Executive Summary

Key Figures

Source: Yener, Hassan, Bashir, "Who Governs Data in the AI Era?" (arXiv:2609.32030, September 25, 2026).

The usual way to learn how an organization handles privacy and AI is to ask the people who do it. That is how the annual surveys from industry associations and security vendors get built. Respondents grade themselves, so favorable answers come back in quantity, and how the work is actually divided up inside the company stays out of frame.

The picture those surveys draw is already sharp enough on its own. In the 2024 governance report from the International Association of Privacy Professionals, which this paper cites, 55 percent of privacy functions said they are directly responsible for AI governance, and 69 percent of chief privacy officers reported AI oversight duties on top of their existing ones. TrustArc's 2025 survey of 1,775 practitioners found 47 percent naming AI as their single biggest hurdle. Every one of those figures is an answer a practitioner selected. Whether the company is actually hiring someone to carry that work, and on what terms, is not something a survey can reach.

This paper picked up a different document. The job ad. A title, a required number of years, a credential, a salary band: these are terms an employer has publicly committed to paying for. Unlike a survey answer they are hard to walk back, and an employer who wants applicants has no choice but to be specific. Between June and August 2025 the researchers collected 2,254 U.S. privacy-related postings from LinkedIn and Indeed, then filtered on title and on description to leave 1,143. Postings where privacy appears only in the equal employment opportunity statement at the bottom dropped out at this stage, as did security or compliance roles with no specific privacy responsibility in the description. Because the collection ran once, retrospectively, any position already filled or taken down during that window never entered the list, and with no record of what was missed the authors write that they cannot tell which way the gap runs.

The surviving documents went through two kinds of analysis. One was rule-based extraction, pulling titles, salaries, competencies, certifications, degrees, years of experience and named laws and standards out of the text according to fixed patterns. The other was topic modeling across whole documents, which produced 18 themes that the researchers grouped into four categories: compliance and risk, governance and management, legal and regulatory, and engineering. The second method exists to catch the mass that the first one, working from a fixed list, walks past.

Reviewing the related literature, the authors report that no peer-reviewed study had yet examined the privacy workforce at this scale. There is a precedent for the method in a neighboring field. A 2024 study ran topic modeling over 9,407 cybersecurity postings from Indeed, and this paper carries that approach across to privacy.

Grouping the 1,143 titles by similarity produced 22 families. The largest is Privacy Counsel, the in-house lawyer who owns privacy, at 59 postings. Yet those 59 postings amount to only 5.2 percent of the corpus. Nothing among the 22 families climbs past 59. Below are the thirteen that appear at least twenty times.

Read the list from top to bottom and the character of the job keeps changing. It opens with a corporate lawyer, passes an analyst and an accountable officer, goes through an engineer, and comes down to compliance staff. This looks less like one job carried under several names than like companies placing the same work in different departments and hiring for it out of different professions. There is no standard occupation here in the way there is for a doctor or an accountant.

One line in the table is worth a second look. The dataset holds U.S. postings only, and Data Protection Officer still appears 20 times. That title names a position the European Union's General Data Protection Regulation requires certain organizations to appoint. Either American companies bound by the European rules have imported the name as it stands, or that vocabulary has started to function as an industry standard.

Six of the families carry the broader compliance label instead. Compliance Analyst at 27, Compliance Manager at 24, Compliance Specialist at 23, Compliance Officer at 22, Compliance Director at 20 and Compliance Program Manager at 17 add up to 133 postings, more than twice the count of Privacy Counsel. That many employers are hiring for privacy work without putting the word in the headline of the ad.

How far the field has scattered becomes plain once the whole table is added up. The 22 families in the paper's title table come to 538 postings, 47 percent of the 1,143 analyzed. The remaining half and a bit went out under names that fit no family at all. The paper adds one observation here. Privacy Engineer standing at only 28 may not mean there is little technical work to do; it may mean that work has moved inside legal and governance titles. Research that defines the privacy workforce by title alone therefore loses that work entirely. A name does not hold everything a job contains, and the same thing happens with AI.

Searching the body text for artificial intelligence language finds it in 51 percent of the 1,143 postings. More than half the employers hiring for privacy wrote AI into the ad. Only 68 job titles, though, include AI as a standalone term. For every ten postings that discuss AI in the description, roughly one names it in the title.

The examples the paper cites show how AI duties reach the other nine. Global Privacy Counsel, an established title, appears as Global Privacy Counsel, AI Governance. VP, Product Privacy appears as VP, Product Privacy and AI Legal. No seat was created; the reach of an existing one was extended.

The topic model points at the same place. AI language did not gather into one theme but stayed spread out. AI/ML Risk Monitoring, in the compliance and risk category, accounts for 3.85 percent of postings. AI Legal Governance, under legal and regulatory, accounts for 1.75 percent. Data Governance and Management, under governance and management, accounts for 4.90 percent. The largest theme by far is Security Compliance and Risk Management at 20.2 percent, and adding the second largest, Healthcare Privacy Compliance, puts the top two at 38.4 percent of the whole set. The pieces that handle AI sit beside that mainstream at one to five percent each.

Summing the eighteen themes by category shows where the weight rests. Compliance and risk holds 48.8 percent, close to half. Governance and management is 21.5 percent, legal and regulatory 10.9 percent, engineering 5.6 percent. All four together reach 86.9 percent, and the remaining 13.1 percent attached to no theme at all. Only two themes put AI in their labels, and together they make 5.6 percent, the same size as the whole engineering category.

Even with the titles scattered, collecting what the postings ask for yields a recognizable portrait of a single person. Credentials first. The Certified Information Privacy Professional, or CIPP, leads at 373 postings, followed by CIPM at 251 and CIPT at 169. The security credential CISSP was requested in 145. The credential built for AI oversight, the Artificial Intelligence Governance Professional or AIGP, appears 16 times. Set against CIPP that is still a long way down. Even so, the name has begun to show up next to credentials that took years to establish.

Degree requirements appear in 73 percent of the postings. Grouped into broad fields, STEM and computing categories account for 682 mentions, well ahead of Business and Management at 256 and Law and Policy at 119. As a single field, Computer Science and related engineering leads at 227, followed by Mathematics and Quantitative Fields at 117 and Information Systems at 107. Law sits at 74. And yet the title employers post most often belongs to a lawyer. The education being asked for leans technical while the name on the seat leans legal. Experience requirements cluster in the middle of a career, with 35 percent asking for four to six years, which is neither an entry-level hire nor an executive one.

Among competencies, communication at 1,030 mentions, collaboration at 856 and leadership at 784 all run ahead of any individual technical competency. On the technical side the most frequent is cloud at 324 mentions, then encryption at 115 and privacy impact assessment at 107. Cloud counted together with the separately named AWS at 111, Azure at 101 and Google Cloud Platform at 63 totals 599 postings in the paper's own text, which is a different measure from the 324 in its competency figure. The size of the gap becomes visible further down the ranking. Four more items the paper classifies as interpersonal outrank the leading technical competency: analytical thinking at 542, documentation at 522, presentation at 457 and risk assessment at 443, against cloud at 324. The job these ads describe sits closer to moving between departments, persuading and coordinating, than to writing code in isolation. The authors do attach a caveat. Words such as communication and collaboration may be standardized or aspirational language rather than a requirement anyone will be held to.

In the regulation counts, the European GDPR leads at 594 mentions even though every posting in the set is American. HIPAA, the American health information law, follows at 525, and California's consumer privacy law CCPA at 472. Salaries, among postings that disclosed them, averaged $146,467 with a median of $135,425, and reported values ran from $29,120 to $371,000. By location, among cities with at least five postings, Mountain View had the highest mean at $239,258, while the lowest on the same basis was Kansas City at $93,842. The authors note that these salary figures describe only the disclosing subset, which tilts toward states with pay transparency laws and toward larger employers.

From here we carry the same numbers over to our own workplace.

What this paper measured is where responsibility for AI sits on the org chart. The answer is that it has not settled into one box. It is in legal, it is in compliance and risk, it is in engineering, and inside the largest of those categories the theme that handles AI risk directly accounts for 3.85 percent of all postings. Engineering, the smallest of the four categories, is 5.6 percent. If that is how companies have actually spread the money, then in a great many organizations it is accurate to say that this responsibility belongs to nobody yet.

Stacking the work onto a role that already exists is fast, and it is not unreasonable. Someone who already handles privacy knows where the data comes in, where it piles up and who pulls it back out. Few better starting points exist for taking on AI. The question is what came along with the added scope. Privacy work is mostly a matter of confirming which system holds which information, while governing AI means following that information into the training set, through the decision and out to the result. If the same person is handed twice the territory while the tools and the records stay where they were, the only thing that grew is the liability.

The competency ranking backs that up. In a role where communication and collaboration rank above technical skill, the person holding it spends a fair share of the day asking other departments questions. Even allowing for the authors' caveat that such words can be boilerplate, the picture employers have of the job still stands. When no record exists of which data went into what, that question travels from one person to the next. This is the scene Pebblous meets regularly in data quality work. The demand to comply arrives first, and the record that would show compliance does not arrive later either.

So the paper does not read as a story about somebody else's labor market. Who in your organization is accountable for data and AI? Is that duty written into their title? And if it is, did the records and the tools to discharge it come with it? When the three answers fail to line up, the position is not far from the one that 1,143 American job ads described.

Thank you for reading this far. The paper itself is available on arXiv. We would be glad if you checked which department in your own organization holds the line of responsibility for AI, and whether records came with the assignment, and told us what turned out to be missing.

R.1Academic Papers

• 1.Yener, R., Hassan, M., & Bashir, M. (2026). "Who Governs Data in the AI Era? A Computational Analysis of the U.S. Privacy Workforce in Job Postings." arXiv:2609.32030. Unless noted otherwise, every figure and quotation in this article comes from here: the title distribution, the AI mention rate, the certification, degree, experience and competency counts, the topic modeling results, the salary statistics, and the limitations the authors state themselves.
• 2.Ozyurt, O., & Ayaz, A. (2024). "Identifying Cyber Security Competencies and Skills from Online Job Advertisements through Topic Modeling." Security Journal 37(4), 1339–1359. A topic modeling analysis of 9,407 cybersecurity job postings from Indeed. The paper above cites it as a methodological precedent, and this article refers to it through that account.

R.2Official Documents & Regulation

• 3.European Union. (2016). "General Data Protection Regulation," Article 37. The provision requiring certain organizations to designate a Data Protection Officer.

R.3Industry Surveys

• 4.IAPP. (2024). "Privacy Governance Report 2024." Source of the finding that 55 percent of privacy functions are directly responsible for AI governance and that 69 percent of chief privacy officers report AI oversight duties. This article refers to it through the account in the paper above.
• 5.TrustArc. (2025). "2025 Global Privacy Benchmarks Report." Based on responses from 1,775 professionals across industries and geographies. Source of the finding that 47 percent of privacy teams name AI as their biggest hurdle, referred to here through the account in the paper above.