Hiring privacy experts is tough — here’s why – Source: www.csoonline.com

The demand for privacy professionals is soaring, but hiring an expert in this field is proving to be a significant challenge. According to ISACA’s State of Privacy 2025 survey, 73% of organizations indicate that “expert-level” privacy professionals are the most difficult to hire. The results reflect the insights of more than 1,600 privacy professionals worldwide. The reasons behind this shortage are complex, spanning unrealistic job expectations, budget constraints, and the evolving nature of privacy itself.

What do privacy professionals do?

Responsibilities vary widely depending on the organization’s structure and industry, making hiring difficult due to the diversity of roles within the privacy field. Safia Kazi, ISACA principal, privacy professionals practices, explains how some privacy professionals are legal and compliance-focused, such as ensuring whether an organization is adhering to regulations like GDPR, conducting privacy impact assessments, developing privacy policies, and advising on what data can and cannot be collected, used, or shared. Others, she says, can take on more technical roles, working in data science, where they assess which data qualifies as personal information, build privacy-enhancing technologies, or design systems that minimise data collection.

There are also privacy professionals who can be embedded in software development teams, Kazi says, pointing to how they could be responsible for integrating privacy by design principles into products and systems from the ground up. Privacy expertise is increasingly expected in user experience and user interface design, where professionals ensure that privacy choices are clear and free from deceptive patterns. “For the most part, people fall into one or potentially both technical or legal and compliance privacy,” she says.

The nature of privacy work also varies by country, which adds another layer of complexity. “The privacy space is largely underpinned by legislation, which varies from country to country. Cybersecurity, on the other hand, tends to revolve around technology, and as a result is more agnostic and universal,” Michael Trovato, managing partner at IIS and former EY cybersecurity lead partner, says. “You can take a cybersecurity expert in Australia and the US, and they would have similar conversations about cybersecurity,” but when it comes to discussion about privacy, it’s quite different and there’s a real disconnect, he adds.

Why it is difficult to hire privacy experts

Finding a highly skilled privacy professional can feel like chasing a unicorn, Kazi describes. “Yes, privacy is important, but they want somebody who’s a lawyer, an expert in technology, knowledgeable about user interface and user experience, and ideally, they know a lot about ethics and are an AI expert as well. And yet, the position does not pay very much. That’s a serious challenge,” she says.

Adding to the problem, 43% of organizations report their privacy budget is underfunded, and 48% expect budget cuts in 2025. A key issue is that many organizations conflate privacy with security, assuming that funding one automatically covers the other. Kazi warns against this misconception, especially when cybersecurity professionals are just as – if not more – burned out and understaffed.

“Some organizations think, ‘Well, we’re funding security, and privacy is basically the same thing, right?’ And I think that’s really one of my big concerns,” she says.

This blending of responsibilities is reflected in training practices, according to Kazi, who notes how many organizations combine security and privacy training, which isn’t inherently problematic, but it carries risks. “One of the questions we ask in our survey is, ‘Do you combine security training and privacy training?’ Some organizations say they do not necessarily see it as a bad thing, but you can … be doing security, but you’re not doing privacy. And so that’s what’s highly concerning is that you can’t have privacy without security, but you could potentially do security well without considering privacy.”

As Trovato emphasizes, “cybersecurity people tend to be from Mars and privacy people from Venus”, yet he also observes how privacy and cybersecurity professionals are often grouped together, adding to the confusion about what skills are truly needed. “The people having the discussion about privacy tend to be over here in the security space and so they just make confidentiality equal privacy, but of course that’s not privacy,” he says.

“Privacy includes how are we using data, how are you collecting it, who are you sharing it with, how are you storing it — all of these are more subtle component pieces, and are you meeting the requirements of the customer, of the regulator, so it’s a much more outward business focus activity day-to-day versus we’ve got to secure everything and make sure it’s all protected.” 

What CISOs need to know about hiring privacy talent

Even when companies find qualified privacy professionals, retaining them is another challenge. The ISACA report found that 63% of privacy professionals say their role is more stressful now than five years ago. Rapid technological evolution (63%), compliance challenges (61%), and resource shortages (59%) were cited as key stressors.

Given these challenges, how can organizations successfully hire privacy professionals? Kazi suggests that companies need to take a more strategic approach.

“What organizations need to do is figure out their biggest need with this privacy role. Do we need somebody who knows our applications really well? If that’s the case, there might be someone at your organization who has helped develop or acquire those, and perhaps you can provide them with on-the-job training and encourage them to obtain some privacy-related certifications,” she says. “That way, they have the technical expertise you’re looking for, and you can teach them the privacy aspect. This way, you’re not posting a job and potentially spending a long time trying to find the right person. I think looking internally can be really helpful.”

Greater internal collaboration is also crucial — not just for improving privacy operations but for attracting and retaining talent. ISACA’s report found that only one-third of privacy professionals regularly work with product and business development teams.

“Make sure that you are facilitating privacy by design as soon as possible,” advises Kazi. “If you’re embarking on a new initiative, invite someone from the privacy team to the kick-off meeting so they’re included. Ultimately, this ensures that privacy is better embedded into projects, and the privacy team’s work becomes much easier because they’re not coming in at the last minute saying, ‘We can’t do this’ or ‘We need to revise this’. Instead, their work is more integrated and aligned with other business objectives.”

Trovato agrees, pointing out that there is an opportunity for privacy professionals to help build out what he dubs as the “operational aspects of privacy”. He says that privacy professionals should not just be seen as compliance enforcers but should be going beyond policies and frameworks to influence leadership, culture, and organizational resilience — and ensure privacy is integrated in both business processes and broader security efforts.