Privacy teams face growing demands on limited resources.
ISACA’s State of Privacy 2026 report (survey run in Sept 2025 with 1,800+ respondents) reports that privacy risk is rising while privacy capacity is shrinking.
This review focuses on staffing, training and the changes privacy teams can make with limited resources.
The survey reports:
Smaller teams still need to assess AI use and respond to data subject requests.
Treating privacy as a separate review at the end of a project can add delays.
Lower staffing makes those delays harder to manage.
If privacy isn’t built into how the business runs, you end up with:
ISACA separates privacy staffing into two categories:
Both are under pressure. But technical privacy roles are consistently harder to cover—because you need people who can translate privacy requirements into actual system behavior.
And the survey also shows technical privacy roles are slightly more likely to see increased demand in the next year.
Allocate time and staff to implementing privacy controls.
Priorities include:
ISACA asked what makes a privacy candidate “qualified.” The top answers were:
Notably, “organizational fit” and “adaptability” were new options this year—and they jumped straight to the top.
Also:
Privacy roles require continuing professional development.
Staff need to keep up with changes in tools, laws and AI use.
When hiring, assess how candidates apply their knowledge and work with other teams.
This was one of the most blunt findings in the report:
And while 79% of organizations provide privacy awareness training, the existence of training clearly isn’t the same as effective training.
Training should have a defined behavioural objective.
Attendance records alone do not show whether staff can apply what they learned.
If your program is just:
check whether staff can apply the lessons in their work.
The real question is: What behavior changed this quarter because of training?
ISACA also draws a strong connection between board support and:
Board discussions should explain the operational effects of privacy risks.
Use evidence when requesting resources.
Explain the potential business consequences:
The survey shows:
ISACA’s important point: AI adoption correlates with maturity.
Organizations with stronger privacy-by-design habits and board prioritization are more likely to use AI responsibly.
AI tools need defined uses and oversight.
Establish an inventory, responsibilities, workflows and measures before introducing AI tools.
Potential uses, subject to review, include:
ISACA notes a clear trend:
Even when actual cuts lag behind expectations, the fear of cuts changes behavior:
With limited resources, privacy teams can improve operational efficiency through:
Assign privacy responsibilities within existing business workflows.
Privacy leads can adapt the following steps to their teams:
If you can’t show:
leadership will have less information for resource decisions.
Start small:
And document governance: what you use, what data touches it, and what you prohibit.
The staffing and budget findings support a review of priorities.
Identify which tasks need technical support and which can be handled through established business workflows.
Track whether those changes reduce delays and unresolved risks.
Start with the gap that creates the most unresolved risk or repeated work.
