A privacy promise is easy to write. A customer clicks “delete my data,” and the promise suddenly becomes a scavenger hunt through marketing software, support tickets, payment systems, product databases, forgotten trials, and whatever app somebody expensed last Tuesday. Daniel Barber built DataGrail around this awkward distance between what a company says and what its systems can prove.
His route into privacy did not begin in a law office. It ran through the revenue side of enterprise software, where Barber led teams at Responsys, ToutApp, Node.io, Datanyze, and DocuSign. Those companies sat close to the modern growth machine: more tools, more customer signals, more ways to turn behavior into a sales or marketing decision. Barber saw the useful side of that machinery. He also saw how personal information scattered as each new application joined the stack.
The discomfort accumulated. Brands were asking people to trust them while often lacking a current inventory of the systems holding those people’s information. Barber came to treat the mismatch as more than a compliance inconvenience. He has repeatedly put the principle in plain language: “Privacy is a human right.” But his founder’s response was concrete. If rights were going to survive contact with a sprawling software estate, somebody had to build the plumbing.
“First and foremost, privacy is a business problem.”Daniel Barber, on shared responsibility
01 / The useful pothole
He learned by watching where operators got stuck
Barber has a revealing description of how he prepared to found a company. He watched other founders, CEOs, and executives and tried to notice where they “hit potholes.” It is less romantic than waiting for inspiration and more useful than copying a victory lap. A pothole is a recurring failure in the road: a handoff nobody owns, a spreadsheet that expires as soon as it is saved, a promise that depends on one exhausted employee remembering twelve passwords.
Privacy was full of these. Europe’s GDPR gave people rights to access and erase information. California’s CCPA brought a related conversation closer to Barber’s home market. Yet the operational starting point remained stubborn: a business needed to know which systems it used and which of them contained personal data. In one interview, Barber said DataGrail’s mapping work could uncover about 50 percent more third-party applications than customers expected. The surprise was the product brief.
In 2018, Barber co-founded DataGrail with Ignacio Zendejas and Earl Hathaway. The early proposition linked an inventory of data-bearing systems to workflows for consumer requests. Rather than ask a privacy team to chase every application manually, the platform used integrations to discover systems and orchestrate the work. The company later expanded into consent, assessments, risk monitoring, and managed privacy services, but the map remained the organizing object.
02 / Rights meet machinery
The company grew around a deceptively simple request
“Show me what you have about me” sounds like one question. Inside a company it can become dozens. Is the requester who they claim to be? Which identifier connects their support account to a purchase? Did the deletion reach an internal database as well as a SaaS vendor? Can the team demonstrate what happened, and when? Barber and his co-founders are named inventors on issued patents dealing with live data mapping and privacy-protection verification. The technical language reflects the same operational obsession: find, connect, verify, record.
Capital followed the expanding workload. DataGrail announced a $5.2 million financing in 2019, a $30 million Series B in 2021, and a $45 million Series C in 2022. At the Series C, the company reported $84.2 million raised in total. The product had moved toward a privacy control center, and the customer list included businesses such as Salesforce, New Balance, Instacart, Skillshare, and MyFitnessPal. The money was a bet that privacy would become a durable operating category rather than a temporary rush around one regulation.
That bet also asked Barber to translate among professional dialects. Lawyers read duties. Security teams track threats. Marketers care about permission and customer relationships. Product and engineering teams own the actual data flows. His recurring point is that privacy touches all of them. Calling it a business problem is a way of refusing the comfortable fiction that one department can clean up everyone else’s systems after the fact.
It also changes the internal question. Instead of asking which team “has” privacy, a company can ask who owns each decision and which evidence survives the handoff. The distinction sounds small. In practice, it separates a program from a pile of tasks. Barber’s product instincts consistently favor that connective tissue. A request is not finished because an inbox says so. It is finished when the relevant systems have been checked, the action has been recorded, and the people responsible can see the result.
- BBA in international business and marketing from Eastern Michigan University.
- MBA in global management from Doshisha University in Kyoto.
- Co-founds DataGrail and becomes CEO.
- DataGrail announces its $45 million Series C.
- Fast Company includes DataGrail in the security category of its annual innovation list.
- Barber’s public focus centers on AI agents, shadow AI, and accountable automation.
03 / The AI turn
The old visibility problem learned a new trick
Generative AI did not replace the privacy maze. It added moving walls. A familiar vendor can introduce an AI feature, send information to a new subprocessor, or connect a model to data that was once confined to a single application. Employees can adopt tools before legal, security, or privacy teams know they exist. Barber’s formulation is crisp: shadow IT and shadow AI are converging. Both are failures of visibility before they become failures of control.
DataGrail’s 2026 research examined 2,400 widely used business-software providers. It reported that 63.6 percent of vendors advertising AI capabilities did not disclose a third-party AI subprocessor in their legal documentation. Barber described a triangulation process that compared data-processing agreements with product documentation, GitHub environments, API connections, and marketing materials. The larger point was not that every undisclosed connection proved misconduct. It was that static paperwork could lag behind a product that changes continuously.
“Visibility becomes the control plane. Without it, governance fails.”Daniel Barber, looking toward 2026
His answer is not to freeze adoption. Barber expects AI agents to take on repetitive privacy work such as first-pass assessments, records of processing, and routine documentation. Humans would still own judgment and accountability. It is the same founder instinct applied to a new tool: locate the manual chase, automate the predictable parts, and preserve a clear place for consequential decisions.
That division of labor now animates Barber’s public conversations. Through GrailCast Live, he has spoken with leaders from Webflow, CB Insights, Drata, and Glean about guardrails, permissions, governance, and the point at which an AI experiment becomes an operating risk. His role in those discussions is often that of a translator. He brings the conversation back from broad ethics to the mundane controls that determine what actually happens: approved tool lists, data inventories, owners, assessments, and evidence.
04 / The founder’s through-line
Trust becomes credible when someone can inspect the work
Barber’s career has an instructive reversal. He spent years helping revenue organizations use technology and data to move faster. Then he built a company to make the consequences of that accumulation visible and manageable. It is not a rejection of growth. It is an argument that growth creates obligations, and that those obligations need systems as sophisticated as the systems that collect the information.
The practical insight is portable. Values weaken when they depend on memory. A promise becomes sturdier when it has an inventory, an owner, a workflow, and a record. Privacy happens to make the lesson unusually clear because a person can show up and ask the company to act. The request tests whether the elegant policy at the edge of the website is connected to the messy interior.
Barber’s public persona is more operator than oracle. Even the phrase he chose for founder preparation, watching for potholes, describes a person looking down at the road rather than up at the horizon. Colleagues have described him as analytical and as a coach willing to give direct feedback. His own writing keeps returning to tools that make work legible: dashboards, live maps, assessments, and visible controls.
There is still an aspiration underneath the machinery. Barber wants people to have meaningful control over their information, and he wants businesses to earn trust through transparency. DataGrail is the bridge he chose to build between those aims. The AI era raises the stakes because software can now change what it does faster than many organizations can update the paperwork describing it. The founder who studied potholes has found another stretch of road worth mapping.
Read, watch, follow