ISACA Privacy Landscape 2024 Report

Keypoints

• The annual cybersecurity and privacy reports typically include sections such as executive summaries, survey methodology, staffing trends, privacy operations, compliance frameworks, privacy by design, training, breach analysis, and conclusions, offering comprehensive insights into current threats and practices.
• Major statistics reveal persistent understaffing of technical privacy roles, with over half of organizations reporting significant resource gaps, and a notable difficulty in hiring expert-level professionals—a challenge consistent over recent years.
• Trusted privacy frameworks like GDPR (Europe) and NIST Privacy Framework (North America) dominate compliance efforts, with most organizations adopting multiple controls such as encryption, identity management, data security, and incident response to enhance privacy beyond legal requirements.
• Organizations perceive privacy budgets as increasingly underfunded, with a declining trend in expected future funding despite rising privacy obligations driven by over 160 global privacy laws, emphasizing the ongoing resource constraints faced by privacy teams.
• The report notes cautious or limited adoption of artificial intelligence in privacy functions, with many organizations hesitant due to risks, underscoring a strategic stance toward AI’s privacy implications amid understaffing and underfunding pressures.
• Privacy by design remains a best practice, with entities practicing it more likely to have well-resourced teams, robust board support, and aligned organizational strategies, although breaches continue to occur at similar rates regardless of privacy maturity levels.
• Employee training on privacy remains widespread but highlights ongoing issues with training effectiveness and the need for regular review and assessment to prevent common privacy failures, such as insufficient staff awareness and poor incident handling.
• Despite stable breach figures year-over-year, the high percentage of organizations uncertain about breaches points to deficiencies in breach detection, classification, and transparency—highlighting areas for improvement in breach response protocols.
• The report underscores that privacy remains a critical, resource-dependent area, with organizations balancing compliance, operational integration, and emerging technologies amid evolving legal landscapes and budget constraints.