A Letter from the Authors

The scale and speed at which data is used today has fundamentally changed the challenge of protecting it. AI is now driving how software is built. As development, analytics, and agentic initiatives expand, they are creating more data, across more environments, with more teams accessing it.

In our third annual State of Data Compliance and Security Report, we expanded our global survey from 280 to 518 enterprise leaders. Our goal in doing this was to increase representation globally across application development, IT operations, security and compliance, and data engineering and analytics leaders. We wanted to provide an even more comprehensive picture of the state of data compliance in 2026.

This year’s data highlights a set of consistent and measurable gaps between the confidence leaders have in their organization’s ability to protect sensitive data and how it plays out in practice.

There’s a clear disconnect between policy and enforcement. 99% of organizations report having data masking mandates in place, yet 84% still allow compliance exceptions. At the same time, confidence does not reflect outcomes. While 98% of leaders also say they are confident in protecting sensitive data, 43% have experienced audit failures and 34% have experienced breaches or theft in non-production.

The same pattern holds in AI. 86% of organizations report having AI data privacy mandates, and 98% express confidence in their ability to protect sensitive data in AI workflows. Yet 68% are concerned about data leaks and 62% about training data breaches.

By reading this report, you will gain a clearer understanding of where these gaps exist, which data protection practices are breaking down in practice, and where organizations are prioritizing change.

Continue reading the report in full, or use the navigation on the left to jump to a specific section.

Sincerely,

Ann Rosen, Ross Millenacker, and Ilker Taskaya

About the Authors 

Contributing Editor