Data Protection, Privacy & AI Governance

The firm advises organisations on data protection, privacy governance and the responsible use of artificial intelligence. Our work covers India’s Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025, the EU and UK GDPR, other international privacy regimes such as the CCPA, and the sector-specific requirements that apply alongside them, including those affecting financial services and healthcare. We act for clients in technology and SaaS, financial services, healthcare, professional services and digital platforms, on matters ranging from DPDP and GDPR readiness and privacy programme design to fractional DPO support, data processing and vendor agreements, cross-border transfers, breach preparedness and response, and the governance of AI systems that use personal data. Because these laws overlap in some places and diverge in others, we treat each on its own terms, and help clients whose operations, customers and counterparties extend beyond India build one coherent programme with the jurisdiction- and sector-specific measures each requirement demands.

Our services

DPDP and GDPR advisory

• Applicability assessments: which Indian and European requirements reach your business.
• Readiness reviews and gap analyses, with prioritised roadmaps to the dates that apply to you.
• Privacy notices, consent mechanisms, policies and internal procedures.
• Data protection by design for products, services and business initiatives.

Privacy programme design and management

• Governance frameworks, roles and responsibilities.
• Records of processing, data inventories, retention and deletion frameworks.
• Privacy risk assessments and data protection impact assessments.
• Training and awareness for management and functional teams, built around the decisions they actually make.

Fractional DPO and privacy leadership

For organisations that need experienced privacy leadership without a full-time hire, we provide ongoing advisory support, programme oversight, reporting on agreed activities, assistance with data subject requests, and coordination with legal, security, HR, technology and procurement teams. Where a formal statutory DPO appointment is contemplated, we first assess the legal requirements, independence, reporting lines and conflicts of interest before agreeing a structure.

Contracts, vendors and international data flows

• Data processing agreements, data-sharing arrangements and privacy terms in customer and technology contracts.
• Vendor due diligence and allocation of privacy responsibilities.
• International transfer mechanisms and related safeguards.
• Privacy due diligence in investments, outsourcing and strategic transactions.

Breach preparedness and response

We help organisations prepare for incidents before they happen, with response procedures, escalation protocols and tabletop exercises, and support them when they do: assessing the facts, advising on notification obligations, handling communications and running post-incident reviews. Technical containment and forensic investigation are handled with specialist partners.

AI and emerging technology governance

• Legal and privacy review of proposed AI use cases and third-party AI tools.
• AI usage policies, governance procedures and employee guidance.
• Advice on personal data in training, testing and deployment, including transparency, accountability and data minimisation.
• Risk assessments and human-oversight arrangements.

How we work

Each engagement is scoped, priced and documented with the client from the outset. Most follow five stages.

1. Understand. Your business, jurisdictions, data flows, technology and immediate concerns.
2. Assess. The requirements that apply and where your current practices fall short.
3. Design. A tailored response: roadmap, documentation, governance and procedures.
4. Implement. Working with your legal, compliance, HR, procurement and technology teams, with clear owners and priorities.
5. Maintain. Ongoing reviews, training and updates as your business and the law change.

Engagements range from a focused assessment or contract review to a full privacy programme or a continuing advisory relationship.

Who we work with

• Indian businesses preparing for the DPDP Act, including technology and digital companies, and growing mid-market organisations that want structured support before building an in-house function.
• Indian service providers with international clients, facing customer privacy expectations, contractual commitments and cross-border requirements.
• European and other overseas businesses engaging with India, through Indian operations, vendors, customers or partners.
• Multinational groups that need local Indian legal support coordinated with a global privacy programme.
• Organisations adopting AI that want to assess the privacy and legal implications before deployment.

Working with us

Cornerstone’s approach centres on connecting legal requirements with the operational decisions that determine whether a privacy programme works: engaging the people responsible for implementation, setting priorities and building processes that last.

We believe effective data protection is built through informed decisions, clear accountability and practical implementation, not documentation alone. Whether you need to assess your regulatory position, build a privacy programme, secure ongoing DPO support, review a cross-border arrangement or put governance around AI, we will help you identify the right questions and define a proportionate response.