IAPP's 2025-26 Salary Report Adds AI Governance to Privacy Benchmarks

By Grace Kim

The International Association of Privacy Professionals (IAPP) released its Salary and Jobs Report for the 2025-26 cycle, bundling three practice areas into a single benchmark: privacy, AI governance, and digital responsibility.

The release, distributed through IAPP's news channel, gives employers and job seekers one reference document for a labor market that has spent two years blurring role boundaries. Postings that used to read "privacy counsel" now often read "privacy and AI governance counsel."

What do the three domains actually cover as job families?

Privacy is the oldest of the three. It has established credentials — the CIPP and CIPM tracks — and a salary survey record running more than a decade. Pay bands for chief privacy officers, privacy counsel, and privacy engineers typically track to firm revenue or headcount.

AI governance is the newer middle sibling. It overlaps with privacy on data-handling but adds model risk, fairness testing, and regulatory mapping under frameworks like the EU AI Act and NIST's AI Risk Management Framework.

Digital responsibility is the broadest category. It folds accessibility, data ethics, algorithmic transparency, and digital sustainability into a single remit, often attached to a privacy or compliance seat rather than standing alone.

Comparing pay across these uneven job families is hard. The 2025-26 release is a starting point for that comparison, not a settled answer.

Why does IAPP's release carry weight for compensation talks?

IAPP is the main professional body for privacy practitioners, so its salary survey functions as the de facto reference for compensation conversations in the field. Pulling AI governance and digital responsibility into the same document signals what postings already show: more roles straddle two or three of these areas.

For a mid-career candidate, the practical move is to identify which of the three domains your current role actually maps to before comparing offers. A privacy engineer whose work has shifted 40% into model risk review will benchmark against AI governance pay, not legacy privacy pay.

That distinction matters more than the headline medians. Most candidates undercount how much their role has drifted toward AI governance in the past two years.

What should readers watch in the methodology?

The release hasn't disclosed sample size, regional split, or whether figures came from IAPP membership, an employer survey, or both. Those details decide how much weight to give the medians when negotiating. Smaller, self-selected samples tend to overstate senior pay.

Path & Pay will update this piece when the full methodology is public. Until then, treat the medians as directional, not definitive.

The release lands before autumn hiring ramps, which gives candidates in any of the three domains roughly a quarter to recheck their compensation asks against the new figures before Q4 interviews pick up. Plan against that window.