SKILL ROADMAP 43 · SPECIALISED LEGAL FIELDS
Data Protection and Privacy
Privacy foundations → DPDP Act → Data mapping → Notices and consent → Rights and grievances → Breach response → Global laws → Privacy compliance programme → Specialisation
Track your progress
- This roadmap has 9 steps, 5 checkpoints and 4 projects.
- Open the interactive version to tick checkpoints and projects. Your progress is saved in your browser.
1 What this path is
Data protection lawyers advise organisations on how to collect, use, share and protect personal data lawfully, and help individuals protect their privacy.
2 Who this path may suit
The work involves compliance, documentation, technology understanding and advising product and business teams.
3 The roadmap, step by step
- Learn privacy foundations.
Learn: the right to privacy under Article 21 as recognised by the Supreme Court in 2017.
Practise: by summarising what the judgment says about informational privacy. - Learn the DPDP Act.
Learn: the Digital Personal Data Protection Act 2023 and the Rules made under it, including the duties of data fiduciaries, children's data, significant data fiduciaries and the Data Protection Board of India. Provisions are coming into force in phases, so check which apply on the date you advise.
Practise: by preparing a chart of duties and penalties. - Map data.
Learn: to trace what personal data an organisation collects, why, where it is stored and who receives it.
Practise: by carrying out a data mapping exercise for an imaginary app. - Learn notices and consent.
Learn: what a valid notice and consent must contain.
Practise: by auditing the privacy policy of a popular Indian app against the DPDP Act. - Learn rights and grievances.
Learn: the rights of data principals and how organisations must respond.
Practise: by drafting a process for handling access and erasure requests. - Learn breach response.
Learn: breach reporting duties under the DPDP framework and the CERT-In directions.
Practise: by preparing a breach response plan. - Learn global laws.
Learn: the EU's General Data Protection Regulation and how it differs from Indian law.
Practise: by comparing one obligation under both laws. - Build a compliance programme.
Learn: policies, records, vendor contracts and training.
Practise: by drafting a data processing agreement and an internal privacy policy. - Specialise.
Learn: a sector such as health, fintech, education or ecommerce, where privacy has special risks.
Practise: with a sector specific privacy review.
4 Your levels and checkpoints
Beginner level
- Explain the main duties under the DPDP Act
Intermediate level
- Complete a data mapping exercise
- Audit a privacy policy
Advanced level
- Build a compliance programme for a company
- Draft a breach response plan
Advanced professional level
You lead privacy programmes and advise on complex data questions.
These checklists are for honest self assessment. They are not an official certification.
5 Build these projects
- A data mapping exercise
- A privacy policy audit
- A breach response plan
- A data processing agreement
6 Internship direction
Look for privacy teams at firms, company legal and compliance teams and technology policy organisations. Before applying, know the DPDP Act well. Prepare a privacy policy audit as your sample. Privacy certifications offered by bodies such as the IAPP are valued by many employers.
7 Portfolio evidence
Audits, data maps, plans and agreements.
8 Common mistakes
- Advising on provisions not yet in force without saying so
- Copying foreign privacy policies without adapting them
9 Go deeper
Cyber and AI Law Guidebook · AI Legal Hub