About Comply Ark

Comply Ark is a regulatory infrastructure company building software for data protection compliance under the DPDPA and global privacy regimes.

We build two products. DataLens is a full-stack, data-blind compliance platform for the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025. It discovers and classifies personal data across an organisation's systems, generates the records of processing, runs consent and data principal requests, and supports breach response, all without personal data ever leaving the customer's environment.

Comply Ark was founded by Navaneeth SS, a technology and data protection lawyer who previously practised at a leading Indian technology law firm, and Midhun MP, a full-stack engineer who owns the technical architecture of DataLens. A technology and data protection lawyer and a full-stack engineer: the exact pairing this category has been missing. The company is DPIIT-recognised, a recipient of the Kerala Startup Mission Idea Grant, and part of the current ISB iVi (I-Venture Immersive) cohort.

The role

This is one role that spans law, technology and business, because privacy compliance is now all three at once. The DPDPA is in force, and its obligations become enforceable in May 2027. Most organisations need 6 to 12 months to become compliant, and penalties reach up to ₹250 crore per breach.

That makes the buying window now. Organisations need someone who can read the Act closely, understand how their systems actually hold personal data, and explain both to a General Counsel and a CISO in the same meeting.

As a Data Privacy Intern, you will do that work inside a company building the infrastructure for it. You will research the law, test and shape the products against it, and take both to the market. This is not a legal internship with some technology on the side, or a sales internship with some reading attached.

Every intern works across all three areas below. The weighting shifts with your background and strengths, and a typical split is about 40 percent privacy and regulatory work, 30 percent product, and 30 percent business development.

What you will do

You will produce work that ships: research the product team builds on, test findings that change the product, and account work that moves real conversations forward.

Privacy and regulatory

- Read the DPDPA and the DPDP Rules, 2025 at sub-section level, and translate obligations into operational requirements for specific sectors such as banking and fintech, insurance, healthcare, edtech and e-commerce.
- Track regulatory developments in India, including notifications, Data Protection Board activity and sectoral regulator guidance, and in the global regimes CookieGate covers, including GDPR, CCPA/CPRA, LGPD and PDPL.
- Draft and cite-check knowledge content such as client briefings, updates to the Comply Ark DPDPA whitepaper, product FAQs and the DataLens content series, with every claim traced to the official text.

Product and technology
- Map legal obligations to DataLens and CookieGate features, and write them up as clear requirements with acceptance criteria the engineering team can build and test against.
- Test the products the way a compliance officer would use them: run data principal request flows, review generated records of processing, check consent records, and log every issue with reproducible steps.
- Review cookie and tracker classifications across jurisdictions, flag misclassifications,



and help build the reference datasets that improve classification accuracy.
- Build sector-specific demo scenarios and sample data so that each demo speaks to the prospect's own regulatory exposure.

Business development
- Research and qualify target accounts in regulated, data-heavy sectors, map their buying committees, from the General Counsel and Chief Compliance Officer to the CTO, CISO and DPO, and keep the sales tracker current.
- Build and update sector playbooks covering regulatory exposure, typical data flows, buying triggers and likely objections.
- Support outbound and demos with account research notes, tailored follow-ups, meeting notes and post-meeting debriefs.
- Support partnerships with law firms and compliance consultancies, from partner research to the material they need to work with us.

You will not give legal advice to customers or prospects. Comply Ark builds software, it is not a consulting firm, and any client-facing statement on the law is reviewed by the founders before it leaves the company. Who we are looking for

We welcome applicants from law, technology and business, and we hire for judgement, precision and ownership rather than for a particular degree.

You should be a student in the later years of your degree, or a graduate within one year of completing it. Your background decides where you start, and the role expects you to grow into the other two areas.

Background

Typical degrees

What we expect you to bring

Law

B.A. LL.B., LL.B., LL.M.

Close reading of statute at sub-section level, structured legal writing, and a working grasp of how privacy regimes compare

Technology

B.Tech, B.E., BCA, MCA, B.Sc. in computing A clear model of how systems store and move personal data, from databases and APIs to cookies and third-party scripts, plus basic SQL or Python

Business

BBA, B.Com, MBA, PGDM

Account research, clear commercial writing, comfort with a CRM or tracker, and the confidence to speak with senior buyers

What every applicant needs

- Precise written English. Most of your work will be read by lawyers, engineers or buyers, and each of them will notice loose wording.
- A real interest in data protection, shown through coursework, writing, projects, moots, internships or self-study.
- Comfort with technology. You do not need to code, but you must be willing to understand how a product works and to test it carefully.
- Positive use of AI tools, paired with the discipline to verify every output against the source.
- The habits remote work demands: you communicate without being chased, meet the deadlines you set, and say early when something is off track.

What will set you apart
- A privacy certification such as CIPP/E, CIPP/A, CIPM or CIPT, or one in progress.
- Published writing, a moot, research or a project on data protection or technology law.
- Prior internship experience at a law firm, a compliance team, a privacy or security company, or an early-stage startup.
- Hands-on familiarity with browser developer tools, cloud consoles or consent management platforms.
- Prior work on outreach, partnerships or sales, in any setting.

How we work The internship is fully remote,



and it runs on written work, clear weekly commitments and regular feedback.
- You agree your weekly working hours with us at the start, with regular overlap during Indian working hours for reviews and collaboration. If you are studying, we plan around your examinations in advance rather than at the last minute.
- Every intern has a weekly review with a founder and sends a short written update at the end of each week covering what was done, what is next and what is blocked.
- Work happens in writing, in shared documents and trackers, so that anyone can pick it up without a meeting.
- You need your own laptop and a reliable internet connection. We provide Comply Ark accounts and the tools the work requires.
- Before you start, you sign a confidentiality and intellectual property agreement.

What you will get You will learn data protection the way it is actually practised now, at the point where the law, the system and the buyer meet.
- Direct work with both founders, a technology and data protection lawyer and a full-stack engineer, with weekly feedback on your work.
- Real ownership. Your research, test findings and account work feed into the products and conversations that Comply Ark is running.
- Exposure to how enterprise buyers in regulated sectors evaluate privacy software, from the first conversation to the demo.
- Credit for your work. Where something you wrote is published, you will be named.
- A monthly stipend, a certificate of completion, and a letter of recommendation for interns whose work earns one.
- The possibility of a pre-placement offer, based on your performance during the internship.

How to apply Apply through this LinkedIn job post with an up-to-date CV. We accept applications only through LinkedIn, so that every candidate goes through the same process.

We review applications on a rolling basis, and the process runs in five steps:

1. Application review. We read every CV against what this posting asks for.
2. Candidate questionnaire. Shortlisted candidates receive a short questionnaire that takes about 20 minutes. It includes a note of no more than 200 words on why this role, and on one data protection question you find genuinely interesting. The note carries as much weight as your CV.
3. Work sample. You choose one short task: map a DPDPA obligation to a product requirement, profile a company's regulatory exposure, or review a live website's cookie consent against the law.
4. Interview with the founders. A 30 to 45 minute conversation about your work sample and how you think.
5. Offer. We confirm the duration, weekly hours, start date and stipend in writing.

Using AI in your work is welcome, but we assess your own judgement, so please write your answers yourself. A specific answer from your own work will serve you better than a polished general one. How we handle your personal data

We use your application data only to assess you for this role, and we hold it to the same standard we build our products for.

We erase your application 6 months after the process closes. If you would like us to keep it on file for future roles, we will ask for your consent separately, and you can withdraw that consent at any time.

You can ask us at any time for a summary of the data we hold about you, or to correct, update or erase it, by writing to [email protected]. The same address handles any grievance about how we have dealt with your data. Our full privacy policy is at complyark.com/privacy-policy.

📌 Data Privacy Intern (Bengaluru)
🏢 comply ark
📍 Bengaluru