ISACA Privacy Survey Finds Shrinking Teams and Widespread Budget Concerns
Original report publisher: not verified. Report discovered via Awesome Annual Security Reports.
Summary
ISACA’s State of Privacy 2026 survey finds median privacy staffing fell from eight to five, half of respondents expect budget cuts, and 14% reported a privacy breach in the past year, up from 12%.
Key points
- ISACA surveyed more than 1,800 respondents in September 2025 about privacy staffing, operations, budgets, training and breaches.
- Median privacy staffing fell from eight to five; 47% of respondents described technical privacy teams as understaffed, compared with 37% for legal/compliance teams.
- Half of respondents expect privacy budget cuts in the next 12 months. However, only 12% reported actual decreases in the past year, substantially below earlier forecasts.
- Fourteen percent reported a privacy breach in the preceding 12 months, up from 12%; 17% did not know and 14% preferred not to answer.
- Respondents identified poor or absent training (51%) and failure to practice privacy by design (50%) as the most common privacy failures, both increasing from the previous survey.
- Board prioritization, alignment with enterprise objectives and adequate funding were associated with more consistent privacy-by-design practices; the report did not find an association between those practices and fewer breaches.
- Thirteen percent currently use AI for privacy tasks and 38% plan to within a year. The report cautions that AI cannot compensate for resource shortages or inadequate privacy prioritization.
Article Details
- Publisher
- ISACA
- Scope
- Global survey of privacy staffing, operations, budgets, awareness training, breaches, privacy by design, and AI adoption for privacy tasks.
- Sample Size
- More than 1,800 respondents; approximately 47,600 ISACA constituents were invited.
- Key Statistics
- Median privacy staff size fell from eight in the previous report to five in the 2026 report.
- 47% of respondents reported understaffed technical privacy teams, compared with 37% for legal/compliance privacy teams.
- 50% expected privacy budget decreases in the next 12 months. However, only 12% reported actual decreases, despite 48% anticipating decreases in the previous survey.
- 51% identified lack of training or poor training as a common privacy failure, compared with 47% in the previous report.
- 14% reported an organizational privacy breach in the preceding 12 months, compared with 12% in the previous report; 17% did not know and 14% preferred not to answer.
- Recommendations
- Ensure boards prioritize privacy and align privacy strategies with broader enterprise objectives.
- Maintain close collaboration between technical privacy and legal/compliance privacy professionals.
- Periodically review and revise privacy awareness training; ensure combined security and privacy training includes privacy-specific concepts.
- Measure privacy awareness training effectiveness, accounting for the possibility that improved awareness increases incident self-reporting.
- Integrate privacy into the entire engineering process through privacy by design.