, privacy intake form, privacy clause in contract template, privacy assessment template, and Cardholder agreement. ● Conducted comprehensive review of consent life cycle when Peoples Bank acting as issuer of prepaid card. This includes the consent language used in the UI/UX wireframe and requirements when an express consent to be obtained. ● Worked on the project for data anonymization project and record retention practices followed in various business units. Prepared privacy training material and given training to the Peoples Bank employees. Represented Peoples Bank in the Canada Bankers Association (CBA) Privacy Specialist Group.

Responsible for conducting privacy impact assessments for new initiatives/ revised programs, which ensure compliance with federal and provincial privacy laws. New initiatives or revised programs which include new products like credit cards, new banking-related offers, new marketing campaigns, new regulatory requirements or a change in procedure-related banking, or technology-related changes like the introduction of artificial intelligence (AI) models, AI Bots, automated decision making, Generative AI use cases etc. Upon the assessment, if the residual risk is rated Medium or High, propose valid mitigation that is acceptable for business. ● Conducted in-depth privacy assessment on projects with highly sensitive personal information like Biometric information, Criminal data, health data etc. These in-depth assessments helped to document the requirements for this information and ensure appropriate controls were in place for processing this sensitive information. Advised various lines of business on the concept of Privacy by Design (PbD) during the planning stage of new projects. This guidance helped businesses reduce privacy impacts by ensuring appropriate privacy disclosures, limiting the collection of personal information, and implementing valid privacy clauses.

Conducted Transfer Impact Assessments for various cross-border data transfer and issued remedial measures for high risk data transfers which helped AXA XL to comply Schrems II; Reviewed the contractual clauses in the Data Transfer Agreement/ Data Privacy Addendum including European Union Standard Contractual Clauses and liaised with vendors for negotiations; Managing Subjects Access Requests (SARs): search of the data subject/reference, acknowledgement of the request, investigation, analysis of the relationship, redacting files, validation of redaction. Managed Data Breaches: investigation, follow-up, updating data incidents reports; Conducted gap analysis for the various Privacy Polices in multiple geographies by evaluating GDPR, CCPA, HIPPA, PIPEDA and Bill 64; Conducted Privacy Impact Assessments (PIA) for various new program/application/project inducted in the AXA XL and provided remedial if the risk in found high/medium during these assessments; Worked on the internal auditing for the geographies which include UK, Singapore, US and Canada which helped AXA XL Global Data Privacy team to prove its compliance Privacy Principles and local regulations; ● Rendered the services Ad hoc Data Privacy Officer for AXA XL India entity.

Advising and supporting various business teams ( Sales, Marketing, Procurement, and HR) in the review, negotiation, and closure of a variety of contracts. Manage global procurement department for vendor contracts on the legal front, including MSA, SLA, SaaS agreements, consulting agreements, data privacy agreements, EULA, channel partner agreements, NDA, SOW, order forms, global RFP’s and more. Participating in negotiations with customers and vendors and ensuring conformance with internal contracting requirements and risk identification & mitigation. Advising teams on intellectual property and technology-related legal issues including compliance with data protection and privacy laws, online and email marketing rules. Drafting of the employment agreements, confidentiality clauses, non-disclosure agreements related to employees and partners. Support legal team to review client deal documents while understanding industry standards and company policies. Creating and maintaining template agreements and refining contract processes.

● Handled legal due diligence for various clients matters pertaining to labour and employment compliances and registrations, various HR Policies, shareholders agreements, various statutory compliances and reports as required under Companies Act 2013; ● Rendered legal opinion to multinational clients on the various aspects under the labour and employment laws, data protection laws, foreign direct investment. ● Drafted and reviewed various agreements related to service, marketing, cooperation, agency, etc.

● Handled labor and employment matters and advised multinational clients on legal and regulatory compliances under various labor statutes. ● Rendered legal opinion to multinational clients on individual dismissals, collective redundancies, immigration, employment aspects of mergers and acquisitions, restrictive covenants, working conditions, employees privacy, international posting/secondment, social security benefits, contract labor, trade union-related issues, retrenchment, and termination of employees. ● Handled various litigation involving suits for money, property disputes, employment disputes, arbitration, foreign decree execution, etc. for various companies. ● Shouldered the responsibility of managing court cases and legal disputes including researching, strategizing, drafting/vetting, plaints, written statements, rejoinders, applications, notices, replies, submissions, & more.

My thesis was Regulation of Credit Rating Agencies