Privacy teams are being asked to manage growing risk with fewer resources, according to new research from ISACA. Despite accelerating privacy threats and regulatory demands, more than four in ten (44%) privacy professionals in Europe say their teams are underfunded, while over half (54%) expect privacy budgets to decrease further in 2026.
In a region with one of the world’s most mature privacy regulatory environments, underinvestment is already having tangible consequences. Nearly four in ten (39%) legal privacy roles and over half (51%) of technical privacy roles in Europe report being understaffed, and more than a quarter (26%) of privacy professionals believe their organization is likely to experience a material privacy breach within the next year.
Together, this highlights a growing contradiction for European organizations: privacy risk and regulatory expectations continue to rise, while investment in people and resources is being scaled back.
Yet board-level attention remains inconsistent. More than a quarter (26%) of European respondents say their board of directors is failing to adequately prioritise privacy, even as risks continue to intensify.
Chris Dimitriadis, Global Chief Strategy Officer at ISACA, said, “Privacy teams are being asked to manage more risk with fewer resources, and the strain is beginning to show. As organizations adopt new technologies at speed, the volume and complexity of privacy obligations grow in parallel – yet many teams are still operating without the staffing, funding, or training they need to keep pace.
“When boards underestimate privacy, they underestimate a fundamental pillar of digital trust. A single privacy breach can erode years of brand equity, damage customer relationships and trigger significant regulatory consequences. Prioritising privacy is not simply a compliance requirement; it is a business imperative.”
These pressures are mounting at a time when risks are accelerating.
Nearly half (49%) of professionals say managing the risks associated with new technologies is a major obstacle to their privacy programmes. The human impact is equally stark: 67% say their job is more stressful now than five years ago, with respondents pointing to the rapid pace of technological change (68%) and compliance challenges (64%) as key drivers.
Regulatory complexity is compounding these challenges. Over a fifth (22%) of privacy professionals in Europe say their organization struggles to identify and understand its privacy obligations, while more than half (51%) point to the complexity of international laws and regulations as a key barrier. Confidence in future readiness is low, with just 8% of respondents completely confident in their organization’s ability to comply with new and emerging privacy laws.
While regulation is helping to elevate privacy discussions at board level – with 44% of professionals saying their board views the privacy programme as compliance-driven – a narrow focus on compliance alone leaves organizations exposed. True resilience requires boards to see privacy as a strategic and ethical priority.
Dimitriadis continues: “These gaps underline a critical truth: privacy cannot be strengthened solely through controls or checklists, even with the help of AI. It demands sustained investment in people, governance, and culture – and that begins at the top.
“Boards must treat privacy as a strategic driver of trust, resilience, and competitive advantage, not just a compliance checkbox. When organizations equip their privacy teams with the skills, resources, and authority they need, they are not just reducing risk – they are preparing their business for the next wave of regulatory and technological change. By investing in training and professional development today, leaders can build a foundation of privacy resilience that is ready for the evolving landscape.”
Many organizations are taking positive steps, with 79% in Europe using a framework or regulation, most commonly GDPR, to guide their privacy programme, and a majority implementing controls such as data security (71%) and encryption (73%).
However, critical gaps remain. Only 64% of European organizations have a formal incident response plan as part of their privacy controls, leaving more than a third unprepared to respond effectively to privacy incidents. Retention is also a growing concern, with 34% reporting difficulty keeping qualified privacy professionals, and 45% citing a lack of training or poor training as a key contributor to privacy failures.
