I've been intrigued by data privacy and data protection and the cyber law domain and would like to explore the career options in it. It's a growing field, with compliance related work for the most part. Currently in law school and would like to grow further and learn more in this domain. What skills would you guys recommend for a student to learn the intricacies of this field. Specifically, any digital skills like programming languages would help?
Would also love to hear about your personal experience if you currently work in this or a related domain. Thank you.

Currently work in data is still relatively limited. But, India is in the process of overhauling its data privacy regime. And a new law - the Personal Data Protection Bill - is in discussion for a long time. Once that happens (likely, soon) there will be a lot of work in this space, much like after introduction of GDPR in the EU, data work has increased significantly. You can prepare for this, of course. Read up the discussions that have happened around various iterations to the PDP Bill to get good context to the law. Most important being the Srikrishna Committee Report. Then read up the Puttaswamy judgment that held privacy to be a fundamental right. There are several important foreign judgments such as Shrems. Read up the GDPR of course. You will good material on the law on gdpr.eu. Read how the GDPR compares with the Indian approach to data protection at https://www.ikigailaw.com/comparative-analysis-general-data-protection-regulation-2016-and-the-personal-data-protection-bill-2019/ . The Ikigai Law and Nishith Desai blogs generally have a lot of material on data privacy. Great stuff on iapp.org as well. Check out the top data protection law firms in India at https://www.legal500.com/c/india/data-protection/ and apply for internships.

Thanks for this really helpful context, especially now with the DPDP rules notified and visibly more DP work on the ground.

I’m currently working with a Data Privacy team, with prior PQE in gen corp/compliance, and actively looking to move to a Tier 1 firm.

Would really appreciate your help with any pointers on relevant teams/partners (city-wise) I could reach out to, and also a more practical sense of how things are actually playing out right now. Thank you.

You may not like this answer, but ground realities need to be out there and I wish someone had told me this before I committed to DP & tech as a career choice:

In India, DP law is one of the least viable options available. Employment opportunities are nearly non-existent and you're likely to end up making lesser than your peers in other verticals, even when you get the job.

Most DP work in India is done by specialist/boutique firms, and the rest by T1s.

Let me give you an idea of the scenario in T1s first —
Given that there is so little and seasonal DP work going their way, T1 DP teams are extremely small and the chances of getting PPOs there are negligible. I'm aware of 4-5 former interns for whom PAs & partners gave excellent feedback but they were never hired because there was no vacancy. In fact, a number of T1s - like CAM, Luthra & NDA - assign DP work to GC & compliance teams instead of hiring more DP lawyers.
I'm also yet to see campus placement in DP teams from NLS & NALSAR, having followed recruitments from 2019 onwards.
So, overall, T1 DP employment opportunities are fewer than almost every other vertical in the same firms, and it may not be the wisest use of your shot at a T1 job.

Now, coming to other firms which do DP work — Spice Route, Saikrishna, Ikigai, Kochhar, Reina etc could be among the leading names people in the industry would tell you about. Now, the issue with joining any of these firms is the huge cut in your paycheck. Most of these 'technology & DP' firms/teams pay about 4-6 LPA, and even if you compromise on your DP law dream and go to media/tech firms that also do DP work once in a blue moon, 7-9 LPA is a realistic cap.

As such, to answer your titular question — even as a person with a foot firmly onto the field, I don't find DP to be a "viable" option right now, at least not comparatively. However, an important consideration you should note is that things are likely to change once the DPA is formed and starts giving out regulations.

Another notable aspect is that right now, DP work mostly emanates either from policy work for government clients or firms engaging in international businesses. Chaos caused by dynamic regulations in E-Commerce & FinTech, fields and CERT-In guidelines also provide a good chunk of work, most of which is mindless compliance. So, whereas DP is glorified as some next-gen, exciting, and challenging area of law in law schools, the reality of practising it in India is far from it. Make sure you're well aware of what you're entering into.

All the best!

I really appreciate your perspective. I understand that it isn't exactly a roses and rainbows field, but much of my understanding is that the job market could certainly improve after DPA has been enacted. And since you are already work in this field for a while, could you shed some light on the major changes that could follow. GDPR implementation resulted in man firms seeking a specialized DP team. Do you see a similar trend happening?
And about the paycheck, is it really in 4-6 range? That seems quite low for anyone who's in a T1 firm, could you share some more numbers perhaps?

Really appreciate your comment, I really want to make an informed choice so differing perspective is also what I really want about this.

ya i dont think the tech firms pay that low, def. Spiceroute and Ikigai pay significantly higher. Also if you are worried that there are limited roles for DP, you need not only do data. Data cuts across all industries, particularly in tech and you could certainly find TMT roles that are data heavy. To my mind data work is increasing by the day and will only continue to. One can expect a whole host of regulation around data in India and elsewhere and there will continue to be heavy policy, commercial and compliance work that is complex and cross-border in nature. Roles are available not only at law firms but also in-house and with the Big 4. It will always be a niche so don't expect to have a fifth as many openings as in M&A, but then you are also competing with a fair few and have a clear technical niche expertise which is your moat.

Could you provide some details about the pay scale? I highly doubt it's as low as the person above mentioned them to be. Also, considering it to be an upcoming field, having a headstart and starting in this early on as a means of specialisation (alongside TMT) would be beneficial?

There is no DP career in India at law firms/in-house.

It's either a Tech career or an IP career or a Compliances career doing DP.

A focused and full fledged DP career is possible in Big 4 consultancy firms. That's possible because DP consultants get to consult on DP aspects on a global basis.

Not true. There are law firms (though few) that do solid dp work. And there are in-house roles especially at large tech companies that are data-focussed. And its not just compliance. In fact a Big 4 role is most likely compliance-heavy. At law firms, you could also be doing more strategic data advisory, providing opinions, structuring data flows, negotiating contract terms pertaining to sharing of data etc. There are few roles but they will only increase.

I second this point on the shift from pure compliance to more advisory/structuring work in DP at firms.

I’m currently working with a Data Privacy team, with prior PQE in general compliance, and actively looking to move to Tier 1 teams. At the moment, I assist A1s in making our clients DPDP-compliant, including drafting various website policies and related documentation.

Would really appreciate your help with any pointers on relevant teams/partners (city-wise) that are actually doing this kind of work, and who might be worth reaching out to. Thank you.