93% of organizations plan to put more money into privacy over the next two years, according to Cisco's 2026 Data and Privacy Benchmark Study of more than 5,200 IT, technology, security, and privacy professionals. That broad intent sits oddly next to a narrower reality: only 22% of privacy professionals surveyed separately by ISACA expect their own budget to grow this year, and half expect a cut.
The two figures are not a contradiction so much as two different questions answered by two different populations. This post walks through what each survey actually measured, why the numbers diverge so sharply, and what a business without a dedicated privacy budget at all can still do to close the basic compliance gap.
What percentage of firms plan to increase their privacy budget in 2026?
Cisco's 2026 Data and Privacy Benchmark Study, fielded across more than 5,200 respondents in 12 markets in September 2025 and independently analyzed by Sandpiper Research & Insights, found that 43% of organizations already increased privacy spending over the past 12 months. Looking ahead, 93% plan to allocate more resources to at least one privacy or data-governance area over the next two years, a figure that covers organizations of every size across a broad cross-section of industries and job functions, not privacy teams alone.
Figure 1: Nearly all surveyed organizations expect to spend more on privacy soon, even though fewer than half have done so yet. Source: Cisco 2026 Data and Privacy Benchmark Study.
Cisco's own data ties much of that forward intent to AI governance: 90% of surveyed organizations said their privacy program expanded because of AI, and the share of organizations spending $5 million or more a year on privacy nearly tripled, from 14% to 38%, in a single reporting cycle. When a survey asks IT, security, and business leaders broadly whether their organization intends to spend more on privacy somewhere, the answer is close to universal.
Do individual privacy professionals expect their own budget to grow?
Ask privacy professionals directly about their own team's budget, and the answer looks different. ISACA's State of Privacy 2026 survey of more than 1,800 privacy professionals worldwide, published in January 2026, found that only 22% expect their own budget to increase in 2026, down from 26% who said the same a year earlier. Half of respondents expect their budget to shrink over the next 12 months, and just 2% expect it to hold flat.
Figure 2: Optimism about a personal budget increase is fading year over year. Source: ISACA State of Privacy 2026 survey.
The remaining roughly one in four respondents, beyond the 22% expecting an increase, the 50% expecting a decrease, and the 2% expecting no change, did not give a clear directional answer, which itself signals a more uncertain planning environment than Cisco's organization-wide numbers suggest. Whichever way this pans out, a shrinking or flat budget for most individual privacy teams is a very different story than the 93% figure a business owner might see quoted in a headline.
Why is there a gap between company-wide intent and privacy-team reality?
The gap comes down to who answered the question. Cisco surveyed IT, security, technology, and privacy leaders broadly across 12 markets, capturing organization-wide intent to spend more on privacy somewhere, often as part of a larger AI governance push. ISACA surveyed privacy professionals specifically about their own team's budget, and that population reported both a staffing squeeze (median team size fell from 8 people in 2025 to 5 in 2026) and a funding squeeze at the same time.
Figure 3: Two surveys, two populations, two different answers to what looks like the same question. Source: Cisco 2026 Data and Privacy Benchmark Study, ISACA State of Privacy 2026 survey.
A business that has been hiring a bigger AI governance function while its core privacy headcount stays flat or shrinks could accurately answer both surveys the same way: yes, we are spending more on privacy-adjacent work overall, and no, the dedicated privacy team's own line item has not grown. For a business without a dedicated privacy team at all, a privacy policy generator covering the disclosures regulators and privacy-conscious visitors check first is a lower-cost starting point than assuming enterprise-scale budgeting is a prerequisite for basic compliance.
How many firms call their privacy budget insufficient?
Set the increase-versus-decrease question aside and ask professionals to simply rate their current budget, and ISACA's 2026 survey found 43% call it underfunded while only 36% call it appropriately funded. The remaining share gave another answer or no clear rating.
Figure 4: More privacy professionals call their budget insufficient than call it sufficient. Source: ISACA State of Privacy 2026 survey.
That underfunded reading lines up with the staffing data from the same survey: a team that shrank from a median of 8 people to 5 in a single year is a team more likely to describe its resources as inadequate, regardless of what happens to the dollar figure on paper. A budget can technically hold flat in dollar terms and still feel like a cut once a growing set of AI-related disclosure and governance tasks lands on a smaller team.
What share of firms say budget constraints limit their privacy or governance work?
IAPP's 2025 Organizational Digital Governance Report, based on a 74-question survey of more than 600 individuals across 45 countries and territories fielded between April and June 2025, found that 48% of respondents say finance or budget constraints limit their organization's ability to address digital governance issues properly. The report covers digital governance broadly, including privacy, AI governance, and cybersecurity governance together, so this figure should be read as a governance-wide constraint rather than a privacy-only one.
Even read that broadly, a figure close to half is a meaningful signal alongside ISACA's narrower 43% underfunded reading for privacy specifically. Two different survey populations, asked two differently worded questions, land in roughly the same range: something close to half of organizations working on governance-adjacent compliance say money is the limiting factor.
How do the 2026 budget-intent figures compare across surveys?
| Metric | Figure | Source | Year |
|---|---|---|---|
| Plan to increase privacy spend (next 2 yrs) | 93% | Cisco 2026 Data and Privacy Benchmark Study | 2026 |
| Already increased privacy spend (past 12 mo) | 43% | Cisco 2026 Data and Privacy Benchmark Study | 2026 |
| Expect personal budget to increase in 2026 | 22% | ISACA State of Privacy 2026 survey | 2026 |
| Expect personal budget to decrease in 2026 | 50% | ISACA State of Privacy 2026 survey | 2026 |
| Cite budget constraints limiting governance work | 48% | IAPP 2025 Organizational Digital Governance Report | 2025 |
Table 1: The same underlying question, answered by different survey populations, produces figures ranging from 22% to 93%. Source: Cisco, ISACA, and IAPP, as cited above.
Read across the row, the honest answer to "what percentage of firms budget for privacy" depends entirely on which population and which time horizon a survey is measuring. Broad, forward-looking, cross-functional intent sits near universal. Narrow, personal, current-year expectation among the people who actually run privacy teams sits well under half.
How has privacy budget intent changed since GDPR took effect?
Privacy spending intent has moved through several distinct phases since the first major wave of privacy regulation.
Figure 5: Regulatory milestones and survey editions that shaped 2026's conflicting budget-intent numbers. Source: Cisco 2026 Data and Privacy Benchmark Study, ISACA State of Privacy 2026 survey, IAPP-EY Privacy Governance Report 2024.
The Bottom Line
There is no single percentage that answers what share of firms budget for privacy, because the surveys asking the question are measuring different things. Cisco's cross-functional, 12-market survey finds 93% of organizations plan to spend more on privacy somewhere over the next two years, largely driven by AI governance work landing on existing compliance teams. ISACA's privacy-professional-only survey finds just 22% expect their own team's budget to grow this year, with 50% expecting a cut and 43% already calling their budget underfunded. Both figures are accurate descriptions of what they measured. For a small or mid-size business trying to plan its own privacy spending, the more useful takeaway is that broad industry-level optimism about privacy investment does not automatically translate into a bigger budget for any individual privacy team, and budgeting decisions should be made against your own compliance obligations rather than a headline percentage from either survey.
Frequently Asked Questions
What percentage of firms plan to increase their privacy budget in 2026? 93% of organizations plan to allocate more resources to at least one privacy or data-governance area over the next two years, and 43% already increased privacy spending in the past 12 months, according to Cisco's 2026 Data and Privacy Benchmark Study of more than 5,200 professionals across 12 markets.
Do privacy professionals expect their own budget to grow in 2026? Not most of them. Only 22% of privacy professionals expect their own budget to increase in 2026, down from 26% in 2025, while 50% expect a decrease, according to ISACA's State of Privacy 2026 survey of more than 1,800 privacy professionals.
What percentage of firms call their privacy budget underfunded? 43% of privacy professionals describe their current budget as underfunded, versus 36% who call it appropriately funded, per ISACA's State of Privacy 2026 survey.
How many firms say budget constraints limit their privacy or governance work? 48% of digital governance leaders say finance or budget constraints limit their ability to properly address governance issues, including privacy, according to IAPP's 2025 Organizational Digital Governance Report, based on responses from more than 600 professionals in 45 countries.
Where the Numbers Come From
- Cisco. (2026). "2026 Data and Privacy Benchmark Study." Survey of 5,200-plus IT, technology, security, and privacy professionals across 12 markets, fielded September 2025, independently analyzed by Sandpiper Research & Insights, accurate to within plus-or-minus 1 percentage point at a 95% confidence level. 43% increased privacy spending in the past 12 months; 93% plan to allocate more resources to at least one privacy area over the next two years; 38% now spend $5 million or more a year, up from 14% a year earlier; 90% report AI-driven program expansion.
- ISACA. (2026). "State of Privacy 2026 Survey." More than 1,800 privacy professionals surveyed globally, published January 2026. 22% expect a personal budget increase in 2026 (down from 26% in 2025); 50% expect a decrease; 2% expect no change; 43% call their current budget underfunded and 36% call it appropriately funded; median privacy team size fell from 8 in 2025 to 5 in 2026.
- IAPP. (2025). "Organizational Digital Governance Report." A 74-question survey of more than 600 individuals across 45 countries and territories, fielded April to June 2025, published November 12, 2025. 48% say finance or budget constraints limit their organization's ability to address digital governance issues, including privacy, properly.
Note: All figures verified as of August 2026. Cisco and ISACA figures are current as of their respective 2025-2026 fieldwork windows; IAPP's figure covers digital governance broadly rather than privacy alone. Figures are refreshed at least twice a year to track new survey editions.
