Data Privacy Pioneers to Follow in 2027
The scholars, regulators and practitioners who built modern privacy thinking — and now govern how AI systems may use personal data.
Privacy used to be a compliance niche; the numbers say otherwise now. GDPR fines passed €7.1 billion in cumulative penalties by the end of 2025, with European regulators fielding 443 breach notifications a day, and in the US twenty states have comprehensive privacy laws in force with more already enacted for 2027 and 2028. The people below are the scholars, litigants and regulators who built the frameworks those laws borrow — Privacy by Design, contextual integrity, the case law that killed two transatlantic data deals — and several of them now sit in the rooms where the AI rules are being written. We re-checked every entry for the 2027 edition: one has left the European Commission for a university boardroom, and one fight — over training AI on your posts — has become the field's defining case.
The American picture is a patchwork rather than a framework. Per the IAPP's US State Privacy Legislation Tracker, 20 states had comprehensive consumer privacy laws on the books by mid-2026 — Indiana, Kentucky and Rhode Island took effect on 1 January 2026 — with trackers counting enacted-but-not-yet-effective laws at 23–24 (Oklahoma, Louisiana, Alabama and Vermont are scheduled for 2027–28), and still no US federal comprehensive law.
| Name | Known as | Follow for |
|---|---|---|
| Ann Cavoukian | Creator, Privacy by Design | The framework every privacy engineer still starts from |
| Max Schrems | Founder, noyb | The litigant who reshaped EU–US data transfers |
| Shoshana Zuboff | Author, The Age of Surveillance Capitalism | The economics of behavioural data |
| Helen Nissenbaum | Professor, Cornell Tech | Contextual integrity — privacy as appropriate flow |
| Daniel Solove | Professor, GW Law; TeachPrivacy; author, On Privacy and Technology (2025) | Privacy law made teachable |
| Woodrow Hartzog | Professor, Boston University Law | Privacy's blueprint against design abuse |
| Alessandro Acquisti | Professor, Carnegie Mellon | The behavioural economics of privacy |
| Lorrie Cranor | Professor, Carnegie Mellon | Usable privacy and security |
| Michelle Dennedy | Former Cisco/Symantec privacy chief; recent expert bios list her as Chief Data Strategy Officer, Abaxx Technologies | Privacy engineering as a business function |
| Jules Polonetsky | CEO, Future of Privacy Forum | Where policy meets product |
| Gabriela Zanfir-Fortuna | Future of Privacy Forum | Global data-protection law, comparatively |
| Margrethe Vestager | Former EU Commissioner for Competition & Digital; Chair, DTU Board of Governors | Europe's tech-regulation era |
| Bruce Schneier | Security technologist; author, Rewiring Democracy (2025) | Privacy as a security property |
| Debra Farber | Privacy & security advisor | Operational privacy leadership |
| Anu Talus | Chair, European Data Protection Board | EU enforcement — the EDPB's annual reporting is the primary source on GDPR fines |
Privacy is now an agent-design constraint too — see AI fairness in practice for the organisational programme that pairs with it.
Frequently asked questions
How was this list compiled?
The list rebuilds the original Engatica data-privacy ranking for 2027. We kept the scholars, litigants and regulators whose frameworks modern privacy law actually borrows — Privacy by Design, contextual integrity, the Schrems case law — re-checked each entry against current sources, and added the sitting chair of the European Data Protection Board. Preference went to people still shaping AI-era rules, not only those who shaped the GDPR era.
How often is the list updated?
Annually, on the edition cycle, with corrections in between. The 2027 edition added Margrethe Vestager's move from the European Commission to chairing DTU's board, Daniel Solove's 2025 book On Privacy and Technology, and Bruce Schneier's Rewiring Democracy. Privacy roles change more slowly than tech jobs, but enforcement leadership changes matter — which is why the EDPB's current chair now appears alongside the field's founders.
How can I get added to the list, or get an entry corrected?
Nominate through the nominations page, with links to the person's recent work — a judgment, a paper, a regulatory programme, a book. The bar is influence on how privacy is practised or enforced, not social following. Corrections work the same way: if an entry's title or affiliation is stale, send a current source and we will amend the live list rather than waiting for the next edition.
Is there a US federal privacy law yet?
No. There is still no comprehensive US federal consumer privacy law. Instead, per the IAPP's tracker, 20 states had comprehensive laws on the books by mid-2026 — Indiana, Kentucky and Rhode Island took effect on 1 January 2026 — and trackers count 23–24 enacted once laws scheduled for 2027–28 are included. Until Congress acts, the pioneers on this list are largely explaining a patchwork, state by state.
Sources
- New Chairman of DTU's Board of Governors (Margrethe Vestager) — DTU (2024)
- Meta Training AI on Social Media Posts: 7% in Europe Say Yes — The Register (2025)
- Michelle Dennedy — The 9 Steps (bio: Chief Data Strategy Officer, Abaxx Technologies) — ADAPT (2025)
- Notable Privacy, AI, and Security Books 2025 (Solove, On Privacy and Technology) — TeachPrivacy (2025)
- Professors Woodrow Hartzog and Richard Ainsworth Ranked in SSRN Scholarly Impact — Boston University School of Law (2025)
- Our 6 Takeaways from This Year's Data Privacy Day (Cavoukian; Farber; Cranor) — Transcend (2025)
- Winning Privacy Papers Honored at FPF's 15th Annual Privacy Papers for Policymakers Event — Future of Privacy Forum (2025)
- AI Is Stress-Testing Privacy Law, Says Future of Privacy CEO — MediaNama (2026)
- Shoshana Zuboff Takes on the Tech Bros — The Observer (2026)
- Ending Surveillance Capitalism (Carr Center programme) — Harvard Magazine (2026)
- EDPB Annual Report 2025 — European Data Protection Board (2026)
- GDPR Fines Surpass £1 Billion as Data Breach Notifications Surge (DLA Piper survey) — SC Media (2026)
- GDPR Violation Reports Surge Across Europe in 2025 — Digital Watch Observatory (2026)
- U.S. State Privacy Laws: The 2026 Comparison Guide (IAPP tracker) — Clym (2026)
- U.S. State Privacy Laws 2026–2028 Tracker — Captain Compliance (2026)