Ask anyone in the profession whether privacy is hiring right now, and the answer is an unequivocal “yes”. Ask them where, and the picture gets more interesting. Demand is not spread evenly across the map or across the economy. Some markets are running hot, some sectors are absorbing talent faster than others, and the shape of the privacy role itself is in a state of flux.
In the retained searches we run, the overwhelming majority of privacy roles we are asked to fill sit in the United States, the United Kingdom and continental Europe. That concentration is largely a response to regulatory change, and regulation is where any honest map of privacy hiring has to begin.
The regulatory map is the hiring map
In the United States, the story of the past few years is the steady march of state law.
Twenty states now have comprehensive consumer privacy laws in effect in 2026, with Indiana, Kentucky and Rhode Island joining on 1 January and further obligations landing through the year, including Texas AI governance rules and a new wave of enforcement activity. For employers, the significance is less any single statute than the cumulative weight of a patchwork that a national business has to satisfy all at once. Commentators are calling 2026 the year enforcement, rather than rule-making, takes centre stage, and enforcement is what turns a compliance nicety into a headcount decision.
Continental Europe has had its settled baseline since GDPR, and mature markets tend to hire for depth rather than volume. What has moved the demand curve is the EU AI Act. Its first obligations, covering prohibited practices and AI literacy, have applied since February 2025, with the heavier requirements for general-purpose and high-risk systems phasing in across 2026 and 2027, backed by penalties that reach 35 million euros or 7 per cent of global turnover. That combination, real deadlines and serious fines, is precisely the sort of thing that loosens a hiring budget.
The UK sits in a category of its own. It kept a GDPR-shaped regime after leaving the EU and has been reforming it on its own terms since, which leaves employers wanting people who can hold both frameworks in their head at once. London remains the centre of gravity, though we increasingly see roles seeded in regional hubs as functions grow beyond their first hire.
The AI governance surge
The most recent IAPP salary and jobs survey, its largest to date, found privacy job postings up around 30 per cent year on year and, more tellingly, that roughly 68 per cent of privacy professionals have taken on AI governance responsibilities. The people who can do both are being paid for the privilege: the report puts median compensation for combined privacy and AI governance roles well ahead of either discipline practised alone.
This is the single biggest change we see in briefs. Two years ago, a search was for a data protection specialist. Today the same seat often arrives with an AI governance remit stapled to it, and the shortlist of people who can genuinely cover both is short. It is, in practice, where the market is tightest and where offers are being pushed hardest.
Where the sectors sit
Data intensity broadly explains the sectors. Put simply, the organisations hiring hardest are the ones holding the most sensitive information about the most people. On pay, the IAPP data points to healthcare, finance and retail as the sectors rewarding senior privacy leaders most richly, with a meaningful share of chief privacy officers in those fields earning above 300,000 dollars.
Beyond that top tier, demand clusters where consumer data and AI meet: technology and software, adtech and digital media, and the growing category of businesses that have quietly become data businesses without quite noticing. Financial services and healthcare hire for regulatory weight; consumer technology hires for scale and speed. Both are fishing in the same small pond.
What it means if you are hiring
A few things follow for anyone building a team in this market. Expect competition, particularly for the hybrid privacy-and-AI profile, and expect the strongest of those people to be in post rather than on the market, which is one reason retained (passive-candidate) search has become the norm rather than the exception at senior levels. Be realistic, too, about the shape of the role: asking for deep privacy law, AI governance and security in a single hire is legitimate, but it narrows the field sharply and should be reflected in the offer. And treat salary benchmarks as directional. Compensation varies enormously by market, and the published surveys, useful as they are, lag a fast-moving picture. Local, current data is worth having before you set a band.
What it means if you are a privacy professional
The premium is on breadth, and specifically on the ability to sit between privacy, AI governance and the business. Geographic flexibility helps, but the deeper advantage is regulatory range. The professional who can operate across the US patchwork, GDPR and the UK regime is highly valuable - precisely because so few employers can find one.