Data Privacy Statistics Guide: Complaints, Breach Reports and Enforcement Trends

Privacy figures turn up in every board paper and vendor deck, but few of them say who measured what, when, and among whom. This page gathers data privacy statistics that trace to a named publisher: public attitudes from the Pew Research Center and the EU Agency for Fundamental Rights (FRA), regulator workload from the UK Information Commissioner's Office (ICO) and the European Data Protection Board (EDPB), and organisational spending and AI governance from Cisco's Data Privacy Benchmark Studies for 2025 and 2026. Fine totals and the largest penalties are deliberately left to the companion GDPR Fines and Enforcement Statistics page, so this one covers the rest of the privacy picture: what people think, what regulators handle and what organisations spend. It is for privacy leads, DPOs, CISOs and security teams that own personal data controls and need numbers they can defend. Last reviewed: November 2026.

Key takeaways

• People feel they have lost control. 73% of US adults feel they have little or no control over the data companies collect about them, and 67% understand little or nothing about what companies do with it (Pew Research Center, survey of May 2023).
• Complaints to regulators are rising fast. The UK ICO received 76,743 data protection complaints in 2025/26, up from 42,315 the year before, and 17,431 personal data breach reports, up from 12,412 (as reported from the ICO Annual Report 2025/26).
• Cross-border GDPR work is heavy. The EDPB recorded 1,299 one-stop-shop procedures under Article 60 GDPR in 2025, 572 of which led to final decisions, and 414 new cross-border cases (EDPB Annual Report 2025).
• AI is pushing privacy budgets up. 90% of organisations say their privacy programme expanded because of AI, and 38% spent USD 5 million or more on privacy in the past 12 months, up from 14% in early 2025 (Cisco 2026 Data and Privacy Benchmark Study).
• AI governance is mostly immature. Three in four organisations have a dedicated AI governance committee, but only 12% describe it as mature and proactive (Cisco 2026).

How to read privacy statistics

• Attitude versus behaviour: people who say they are concerned still click "agree" without reading. Pew found both at once. Use attitude figures to justify transparency, not to predict churn.
• Complaints are not breaches: most data protection complaints concern rights handling (access, erasure, marketing), not security failures. Breach report counts are a separate series.
• Vendor surveys: both Cisco studies are run by a company that sells privacy and security products. They are widely cited and recur annually, which makes them useful for trends, but they are single-vendor surveys.

Public attitudes and trust

• Concern is bipartisan: concern among Republicans about government data use rose from 63% to 77% between 2019 and 2023, while Democrats held steady, according to Pew.
• Awareness in Europe: FRA's Fundamental Rights Survey (2020) found 69% of people in the EU-27 had heard of the GDPR. FRA's 2024 report notes awareness does not mean understanding, pointing to the large number of trivial or unfounded complaints regulators receive.
• Organisations agree on the stakes: in Cisco's 2025 study, 95% of respondents said customers will not buy from them if data is not properly protected, and 90% agreed strong privacy laws make customers more comfortable sharing data with generative AI tools.
• Transparency is the lever: in Cisco's 2026 study, 46% ranked clear information about how data is collected and used as the most effective way to build customer confidence, against 18% for demonstrating compliance and 14% for avoiding breaches.

Regulator workload and complaints

• An 81% jump in UK complaints: a near doubling in one year means the regulator will triage harder. Organisations whose own complaint handling fails are more likely to see the complaint escalate. Fix your request handling before the regulator asks.
• Breach reports up about 40%: 17,431 against 12,412 is a rise of about 40% (our calculation from the reported figures). Some of that is over-reporting of low-risk incidents. UK GDPR Article 33 requires notification within 72 hours unless the breach is unlikely to result in a risk to individuals, so a documented risk assessment for every incident is the control that keeps reporting proportionate.
• Coordinated enforcement on erasure: the EDPB launched its 2025 Coordinated Enforcement Framework action on the right to erasure. Expect regulators to test whether deletion actually reaches backups, logs and processors.
• Resources lag workload: FRA's interviews found an overwhelming majority of regulator staff described rising workloads, and a large majority called inadequate financial and human resources a major obstacle. Slow decisions are not the same as no decisions.

Organisational spending and privacy programmes

• Spending has shifted to AI: the sharp rise in USD 5 million plus budgets coincides with 90% expanding programmes because of AI. Privacy and AI governance budgets are converging, which is where security teams often pick up the work. See the AI and Privacy Guide.
• Restriction gave way to enablement: the fall from 28% to 7% in outright bans or data entry limits means more personal data now reaches generative AI tools. Controls have to move from blocking to monitoring and classification. See the Shadow AI Statistics page.
• Staff already paste personal data: in Cisco's 2025 study, 64% worried about inadvertently sharing sensitive information through generative AI and nearly half admitted entering personal or non-public data into those tools.

Cross-border data and localisation

The figures are contradictory on purpose: respondents want data kept local and also trust global providers more. In practice this shows up as regional hosting inside global cloud platforms, with transfer impact assessments and key control kept in-region. International transfers sit behind several of the largest GDPR fines, which the GDPR Fines and Enforcement Statistics page lists.

Where identity fits

Privacy complaints and breach reports often trace back to access: an employee or service account that could read records it did not need, or an API key that exposed a customer table. Rights requests also depend on identity, since you cannot answer an access or erasure request reliably if you cannot find every system and account that holds the person's data. Two practical links between the numbers and identity controls:

• Access to personal data stores: restrict and review which human and non-human identities can read personal data, and log that access. See the Privacy Programme Guide for Security Teams.
• Machine credentials: in our view at NHI Mgmt Group, leaked tokens and keys to data stores can give direct access to personal data, so secrets management belongs in the privacy programme.

What the numbers mean for defenders

1. Map personal data first: rights requests, erasure checks and breach risk assessments all fail without a data inventory. Start with systems that hold special category data.
2. Industrialise rights handling: with complaints to the ICO rising 81% in a year, measure request turnaround and fix backlogs. See the DSAR Guide.
3. Prove erasure reaches everywhere: test deletion through backups, logs, analytics and processors ahead of coordinated enforcement on erasure.
4. Make breach notification proportionate: keep a documented risk assessment template and a 72-hour clock in the incident runbook. See the Data Breach Notification Checklist.
5. Govern AI data flows: classify what may be entered into generative AI tools, monitor use rather than relying on bans, and give the AI governance committee real decision rights.
6. Write transparency for people, not lawyers: with 69% of US adults seeing policies as something to get past, layered notices and just-in-time explanations are the evidence-backed fix.

Metrics to track

• Rights request turnaround: median days to complete access and erasure requests, against the one-month statutory deadline under GDPR Article 12(3).
• Complaints escalated: number of complaints that reached a regulator, and the share upheld.
• Breach decisions on time: percentage of incidents with a documented notify or do-not-notify decision within 72 hours.
• Inventory coverage: share of systems holding personal data that are in the record of processing with an owner.
• AI data exposure: monthly count of blocked or flagged personal data submissions to generative AI tools.

Common failure patterns when using privacy statistics

• Quoting US attitudes as global: Pew figures are US adults only; FRA's 69% awareness figure is EU-27 and from 2020.
• Counting complaints as breaches: ICO complaint and breach report figures are separate series and should never be added.
• Comparing Cisco editions without the sample: the 2026 study has roughly twice the respondents of 2025, so small changes may be sample effects.
• Treating practitioner surveys as customer views: Cisco respondents are privacy professionals describing their own organisations.
• Using fine totals as a proxy for privacy risk: most enforcement work is complaints and procedures, not fines. Keep fines and workload figures apart.

Practitioner checklist

• Quote every figure with publisher, edition, period and population.
• Maintain a personal data inventory with owners for each system.
• Measure and report rights request turnaround monthly.
• Test erasure end to end, including backups, logs and processors.
• Keep a breach risk assessment template and a 72-hour notification clock in the incident runbook.
• Set a written policy on personal data in generative AI tools and monitor it.
• Review access by human and non-human identities to personal data stores quarterly.
• Refresh this page's figures when the ICO, EDPB, Pew and Cisco publish new editions.

Standards and references

• EDPB: Annual Report 2025, executive summary
• ICO: Information Commissioner's Annual Report 2025/26, a year in review
• FRA: GDPR in practice, experiences of data protection authorities
• Pew Research Center: How Americans View Data Privacy
• Cisco: 2026 Data and Privacy Benchmark Study
• Cisco: Building Trust in the Age of AI (2025 Data Privacy Benchmark Study)
• LexisNexis: ICO publishes annual report 2025/26
• Freevacy: ICO publishes 2025/26 annual report

Related NHI Mgmt Group resources: GDPR Fines and Enforcement Statistics · Data Breach Statistics Guide · Privacy Programme Maturity Model · DSAR Guide