Data Privacy Attorney Salary 2026: Law Firm vs In-House

A junior data-privacy attorney on the 2026 scale is paid $87,000 more in base than the ACC in-house Attorney median. That spread is arithmetic on two public series: $235,000 (Milbank/market, effective 1 July 2026, reported by Bloomberg Law on 2 June 2026) minus $148,000 (ACC 2025, data effective 1 March 2025). It is not a privacy premium. It is the distance between lockstep and an in-house IC row.

NALP’s 2025 U.S. Associate Salary Survey, as of 1 January 2025 and published in June 2025, put the overall first-year median at $200,000 across 359 offices, $215,000 at firms of 701 or more lawyers (152 offices), and $150,000 at firms of 250 or fewer. The modal first-year figure was $225,000 — 32 percent of all offices, 44.7 percent of 701-plus offices — already the standard in New York City, San Francisco, Austin, Boston, Houston and the Washington, DC area, and still a minority nationally. Eighth-year median at 701-plus firms was $375,000. Those cells pre-date the June 2026 raise. The 2026 lockstep is a market vanguard, not a profession-wide wage.

Biglaw Investor’s 2026 class-year table (fetched 11 September 2026) records the matching-firm ladder as $235,000 / $245,000 / $270,000 / $320,000 / $385,000 / $410,000 / $440,000 / $455,000 base from first year through eighth. Adding the last published year-end plus summer/special produces all-in cash of $256,000 in year one and $585,000 at the senior rung. Treat the bonus column as November 2025, not as a 2026 year-end announcement.

Read the table as two columns of buyers. A lawyer earning the figure starts on the firm row that matches class year, then asks whether an in-house title would actually pay the catch-up — Attorney and Senior Attorney do not; Associate General Counsel begins to. A general counsel paying the figure starts on the in-house title they can honestly staff, then asks whether the work is counseling the collect-use-share-sell stack or incident response. The Bureau of Labor Statistics, last modified 27 August 2026, puts the lowest 10 percent of U.S. lawyers below $78,360 and the highest 10 percent above $351,600 on May 2025 wages. A first-year on the 2026 scale already sits inside that upper decile on base alone. An in-house Attorney median does not.

IAPP’s infographic of 17 September 2025 puts the global median base across privacy, AI governance and cybersecurity roles at $139,000 (first quartile $94,000, third quartile $192,000) against the North America median of $190,000 (first quartile $123,000, third quartile $221,000). Global average total compensation across those same roles is $200,000. This page is a United States wage. The North America cut is the one that belongs next to the lockstep grid; the global median is the profession-wide floor, not the New York or San Francisco offer.

A fifth-year on the 2026 scale ($385,000 base) is paid $184,000 more than the ACC Senior Attorney median base of $201,000. The in-house catch-up is not a cybersecurity retitle. It is promotion to Associate General Counsel ($245,000 base / $294,000 total cash), a $5 billion-plus revenue employer, and the dual-domain overlay IAPP priced. Long-term incentive eligibility is 17 percent at Attorney and 63 percent at CLO in the same ACC 2025 survey. A single-lawyer GC median sits at $234,000 base / $255,000 total cash — not the desk that funds a competitive privacy-attorney package.

Of 33 closed New York associate searches over three years, 9 were privacy or data-protection associate seats at scale-matching firms. Four of those nine drew a counter-offer from the incumbent firm, against a New York associate-line counter-offer incidence of 37 percent. Median offer-to-acceptance on the completed files was 11 working days. Three of the eight completed privacy associate files required a mid-process cash re-brief because the client’s first number was an in-house privacy band. Our New York associate desk is slower on privacy than on corporate M&A for that reason: the typical 6 to 12 week window holds, and privacy files sit at the long end of it.

One of the nine privacy associate files did not complete on the first brief. The client had budgeted the ACC Attorney median against a fifth-year on the 2026 scale. We rewrote the brief; the file then closed in week 14, past the typical window. That is the number on this page that does not flatter the method. Completion across the 33-search New York associate line remains 93 percent. Privacy is where the first conversation about cash most often has to be had twice.

The brief has to decide three things before anyone is approached. Whether the work is collect-use-share-sell counseling or incident response — Chambers already splits those tables, and a mixed brief sources the wrong pool. Whether the payer is a scale-matching partnership or a large-revenue legal department — those two cash systems do not meet at Senior Attorney. Whether the overlay is AI-governance notices and risk assessments, which IAPP priced, or a CISO report, which this page does not. We have mapped this market for more than 10 years; the files that close on time are the files that answer those three questions in week one, not week eight.

Three anonymized composites from the same desk

Connected-product company, privacy AGC. A U.S. manufacturer with a connected-vehicle program opened an in-house seat labeled cybersecurity attorney at Senior Attorney cash. The work was CCPA minimization, purpose limitation and vendor terms after the 2026 enforcement wave. We re-briefed the seat as Associate General Counsel, privacy, with an AI-governance overlay, at the ACC AGC total-cash band. Time-to-fill ran 14 weeks. The candidate who accepted was a fifth-year off a Band 1 privacy desk. No firm, company or lawyer is named here; the shape is the one we see.

Scale-matching fourth-year, declined in-house. A large-revenue technology platform offered Senior Attorney cash to a fourth-year on the 2026 scale ($320,000 base). The incumbent firm counter-offered inside the 37 percent New York associate-line incidence. The lawyer signed back in 11 working days. We closed the company file only after the brief moved to AGC. The lockstep number is doing the retention work; a cybersecurity title would not have changed the math.

Data-broker first privacy attorney. A registered broker facing DROP processing from 1 August 2026 hired its first in-house privacy attorney at Counsel, not at CISO and not at CLO. The brief was registration, frictionless opt-out, and downstream deletion. CalPrivacy’s Strike Force had been live since 19 November 2025. The seat is a privacy attorney. Treating it as a cybersecurity hire would have sourced the wrong pool.

Companies building this seat should start from our in-house and general counsel search and, where the hire is still at a scale-matching firm, from associate and attorney recruiting. The lockstep grid itself lives on the 2026 BigLaw associate salary scale. The in-house privacy-counsel title — a different seat from this attorney table — is a sibling page; so is the cybersecurity-attorney wage. Neither is retold here.