Free to read. No sign-up. The report is 42 pages; the full review is 106.
167Australian job advertisements captured and coded
101Substantively privacy-focused roles
26%Privacy carried inside another function
0Advertisements asking anyone to change how privacy decisions are made
The central finding
The market describes privacy work more clearly than how privacy reaches a decision
Role descriptions name the expertise. They are much less explicit about when privacy enters a
decision and who must answer the judgement.
0149%
Compliance and legal advice dominate
49 of 101 included advertisements sit in Compliance / Privacy Governance or Legal Privacy Counsel.
0217
Embedded work is a smaller market
17 of 101 roles sit in Operational Privacy. Senior roles are often project-shaped; expertise is clearer than authority.
033
Independent challenge barely appears
3 of 101 roles sit in Risk / GRC Privacy. None describes a clean second-line privacy challenge function.
Almost half the included roles buy compliance or legal advice
Seven populated archetypes classify primary role scope, rather than job titles.
Compliance / Privacy Governance27
Legal Privacy Counsel22
Operational Privacy17
AI Governance Hybrid14
DPO / Regulatory Interface13
Data / Technology Privacy5
Risk / GRC Privacy3
49% combined
Primary archetypes, n = 101. Every advertisement has one primary archetype; the combined 49% is rounded. These counts cannot establish how much capability employers already hold or need. Source: 2026 job-advertisement corpus.Reading the capability findings
The bands signal role scope; the framework describes capability
The review reads each advertisement against the four levels of
The Privacy Capability Framework. A job
advertisement cannot show what a practitioner can do, but it does signal the level the
organisation is asking for, so every role was coded into an advertised band, L1 to L4.
Level 1 · Know
Rule Knowledge
Identifies the applicable obligation and recognises when the text does not answer the question.
↓
L1Rules awarenessSignal holds: closely
Accurate identification of requirements and disciplined escalation.
Level 2 · Operate
Operational Fluency
Applies professional privacy method consistently to produce credible work.
↓
L2Artefact productionSignal holds: closely
Application of professional method to produce credible work and run established processes.
Level 3 · Judge
Risk-Disciplined Judgement
Finds the consequential choice and develops an alternative the business could actually use.
↓
L3Operational embeddingSignal holds: partly
Business access provides exposure; it does not prove judgement, alternatives or unresolved risk ownership.
Level 4 · Shape
System Shaping
Works on the organisational system that keeps producing privacy outcomes.
↓
L4Operating model and contested judgementSignal holds: weakly
The band combines operating-model, judgement, leadership and authority language. The audit tests whether it evidences shaping recurring decision conditions.
The bands were coded in May and June 2026, before the framework reached its final form in August, and are kept unchanged so the corpus stays reproducible. On this page L1 to L4 always mean the advertised bands; framework levels are written out in full. Read the framework →
The supporting findings
The supporting findings qualify the headline pattern
The evidence extends beyond the included privacy-focused roles and requires careful interpretation of senior capability signals.
04
AI governance has three designs
Privacy-led, data-led and standalone functions coexist. The corpus establishes no winning pattern. The choice depends on what existing functions can carry.
05
Senior signals need careful reading
50 roles are coded L3 and 28 L4. L3 signals operational embedding, not proof of Risk-Disciplined Judgement. L4 combines leadership, authority and judgement signals, not proof of System Shaping.
06
L4 does not establish System Shaping
The secondary reading finds no evidenced mandate to change the organisation’s own decision conditions under the report’s test.
07
Privacy disperses into other functions
43 roles name privacy inside adjacent functions: 26% of 167 raw captures, rounded. The other 12 near misses do not support the absorption finding.
08
Timing and authority are under-described
Even roles closest to the business rarely specify when privacy enters a decision or who must engage with the judgement. Operational access does not establish authority to change how the decision is made.
0System Shaping evidenced under the report’s test
What the secondary audit finds
L4 does not establish System Shaping
System Shaping, the framework’s fourth level, means shaping the recurring conditions under which privacy decisions are made. 34 advertisements were re-read against it: 28 coded L4 and 6 coded L3–L4. The audit adds an interpretation; it does not replace the original codes.
91312
Governance construction inside fixed conditions · 9
Risk-Disciplined Judgement only · 13
Mixed · 12
What the L4 signals are, and are not
The L4 signals in these advertisements are mostly leadership, authority and difficult judgement. None of them is System Shaping as the framework defines it: a System Shaping practitioner usually works through the organisation’s existing initiatives, forums and sponsors, and needs influence rather than a title. Even setting authority aside, no advertisement describes the work of shaping the conditions in which privacy decisions are made.
Secondary audit, n = 34. A further scan of all 50 L3 roles found no concealed System Shaping signal. This is a single-reader interpretive audit: silence in an advertisement does not show that an organisation lacks the capability, mandate or sponsorship internally. Source: 2026 job-advertisement corpus.
43 roles carry privacy inside another function
The other 12 near misses are search false positives, not evidence of privacy responsibility being absorbed.
Names privacy inside another function (43)
Does not name privacy (12)
General legal counsel14 + 1
AI, ML and data leadership5 + 3
Cyber and security leadership5 + 3
Senior compliance and risk5 + 1
FOI and information access3
Data governance leadership2 + 1
Long tail9 + 3
Consolidated near-miss reasons, base 55. Absorption is 43 of all 167 raw captures, 26% rounded. Nine of the 12 false positives contain no occurrence of “privacy”; three use it only in candidate-data boilerplate. Source: 2026 job-advertisement corpus.AI governance
Three AI governance designs coexist
The corpus shows competing arrangements. It does not establish which produces better outcomes.
01 Privacy-led
Privacy function↓Privacy + AI governance
Examples in the corpus Sportsbet · QBE · MUFG
What it requires
An existing privacy function with embedded capability and capacity to carry AI scope.
Where it can struggle
A compliance-led function can reproduce that approach to AI.
The organisational choice
Can privacy reach AI deployment decisions before the design is settled?
02 Data-led
Data leadership↓Data + AI governance
Examples in the corpus AFCA · Helia · Capricorn
What it requires
Data leadership with regulatory familiarity and judgement capacity for ambiguous AI decisions.
Where it can struggle
A technical function may lack the judgement needed for contested deployment choices.
The organisational choice
Who resolves questions that technical controls cannot answer?
03 Standalone
Dedicated AI function↓AI governance
Examples in the corpus Slade · Profectus
What it requires
An AI portfolio that justifies the function and executive capacity to integrate it.
Where it can struggle
Separate leadership can add an interface without embedding governance in business work.
The organisational choice
Who resolves decisions that cross the privacy, data and AI functions?
Source: 2026 job-advertisement corpus. Conceptual comparison, not measured reporting lines or market shares. Entry conditions and trade-offs are interpretation, not measured outcomes.
Organisational choices
Five design decisions the corpus surfaces
Design implications, not measured organisational outcomes. The corpus surfaces the choices; existing capability, risk exposure and decision volume determine the organisation’s answer.
01
Where privacy enters business work
Evidence. 49 compliance/legal roles versus 17 Operational Privacy roles in the 101 included roles.
Choice. Whether advice on request is sufficient, or privacy input needs a defined place in product, vendor and data decisions.
02
Where AI governance sits
Evidence. Privacy-led, data-led and standalone designs coexist; the corpus establishes no winning pattern.
Choice. Which function can carry the work, and whether executives can integrate a new function with existing privacy and data governance.
03
How cyber and privacy meet in decisions
Evidence. Senior cyber/security near misses absorb privacy or leave it out of the advertised scope.
Choice. Who has authority on each side of the interface, including during incident response, notification and remediation.
04
How privacy legal work is staffed
Evidence. 22 Legal Privacy Counsel roles; 15 broader legal near misses; 14 name privacy as one practice area.
Choice. Whether the privacy load requires dedicated counsel or can sit within a broader remit. The corpus provides no measured headcount threshold.
05
Where independent challenge comes from
Evidence. 3 Risk / GRC Privacy roles in the 101 included roles; none describes a clean Line 2 function.
Choice. Build privacy-specific Line 2, use broader risk coverage or explicitly accept another model. Challenge complements Line 1 capability.
Read the research
Two ways to read it
The report · 42 pages
The findings, made visual
The eight findings, the capability audit, the AI governance designs, five organisational choices and the routes for practitioners, set out page by page for executives and senior practitioners.
Every section in full: role inventories, the coding framework and crosswalk, the secondary audit, limitations and reproducibility notes. The version to cite.
Read the findings, then the five organisational choices and the operating-model comparisons.
For practitioners
Read the embedded work and AI sections, then the career routes and capability implications.
For a critical reading
Read the band crosswalk, the audit and its closest case, then the methodology and limitations in the full review.
How the research was done
One collection window, three job boards
The observable market
167 raw captures were assembled manually in six sprints from 11 May to 2 June 2026. LinkedIn supplied 112, SEEK 46 and Indeed 9. Manual capture preceded AI assistance; no AI tool collected, scraped or generated advertisement content.
A description of demand
The corpus is neither a census nor a representative workforce survey. It does not measure salary distribution, time-to-fill, team size or operating effectiveness. Search strategy and the short collection window govern the interpretation of every count.
The findings concern advertised demand. They do not measure operating effectiveness or demonstrate the capability of appointed practitioners.
Chan, F. (2026). The Privacy Capability Labour Market Review: What 167 Australian job advertisements reveal about how organisations describe, hire and structure privacy work. fiona-chan.com. https://fiona-chan.com/research/privacy-capability-labour-market-review/
