$375,000 Median Privacy Budget 2026: Spend by Company Size

The median privacy program budget held at $375,000 for a third consecutive year in the IAPP-EY Privacy Governance Report 2024, while the average budget across the same companies climbed to $1,751,866. That gap between median and mean is the story: privacy spend is not spread evenly across company sizes, it is concentrated in a shrinking number of large programs while the typical mid-size budget stays flat.

This post breaks down what companies actually spend on privacy by size, what is driving the gap between small budgets and mega-budgets, and where 2026's forecasts point next.

What is the average privacy budget in 2026?

The most recent published figure is $1,751,866, from the IAPP-EY Privacy Governance Report 2024 (published December 2024, the latest edition with a dollar figure to date). That average rose more than $150,000 from the prior year's $1.599 million, continuing a multi-year climb even as the median budget in the same survey stayed completely flat.

Figure 1: The average privacy budget rose $150,000+ in one year even as the median held flat. Source: IAPP-EY Privacy Governance Report 2024.

An average pulled upward by a small number of very large budgets is exactly what shows up when a handful of Fortune 500-scale privacy programs report multi-million-dollar spend inside a survey pool that also includes far smaller mid-size companies. That is why the median, not the average, is the more representative number for a typical mid-size organization sizing its own budget.

What is the median privacy budget, and why has it not moved?

The median privacy program budget is $375,000, and it has been exactly $375,000 for three straight survey years running: 2022, 2023, and 2024, per IAPP-EY. A flat median next to a rising average over the same period means new privacy spend is landing disproportionately at the top of the distribution rather than lifting the typical program.

That $375,000 figure is a useful planning anchor for a typical mid-size privacy program covering a core headcount plus tooling and outside counsel, but it undercounts what the largest organizations spend by nearly 5x against the survey's own average. A single company at the high end of the distribution can carry a budget many times the median, while dozens of smaller programs sit well under it, and the median stays put because it reflects the middle of the distribution, not the shape of its tail.

How does privacy spend differ by company size?

The clearest company-size gap in the data comes from early GDPR compliance-cost research rather than a 2026 survey, and it should be read as a historical implementation-era baseline, not a current run rate. Estimates cited in FTC-hosted academic literature on GDPR's first year (Hughes and Saverice-Rohan, 2018, building on 2018 Accenture compliance-cost survey data) put annual compliance cost at roughly $1.7 million for small and mid-size businesses, rising to roughly $70 million for large enterprises, a gap of close to 40x by company size.

Figure 2: A roughly 40x cost gap between small and large organizations, from GDPR's 2018 implementation year. Source: Hughes and Saverice-Rohan (2018), cited in FTC-hosted GDPR research literature.

That 40x gap is not primarily headcount cost scaled linearly. Large enterprises carry far more data processing surfaces, more jurisdictions, more vendor contracts to renegotiate, and more legacy systems to remediate, so their compliance cost scales faster than their size. A small business with a single product and a handful of vendors faces a fundamentally smaller compliance surface than a multinational with dozens of business units, which is part of why a generic enterprise compliance checklist tends to over-scope what a small site actually needs. Businesses sizing their own privacy budget from scratch can start with a privacy policy generator built to scale disclosure requirements to what the business actually collects, rather than budgeting for enterprise-grade compliance overhead on a small-business footprint.

Are privacy budgets increasing or decreasing in 2026?

Sentiment has turned more cautious. Only 22% of privacy professionals expect their budget to increase in 2026, down from 26% who expected an increase in 2025, according to ISACA's State of Privacy 2026 survey of more than 1,800 privacy professionals worldwide (published January 2026). Half of respondents expect their budget to shrink over the next 12 months, and just 2% expect it to hold flat.

Figure 3: Optimism about budget growth is fading year over year. Source: ISACA State of Privacy 2026 survey.

That caution is paired with a staffing squeeze rather than a workload drop: the same ISACA survey found the median privacy team size fell from 8 people in 2025 to 5 in 2026, even as 43% of respondents already describe their current budget as underfunded and only 36% call it appropriately funded. Fewer people and a flatter or shrinking budget, against a legal landscape that keeps adding new state privacy laws, is the tension defining privacy programs heading into the rest of 2026.

Figure 4: More than four in ten privacy professionals call their current budget underfunded. Source: ISACA State of Privacy 2026 survey.

Where does the money actually go, and is it increasing anywhere?

Despite flat-to-shrinking budgets in the ISACA data, spend intent is rising elsewhere: Cisco's 2026 Data and Privacy Benchmark Study, fielded across more than 5,200 IT, security, and privacy professionals in 12 countries in September 2025, found that 43% of organizations increased privacy spending over the past year and 93% plan to allocate more resources to at least one privacy or governance area over the next two years. The number of organizations spending at the very top of the range has nearly tripled: 38% spent $5 million or more on privacy in the past 12 months, up from just 14% a year earlier.

Figure 5: High-end privacy spend has nearly tripled in one year. Source: Cisco 2026 Data and Privacy Benchmark Study.

Cisco's own analysis attributes much of that top-end surge to AI governance work layering on top of existing privacy compliance spend, with 90% of surveyed organizations reporting they are expanding data privacy programs specifically to manage AI-related data risk. That is a company-size story on its own: AI governance tooling and dedicated review processes are the kind of new line item that a large enterprise privacy team can absorb inside an eight-figure budget far more easily than a five-person mid-size team working from a flat $375,000. For a fuller breakdown of that same $5 million-plus spending tier and how it splits against DPO salary benchmarks, see the cost of privacy compliance in 2026.

How do 2026 budget figures compare across sources?

Metric	Figure	Source	Year
Median privacy program budget	$375,000	IAPP-EY Privacy Governance Report	2024 (flat since 2022)
Average privacy program budget	$1,751,866	IAPP-EY Privacy Governance Report	2024
Organizations spending $5M+ annually	38%	Cisco Data and Privacy Benchmark Study	2026
Small/mid-size business GDPR compliance cost (historical)	~$1.7 million/year	Hughes and Saverice-Rohan, cited via FTC-hosted research	2018

The IAPP-EY figures remain the most current dollar-denominated median and average available for privacy programs broadly. Cisco's 2026 study is the freshest large-sample data point but reports year-over-year change and spend tiers rather than a fresh median or average in dollars. The GDPR-era $1.7 million versus $70 million company-size comparison is the most directly size-segmented figure available, but it is nearly eight years old and should be treated as a historical baseline from GDPR's implementation year, not current 2026 spend.

The Bottom Line

A $375,000 median next to a $1.75 million average tells you privacy budgets are not scaling smoothly with company size: a relatively small number of large organizations, many of them now layering AI governance spend onto existing compliance budgets, are pulling the average far above what a typical mid-size program actually spends. If you run a small or mid-size business, the historical company-size data still points to something like a 40x gap in compliance cost between your scale and enterprise scale, which means budgeting against enterprise benchmarks will badly over-scope what you actually need. The more useful anchor is the flat $375,000 median, adjusted down further for a business with a narrower data footprint, paired with tools that scale documentation to what you actually collect rather than to enterprise-grade assumptions.

Frequently Asked Questions

What is the average privacy program budget in 2026? $1,751,866 on average, according to the IAPP-EY Privacy Governance Report 2024, the most recent edition with a published figure. The median budget across the same respondent pool is far lower, at $375,000, because a small share of very large programs pull the average upward.

What is the median privacy budget for a mid-size company? $375,000, and it has held at exactly that figure for three straight survey years (2022, 2023, and 2024), per IAPP-EY. That flat median, next to a rising average, points to spend concentrating in a shrinking group of large organizations rather than spreading evenly.

How much does GDPR compliance cost a small business versus a large enterprise? Around $1.7 million a year for small and mid-size businesses versus roughly $70 million a year for large enterprises, per the compliance-cost estimates cited in FTC-hosted academic research on GDPR's first year (Hughes and Saverice-Rohan, 2018). Those figures date to GDPR's 2018 implementation year and reflect one-time and ongoing compliance combined, not a current 2026 run-rate.

Are privacy budgets going up or down in 2026? Down, on balance. Only 22% of privacy professionals expect their budget to increase in 2026, down from 26% in 2025, while 50% expect a decrease, according to ISACA's State of Privacy 2026 survey of more than 1,800 privacy professionals.

Where the Numbers Come From

1. IAPP. (2024). "Privacy Governance Report 2024," produced with EY. Median budget $375,000 (flat since 2022), average budget $1,751,866, up from $1.599 million in 2023. Published December 2024.
2. Cisco. (2026). "2026 Data and Privacy Benchmark Study." 5,200+ respondents across 12 markets, fielded September 2025, independently analyzed by Sandpiper Research and Insights, statistical validity of plus or minus 1 percentage point at a 95% confidence level. 38% spent $5 million or more on privacy in the past year, versus 14% the prior year; 43% increased spend year over year; 93% plan to increase spend in at least one privacy area over the next two years.
3. ISACA. (2026). "State of Privacy 2026 Survey." More than 1,800 privacy professionals surveyed globally. 22% expect a budget increase in 2026 (down from 26% in 2025), 50% expect a decrease, 43% call their current budget underfunded, median privacy team size fell from 8 in 2025 to 5 in 2026. Published January 2026.
4. Federal Trade Commission-hosted research citing Hughes and Saverice-Rohan (2018) and Accenture (2018) survey data on GDPR compliance costs. Estimated roughly $1.7 million per year for small and mid-size businesses and roughly $70 million per year for large enterprises during GDPR's 2018 implementation period.

Note: All figures verified as of July 2026. The IAPP-EY dollar figures are the most recent published edition (December 2024) as of this post's writing; the 2026 edition had not yet published a budget figure at the time of research. The GDPR-era small business versus large enterprise cost comparison is an implementation-year (2018) estimate and is presented as historical context, not current 2026 spend. Budget figures are refreshed at least twice a year as newer survey editions publish.