Privacy teams across Europe are being stretched thin, forced to reconcile increasingly data‑heavy environments with fewer resources, leading many to anticipate a material breach in the next year, according to new research from ISACA. 

Polling almost 500 European privacy professionals, ISACA’s State of Privacy 2026 report found that nearly four in ten (39%) of legal privacy teams and 51% of technical privacy teams report being understaffed, even as their workloads soar.

Adding to the problem, 44% of privacy pros say their team is underfunded, with more than half (54%) expecting privacy budgets to decrease further over the next year.

With Europe featuring some of the world’s most complex privacy regulatory environments, this underinvestment is already having a severe impact, with 22% of privacy professionals saying their organisation is struggling to identify and understand its privacy obligations.

Confidence in future readiness is low as a result, with just 8% of respondents sure in their organisation’s ability to comply with new and emerging privacy laws, and half (49%) reporting that managing the risks associated with emerging technologies has become a major roadblock.

Retention is also a growing concern, with 34% reporting difficulty keeping qualified privacy professionals, and 45% citing a lack of training or poor training as a key contributor to privacy failures.

Together, this is leading to a stark human impact. More than two-thirds of respondents said that their job is more stressful now than five years ago, pointing to the rapid pace of technological change (68%) and compliance challenges (64%) as key tension points.  

With pressure mounting, more than a quarter (26%) of privacy pros believe that their organisation is likely to experience a material privacy breach in 2026 – a figure which could amount to a wave of avoidable data breaches if resources continue to thin.

“Privacy teams are being asked to manage more risk with fewer resources, and the strain is beginning to show,” said Chris Dimitriadis, global chief strategy officer at ISACA.

“As organisations adopt new technologies at speed, the volume and complexity of privacy obligations grow in parallel – yet many teams are still operating without the staffing, funding or training they need to keep pace.”  

Despite the potentially cataclysmic fallout when privacy policies fail, board-level attention remains inconsistent, with 26% of European privacy professionals agreeing their board of directors is failing to prioritise privacy, even as risks continue to intensify.

Recommended reading

• Report: Cyber Breaches Are Tanking Share Prices
• How Prepared Are You For The Inevitable Data Breach?
• AI Is Driving Data Breaches, IBM Finds

While the financial implications of regulations like GDPR and the NIST Privacy Framework are forcing privacy up the board agenda, 44% of those working in the field said that their leaders treat it simply as a compliance chore, rather than astrategic and ethical imperative.

“Boards must treat privacy as a strategic driver of trust, resilience and competitive advantage, not just a compliance checkbox,” said Dimitriadis. “It demands sustained investment in people, governance and culture – and that begins at the top.”

More positively, many organisations across Europe are taking steps to strengthen privacy controls. More than three-quarters (79%) are now using a framework or regulation, most commonly GDPR, to guide their privacy programme, and a majority are implementing controls such as data security (71%) and encryption (73%).

However, only 64% of European firms have a formal incident response plan as part of these privacy programmes, leaving more than a third unprepared to respond effectively to serious incidents, a gap the ISACA said could leave organisations increasingly vulnerable in the years ahead.