We’re getting the same email over and over right now: we’re planning for 2027, where should we focus? I love this question. It means privacy is being planned for on purpose instead of thrown together after a customer inquires (like my call the other day) or after a privacy failure.
First, the good news. I’ve been shouting from the rooftops for 15+ years that privacy matters. Now I have proof with Cisco’s 2026 Data and Privacy Benchmark Study, which found that 99% of organizations got at least one real benefit from what they spent on privacy, whether that was faster innovation because the data controls were already there, more customer trust, or simply less wasted time because the data was actually organized.
A good return on investment still doesn’t guarantee a budget, though. What gets approved is specific, tied to laws the company has to comply with or a problem that needs solving. I thought I’d share insight into what we’re telling companies to focus on and how to make the case for those resources.
Start with where you are
You can’t put a number on next year until you know where you are today, so start there. When did you last do a full privacy program assessment? If it’s been a year or more, a lot has probably changed; new products, new vendors, new ways you’re using data, maybe a new market, and any of those can bring new rules you now have to follow.
The laws don’t sit still either. We’re at 23 signed state privacy laws as I write this, and I have no idea how many more we’ll have a year from now. Pile on the new AI laws and the constant amendments to the state privacy laws already here, with lower thresholds and broader definitions of sensitive data like health and kids’ data, and something that didn’t apply to you last year might apply now. We also talk to a number of companies that are expanding into new regions like the EU or Canada.
Companies really value an outside read on where their gaps are and a clear roadmap to fix them, and it helps get budget approved. A good assessment gives companies a prioritized list of gaps and the reason each one needs funding, and it lists which privacy domains apply. Think of a privacy program assessment as a strategic roadmap, and without it, companies tend to point and click or just guess.
If you’re starting from scratch
Some companies aren’t fine-tuning anything. Instead, there’s a blank page, no software, no real process, maybe a privacy notice someone wrote years ago and forgot about. If that’s you, don’t aim for perfection in 2027, aim for something.
I see this a LOT. A company that implemented cookie consent software and a privacy notice years ago, and they’ve done nothing since. OR they did a data inventory on systems years ago and have done nothing since. Budget to stand up the basics: a way to handle privacy rights requests, a process for the high-risk things that need a risk assessment, and, before anything else, a data inventory.
Data inventories are the foundation
Once you have the trusty strategic roadmap and a plan in place, we believe the data inventory is where a privacy program starts. You can’t protect, minimize, or make a smart call about data you’ve never mapped, so everything else sits on top of it. It’s why our free Data Inventory Roadmap guide is one of the most popular resources on our site. You don’t need the fanciest tool or a big team on day one; you need to get from zero to a real starting point and build from there, and that’s almost always easier than people think and a lot cheaper than explaining to a regulator why you had nothing.
I really do like software (we implement it all the time), but I’ve truly seen companies go years with nothing because they are still shopping for the right software. Excel is better than zero.
Budget for your risk assessments
I keep talking about PIAs and DPIAs aplenty this year, so I’ll keep this short. Most state laws now require one for high-risk processing, which covers targeted ads, selling data, sensitive or kids’ data, a lot of profiling, and automated decisions, and Louisiana and Oklahoma join that list on January 1, 2027, with Vermont in 2028.
Don’t forget our friends in California, where, under CCPA’s requirements, companies technically should have been doing risk assessments since January 1, 2026. The assessment period ends December 31, 2027, and then the certifications are due to CalPrivacy by April 1, 2028. This is a struggle for companies, and it will take significant involvement from the business to get this done. This has to be a 2027 priority.
Think about what you’ll need to get this underway. Do you have the templates? Do you know what to document? Do you have the people to help with interviews or review them? What about managing the risks and findings? The answers to those questions are going to be your budget.
Software, people, or both?
The things that frustrated your team all year are your best budget data, so look at where the work keeps getting stuck and where the pain points are.
I did just say earlier that for some companies, manual is better than zero. This is true. However, for other companies, it’s time to adjust and implement software. If you’re running privacy on spreadsheets, email, and calendar reminders, software can take a lot off your team’s plate for data inventory, rights requests, PIAs, vendor risk, and cookie consent.
Two things before you buy, though. When you price a tool, price all of it: the license, the setup, the actual interviews and documentation, plus review of each activity. Then factor in the person who keeps it running, and the time it takes to implement it, because most companies take six to twelve months to go from buying a tool to actually using it. If you want it to go live in 2027, you’ll need to get it in this year’s budget.
Not everything is a software problem, though. When business teams keep asking you the same questions, that’s usually a training or process fix, not a platform; questions about the law itself might mean seeking outside counsel; and if the work has simply outgrown your team, maybe it’s time to budget for another person.
Audit what you’ve got
Your policies say how the program is supposed to work. Audits tell you if it actually does, which is what a regulator cares about. These are the ones we’re running for clients that have been the most useful:
Share the cost
Meet with your security friends. Last week, I talked about how privacy and security are like peanut butter and jelly. We see a lot of security teams owning privacy or sometimes just the software. There is so much overlap with what privacy, security, and third-party risk teams need, since they’re coming at the same problem from different sides. Vendor assessments are the obvious example: privacy needs to know how a vendor uses the data and security needs to know how they protect it, so when one tool answers both, a shared ask creates a single investment that solves two problems instead of two teams fighting over the same (always too small pile of) dollars.
Look at AI governance the same way, because the privacy tools you already own can often track AI use and run AI assessments too, which means part of what you were about to ask for may already be sitting in your stack. Maybe there’s a shared software or people resource that can help all these functions reach their goal.
Make the case
Privacy’s budget is just one of many. It’s competing with new product features, service offerings, marketing spend, HR activities, headcount, and the list goes on. Each department really needs whatever is on their list. The privacy budget and presentation has to come with evidence to get leadership to recognize that Privacy Matters. Consider these tips to win your budget case:
- Lead with your program assessment findings, so the biggest risks get prioritized first.
- Tie every request to a specific law and deadline, like finishing CCPA risk assessments for existing high-risk processing by December 31, 2027.
- Show how privacy helps marketing, sales, and finance do their jobs, instead of getting in the way.
- Emphasize how privacy is helping bolster security, AI, legal, and third-party risk teams.
- Quantify the hours your team loses to manual work, plus request volumes and response times.
- Show the full cost of each item, from the license and setup to maintenance and internal time, so nothing surprises anyone later.
- Rank everything, and separate what you’re legally required to do from what just makes you more efficient, so if the budget gets cut, you decide what goes.
- Consider a visual – pictures really are more than 1,000 words.
If you haven’t already, start the conversation now, while there’s still room in the budget and time to make your case. This is privacy’s opportunity to get the resources it rightfully deserves, all in the name of not only privacy compliance but also customer trust.
Wishing you a great week!
Jodi
💡 When you’re ready, here’s how we can help:
⚙ Privacy Advisory & Implementation: We help companies navigate privacy requirements with confidence. Our advisory support covers strategy, operations, and real-world implementation.
⚙ Fractional Privacy Services: We provide fractional privacy leadership tailored to your needs and pace. From program development to day-to-day support, we help you build and sustain a strong privacy program.