Most European Privacy Teams Are Understaffed and Underfunded

More than half of European data protection professionals believe budgets will decline in 2025, while a similar share expects technical privacy teams to remain understaffed, according to ISACA.

The global IT professional association polled 351 members in the region working in privacy, to better understand the challenges the industry faces.

Its State of Privacy in 2025 report revealed that industry professionals are becoming more pessimistic.

Aside from the 54% that expect budgets to decrease in the coming 12 months, nearly half (45%) claimed that their organization’s privacy budget is underfunded, up from 41% the previous year.

Read more on privacy: RSAC: Two-Thirds of Organizations Failing to Address AI Risks, ISACA Finds.

Additionally, the share of respondents claiming their technical privacy teams are short-staffed barely budged, from 53% to 52% over the same period.

These resource challenges appear to be having a concerning impact on security and compliance: less than two-fifths (38%) of European professionals said they’re confident in their organization’s ability to safeguard sensitive data. Just a quarter (24%) claimed to always practice privacy by design, as recommended by the General Data Protection Regulation (GDPR).

Chris Dimitriadis, global chief strategy officer at ISACA, argued that as privacy becomes more critical to business operations, the pressures of the role are rising for those working in key positions.

“Two thirds (66%) of the European professionals working in privacy roles who we spoke to said their job is more stressful now compared to five years ago,” he added. “This is only being exacerbated by continued underfunding. While companies may be making a short-term financial gain, they are putting themselves at long-term risk.”

The major sources of increased stress among industry professionals are compliance challenges, resource shortages and technology innovation, ISACA said.

Wide-Ranging Skills Shortages 

The report revealed the biggest skills gaps as:

• Experience with different types of technologies and/or applications (62%)
• Technical expertise (49%)
• IT operations knowledge (45%)

It claimed that around half (47%) of European organizations are now offering privacy training for non-privacy staff in a bid to alleviate skills shortages.

Nearly three-quarters (73%) of respondents said that expert-level privacy professionals are the most difficult to hire. Yet their expertise is more vital than ever: just 28% of organizations claimed to find it easy to understand their privacy obligations.