Rapid advancements in technology, combined with an evolving regulatory environment, are leading to increasing stress levels for privacy professionals, according to new ISACA research.
ISACA’s State of Privacy 2025 survey report, reflecting insights from more than 1,600 global professionals worldwide, found that 63 percent of privacy professionals say they are more stressed in their jobs now than five years ago, with 34 percent indicating it is significantly more stressful. They cite the main causes of this stress as the rapid evolution of technology (63 percent), compliance challenges (61 percent) and resource shortages (59 percent).
On the resources front, 43 percent indicate their privacy budget is underfunded, while 48 percent expect a budget decrease in the next year. Respondents find it tough to hire expert-level privacy professionals, with 73 percent indicating they are the most difficult privacy employees to hire.
Other challenges also are straining the privacy landscape. Only 44 percent of respondents are confident that their organization’s privacy team can ensure data privacy and achieve compliance with new privacy laws and regulations. Additionally, only 33 percent of organizations find it easy to understand privacy obligations, with 23 percent considering it difficult.
Respondents provided insights into their most common privacy failures, with lack of training or poor training (47 percent), data breaches (42 percent), and not practicing privacy by design (41 percent) composing the top three.
The ISACA research surfaced several encouraging findings as well. While the median privacy staff size declined slightly from the previous year (eight this year compared to nine the prior), fewer survey respondents reported that their privacy teams are understaffed. This includes technical privacy roles—with understaffing reported at 54 percent in 2024 compared to 46 percent in 2025—and legal/compliance roles—with understaffing reported at 44 percent in 2024 compared to 38 percent in 2025.
Additionally, 74 percent of respondents report privacy strategy is aligned with organizational objectives, and over half (57 percent) believe the board of directors has adequately prioritized their organization’s privacy.
The State of Privacy findings, as in past years, indicate that practicing privacy by design sets enterprises apart. Sixty-seven percent of respondents indicate that they practice privacy by design, the integration of privacy into the entire engineering process, when building applications. The survey found that enterprises that always practice privacy by design are more likely to:
- Have high confidence in their privacy teams (41 percent)
- Believe their technical privacy area is appropriately staffed (50 percent)
- Have decreased privacy skills gaps by training non-privacy staff for privacy roles (57 percent)
- Believe their boards of directors prioritize privacy (80 percent)
More respondents also reported using artificial intelligence (AI) for privacy-related tasks this year (24 percent) than last year (18 percent). The use of AI for this purpose was higher in enterprises that were not compliance-driven, with 14 percent of those in enterprises with boards that viewed privacy ethically or as a competitive advantage using AI for privacy-related tasks, compared with 9 percent from enterprises with boards that view privacy programs as compliance-driven.
Given the changing technology and regulatory landscape, further substantial shifts in the privacy landscape can be expected throughout the new year.
“This year promises to be transformative for privacy professionals,” privacy expert Onur Korucu wrote in a recent ISACA Now blog post. “AI governance, emerging technologies and global regulations will redefine the way we approach data privacy. By embracing adaptable regulations, leveraging technology, fostering a culture of awareness and collaborating globally, we can turn challenges into opportunities.”
For a complimentary copy of the survey report and to access other related content, visit www.isaca.org/state-of-privacy. Access additional privacy-related resources, training and credentials at www.isaca.org/resources/privacy.