The Data Lawyer Shortage: Why Privacy, Cyber and AI Searches Keep Stalling

By H. Lawrence Brown, Esq., Senior Vice President, Privacy & Legal Executive Search, JW Michaels & Co.

For years, the typical privacy counsel role centered on product counseling, contract review, vendor diligence, privacy notices and M&A support. That work still matters, but it is now a fraction of what companies expect from the seat.

Today's privacy, cyber and AI legal seat is expected to build a program, sit in on incident response, advise the board on AI risk and keep pace with regulators on multiple continents. Very few lawyers have done all of that, and the companies hiring for it are finding out mid-search.

Here is what is driving the shortage, and what you can do before your search opens.

1. The job grew faster than the talent pool

The scope of the privacy seat has expanded across nearly every company that has one.

In the IAPP's Privacy Governance Report 2024, 69% of surveyed chief privacy officers said they had taken on responsibility for AI governance, 69% for data governance and ethics, and 37% for cybersecurity regulatory compliance. At the team level, more than 80% of privacy teams had picked up responsibilities beyond privacy.

That is a different job description than the one most privacy lawyers trained for. Many strong candidates built their careers on product counseling, contract review, vendor diligence and privacy notices. They are capable lawyers. Fewer of them have stood up an AI review process or worked through a regulator inquiry after a breach.

2. Demand for AI governance talent is still climbing

Almost no organization thinks it has enough people for AI governance.

The IAPP and Credo AI's AI Governance Profession Report 2025 found that 77% of surveyed organizations are working on AI governance, rising to nearly 90% among those already using AI. Only 10 of 671 respondents, or 1.5%, said they would not need additional AI governance staff in the next 12 months.

The same report found privacy and legal and compliance teams are the two functions most often given primary responsibility for AI governance, at 22% each. In other words, the AI mandate is landing on the legal and privacy teams you are already hiring for. Nearly one in four respondents (23.5%) named finding qualified AI governance professionals as part of their challenge.

3. The regulatory calendar keeps adding work

Several deadlines that shape these roles land between now and 2028.

• California. The California Privacy Protection Agency finalized new CCPA regulations that took effect January 1, 2026. Businesses subject to the risk assessment rules had to begin complying on that date and must submit attestations by April 1, 2028. Requirements for automated decisionmaking technology apply from January 1, 2027. Cybersecurity audit certifications start with the largest businesses, those with more than $100 million in revenue, by April 1, 2028.
• New York. The final requirements of the amended NYDFS Cybersecurity Regulation (23 NYCRR Part 500), covering multi-factor authentication and asset inventories, took effect November 1, 2025.
• European Union. The Digital Omnibus on AI, adopted in July 2026, moved the EU AI Act's obligations for high-risk systems listed in Annex III to December 2, 2027, and for systems covered by Annex I to August 2, 2028.

The EU delay buys time, and the preparation work remains. Someone still has to inventory AI use, classify systems and build the documentation, and that work usually starts in legal.

4. Pay is following the expanded scope

Lawyers who can cover privacy and AI governance together are commanding more.

The IAPP's Salary and Jobs Report 2025-26, based on more than 1,600 respondents in over 60 countries, found that half of respondents working in both privacy and AI governance earn more than $169,700. By comparison, half of those working only in privacy earn less than $123,000, and half of those working only in AI governance earn less than $151,800.

That gap matters when you set a band. A range built for last year's privacy counsel role will often fall short for a candidate who can also run AI governance, and that candidate has options.

5. Why these searches stall

Most stalled searches trace back to decisions made before the first interview.

• The job description describes the old role. If the posting reads like contract review and the interview process tests for program leadership, candidates self-select out, or the wrong ones apply.
• The comp band was set against the old role. Compensation that worked for a narrower privacy counsel seat can lose finalists late in the process, after weeks of interviews.
• The brief asks for everything at once. A lawyer with deep privacy, cyber incident and AI governance experience exists, but there are very few of them. A search that will only accept all three can run for months.
• Reporting lines are unclear. Strong candidates ask who they report to and whether the seat has a voice with the board. A vague answer slows them down.

6. What to decide before you open the search

The fastest searches start with clear answers to four questions.

1. Which of privacy, cyber and AI governance is core, and which can be learned? Rank them. A candidate who has built a privacy program can often grow into AI governance faster than the reverse.
2. Is this a counsel seat or a program leader? If the business wants someone to build and run a program, scope and title the role that way from the start.
3. Where does the role report, and who owns AI risk? Settle this internally before candidates ask.
4. Does your band reflect the role you are hiring for today? Benchmark against current data, then leave room to move for the right person.

---

Privacy, cyber and AI legal roles are being rebuilt in real time, and the candidate pool is catching up. Companies that define the role clearly and price it to today's market will reach the right people first.

JW Michaels & Co. places privacy, cybersecurity and AI governance lawyers with technology companies, financial institutions and asset managers, from startups to the Fortune 100 and the largest asset management firms. Results from our 2026 Privacy, Cyber & AI Legal Compensation Survey are due in November. To talk through a search, contact Lawrence Brown at Lawrence@jwmichaels.com.

Sources

• IAPP, Privacy Governance Report 2024
• IAPP and Credo AI, AI Governance Profession Report 2025
• IAPP, Salary and Jobs Report 2025-26
• California Privacy Protection Agency, announcement of September 23, 2025
• NYDFS, Second Amendment to 23 NYCRR Part 500
• Regulation (EU) 2026/1744 (Digital Omnibus on AI)