2025 Data Protection Professionals Survey: Key Findings

As data protection expectations continue to grow across Europe, we asked privacy professionals in Q4 last year to share how their roles, priorities and challenges are evolving. 

The 2025 Data Protection Professionals Survey provides a clear snapshot of the realities facing privacy teams today, from expanding responsibilities to persistent resourcing challenges. 

Key survey findings at a glance 

Data protection roles remain broad and demanding 

Advisory and governance activities sit at the core of the role, with almost all respondents responsible for providing guidance, embedding data protection into organisational policies, and monitoring compliance. Alongside this, operational work such as privacy notices, training, DPIAs, incident handling, and DSARs continues to absorb significant time and attention.  

Incident management tops the priority list 

Managing privacy incidents and data breaches remains the highest-priority task, closely followed by DSARs, complaints handling, and advisory support. Priority scores are consistently high across all activities, highlighting an environment where many critical tasks compete for attention at the same time. 

AI and cross-border compliance are the hardest areas 

Compliance with the EU AI Act is rated as the most difficult task overall, followed by managing data protection across multiple countries, third-country transfers, data retention enforcement, and DPIAs. These areas combine regulatory complexity with practical implementation challenges. 

Resourcing remains the biggest constraint 

Securing budget for privacy management tools and obtaining executive endorsement continue to be the most significant organisational challenges. Only a minority of respondents report having ownership of a dedicated data protection budget. 

Technology adoption is steady but uneven 

Almost 60% of respondents use specialist software for at least one data protection task, most commonly for structured, repeatable activities such as ROPA management and DPIAs. Adoption is highest in larger organisations. 

Why this matters for data protection team and their organisations 

The findings underline the growing complexity of the data protection function. Privacy professionals are expected to manage high-priority operational work, interpret emerging regulations such as AI legislation, and do so with limited resources and support. 

This article highlights only a small selection of insights. The full report explores differences by role and organisation size, software adoption by task, levels of internal and external support, and what this all means for 2026 readiness.