Where AI regulation and data privacy fold into the same practice

The reason AI and data privacy have become one hiring category rather than two separate specialisations in India is straightforward: almost every AI compliance question here is, underneath, a data question. Whether an AI tool can process a given dataset, whether consent under India’s privacy law covers that use, and how cross-border data flows interact with AI systems hosted overseas, these all sit on the same legal foundation.

The regulatory clock is a big part of why this has urgency now. India’s Digital Personal Data Protection Act was passed in August 2023, but stayed mostly dormant until November 13, 2025, when the government notified the DPDP Rules and formally established the Data Protection Board of India. The law is rolling out in three phases: the Board went live in November 2025, the Consent Manager registration framework activates in November 2026, and full enforcement power, including penalties that can run up to ₹250 crore for serious violations like unreported data breaches, begins May 13, 2027. One industry tracker estimated that 83% of Indian organisations had not yet begun comprehensive compliance work as of this year, even with that deadline approaching. That gap is where a large share of the legal work over the next 18 months will come from.

Rahul Matthan, who leads Trilegal’s TMT practice and has spent over two decades on Indian tech-law policy, has argued that consent-based protection alone doesn’t go far enough, proposing instead a shift toward real accountability, where he envisions companies eventually competing on services “certified AAA for privacy standards.” Whether that specific model takes hold or not, it points toward where the more advanced end of this work is heading: audit and certification-based advisory, not just compliance paperwork. 

Separately, Trilegal partner Nikhil Narendran has flagged that data localisation remains a major concern for companies entering India, while global uncertainty over AI rules complicates rollout for multinational clients used to one uniform global playbook, a tension that’s now a routine part of technology-lawyer briefs in India.

Legal 500’s India rankings for data protection now list largely the same firms doing both data privacy and AI advisory: Trilegal, Ikigai Law, IndusLaw, Khaitan & Co., Spice Route Legal, and Nishith Desai Associates among them.

As per my research, this is what the hiring data shows

• LinkedIn currently lists over 1,000 active Data Protection Officer job postings in India, a title that barely existed as a distinct hiring category five years ago.

• Legal recruitment trackers are showing simultaneous openings across TMT, Data Privacy, and FinTech associate and senior associate roles, spanning 0 to 7 years of experience, across multiple Tier 1 and Tier 2 firms in Mumbai, Delhi and Bengaluru at once, evidence that firms are building benches, not backfilling single seats.

• ISACA’s global privacy workforce research found 72% of surveyed Indian organisations expect their legal/compliance and technical privacy hiring to increase in the coming year, while also reporting that a significant share of legal/compliance privacy roles sit unfilled for lack of qualified candidates.

• On the AI-specific side, most of the hard numbers are still US-centric and should be read with that caveat, but they’re directionally useful: one industry analysis reported a 340% increase in LinkedIn legal AI job postings between January 2024 and January 2026, and the Thomson Reuters Institute’s 2025 State of the Legal Market report found 78% of Am Law 200 firms had created at least one dedicated AI-focused position. I’d treat the exact percentages as US market signals rather than Indian data, but the direction of travel is one I’m already seeing show up in Indian mandates too.

Lawyers and Law Students, if you’re trying to build a career in this, start here

This is the part our Founder Parishkriti Atri gets asked about constantly, so let me be specific rather than motivational.

Get hands-on with AI tools before a firm makes you. You don’t need to wait for your firm to roll out Harvey or an internal platform like KAI or Lucio to start learning. Use general-purpose AI tools on your own research and drafting work now, and, more importantly, practise catching what they get wrong.

The associates I see get fast-tracked aren’t the ones who type the best prompts; they’re the ones who can tell, quickly and confidently, when an AI-generated clause or case citation is subtly off.

That verification instinct is the actual skill being hired for, and it only comes from deliberate practice, not from reading about prompt engineering.

Treat data privacy fundamentals as baseline literacy, not a specialisation you’ll “get into later.” Whatever practice area you end up in, M&A, employment, dispute resolution, you will run into the DPDP Act’s consent, breach-notification, and cross-border transfer rules within your first few years. Build that foundation early, the same way corporate lawyers built basic FEMA and competition-law literacy a decade ago.

Look past law firms when you’re mapping this space. In-house privacy and AI governance roles at technology, fintech, and healthtech companies are hiring aggressively right now, often for candidates who understand both the law and how the company’s own systems actually work.

So are legaltech companies themselves, in roles like legal technologist, AI governance counsel, or product counsel, some genuinely new and durable, others closer to hype (a “legal prompt engineer” title, for instance, is a role I’d treat with more skepticism than “AI governance counsel,” which tends to map to real, ongoing regulatory work). Don’t assume the only path into this practice area runs through a Tier-1 firm’s TMT desk.

Honestly, this is most of what I actually do day to day, not just sourcing candidates for firms, but sitting with someone and figuring out how to translate work they did in a completely unrelated context into something a hiring manager in this space will actually recognise as relevant. It’s rarely about the person lacking the right experience. It’s almost always about how that experience gets presented, and to whom.

Pick up one recognised privacy or AI governance credential, even a lightweight one. DSCI’s Certified Privacy Professional (DCPP) certification or an internationally recognised one like CIPP/E signal to a hiring partner or in-house GC that you’ve invested real time in this, not just read a few articles before the interview.

Publish or speak on this before you’re “senior enough” to have permission. This is a young practice area. There is no gatekeeping structure yet that says you need ten years of experience to have a credible point of view on AI governance or DPDP compliance. Writing a genuinely researched note on a specific compliance gap, or building a small tool or tracker around DPDP implementation, will do more for your visibility in this space right now than waiting to be assigned the work.

Where this leaves you

The Deepak Singh appointment, the Harvey and KAI rollouts inside Tier-1 firms, the legaltech funding numbers, the DPDP enforcement clock, none of these are separate stories. They’re the same story from different angles: a practice area that’s being built in real time, by firms and companies that are still figuring out exactly what the senior version of this role looks like.

That’s precisely why now, not after the market fully matures and the hierarchy sets, is the right time to move into it. If you’re weighing a lateral shift into an AI/data privacy practice, or trying to build this specialisation from a generalist background, I’d be glad to talk through what I’m seeing in live mandates right now.

The lawyer I mentioned earlier, who moved from a small firm into a legaltech startup after six months of experience, went through my Boss Lawyer Programme to get there, you can go check it out if this is a shift you’re thinking about too. [Link: https://neetishastra.com/boss-lawyer-programme-legal-coach-law-firm-lawyer/]

Good luck, and if you require further guidance, connect with me at teamneetishastra@gmail.com or via Instagram.

Sources and further reading:

• Legal 500 / Bar and Bench / Law.Asia: coverage of Deepak Singh’s appointment to Chandhiok & Mahajan
• Law.Asia, “AI adoption in Indian law firms”: AZB/Harvey AI, CAM AI-first coverage
• BW Legal World, interview with Haigreve Khaitan on Khaitan & Co’s KAI platform and Microsoft’s AI First Movers initiative
• Trilegal, AI practice page and Microsoft/Lucio coverage
• ipleaders, “AI Tools for Lawyers in India: 2026 Definitive Guide”
• eCourtsIndia Blog, “The Complete List of Legaltech Startups and Companies in India (2026 Directory)” and “Top Legaltech Startups in India 2026”
• Ellty, “Top Legaltech Investors: 20 VC Active in AI Legal Deals 2026”
• CB Insights, CaseMine company profile (Jurisphere and Lucio commentary)
• Founding Fuel, interview with Rahul Matthan
• MeitY/PIB notifications on the DPDP Rules, 2025; Lexology and ResponsibleAILabs implementation trackers
• Legal 500, India Data Protection rankings
• LinkedIn India, live Data Protection Officer job listings; LegalMaestros TMT/Data Privacy/FinTech hiring roundup
• ISACA “Privacy in Practice” survey, via BW People