26 and trying to break into data privacy two years after graduation, what’s a realistic path?
I’m 26, a law graduate based in India, and I feel like I’ve fallen badly behind my peers in the profession. I graduated two years ago from DU faculty of law and could not land anything substantial in law at the time. Out of desperation and financial pressure, I ended up taking a low‑pay, night‑shift US pre‑employment compliance job (background checks, health screening type work) after a year of sitting jobless. I stuck with that for a while, but it was going nowhere in terms of a legal career, and I finally quit without a solid backup in April. Now I’m unemployed, trying to get back into the legal side through data privacy, and honestly starting to panic about time, age and direction.
I don’t have a NLU pedigree, a litigation base, family contacts or a neat academic CV. I also can’t really afford to start pure litigation from scratch or do unpaid stints for months. Family finances are tight and there is a lot of pressure to start earning steadily. At the same time, I really don’t want to spend the rest of my 20s bouncing between random BPO/sales roles with no actual legal progression.
Over the last month or so, I’ve tried to pivot towards data privacy. I spent money I couldn’t comfortably spare on a privacy/data protection diploma. I’ve been reading up on GDPR, the DPDP Act and trying to understand the field seriously, collecting a few certificates along the way. I’m also actively applying to privacy and tech‑law roles and messaging people on LinkedIn who work in these areas, but most responses stay at the “keep applying / build skills” level and nothing has translated into a concrete opportunity. It feels like I’m stuck in this limbo where I’m too inexperienced for proper privacy roles, but also too old to be treated like a fresh law grad starting over.
I’ve been especially looking at things like Tsaaro’s career change/ apprenticeship‑type positions and similar entry‑level privacy roles, because on paper they look like a possible way in for someone without a solid background. I applied to Tsaaro a few weeks ago and haven’t heard back at all. It’s honestly messing with my head because I keep seeing very average‑looking profiles on LinkedIn working in these kinds of roles, and it makes me feel like I’ve already missed even the average bus.
For those of you here who are working as data privacy / TMT / cyber / tech‑law lawyers (in Big 4, firms, boutiques, in‑house, wherever): from where I’m standing right now, 26, two years post‑LL.B., one stint in US compliance, some internships, family and money constraints, no T1 or hardcore litigation background, what does a realistic path into privacy / tech‑law actually look like in India? Is it worth continuing to chase Tsaaro‑type apprenticeships, Big 4 privacy teams, and specialist boutiques, and if so, what actually makes a difference for shortlisting at this stage?
If anyone here has managed to get into data privacy / cybersecurity / AI governance from a a couple of years after graduating, I’d really appreciate hearing what actually worked for you and what you would and wouldn’t bother with in my position. I’m not expecting magic or a foreign LL.M. overnight. I just don’t want to wake up at 30 and realise I’ve spent the whole decade stuck on the sidelines of the profession.