Data deregulation to AI protection: Security priorities in 2025

The digital world is changing rapidly, and with it comes an escalating wave of cyber threats that businesses in every sector must navigate carefully. Recent surveys reveal a staggering 40% of executives, particularly Chief Information Security Officers (CISOs), reported between six to ten cybersecurity breaches in just the past year. As organizations strive to shield user data and protect their reputations, 2025 is shaping up to be a crucial year for both data security and the strategic adoption of artificial intelligence (AI). As AI tools become more integrated into business operations, expect to see a significant uptick in IT budgets dedicated to these initiatives.

Meanwhile, the regulation of data is shifting dramatically across the globe, with variations in policy emerging at local and national levels. For example, in Europe, adherence to strict privacy regulations like GDPR sets a high standard for data protection. In contrast, the U.S. currently lacks a cohesive federal framework governing AI data usage. With this context in mind, let’s dive into some predictions regarding what organizations and governments will focus on concerning data security in the upcoming year:

Diverse Approaches to Data Regulation

We find ourselves at a key juncture in the global regulatory landscape for cybersecurity. While the U.S. moves toward a trend of deregulation, Europe is pushing back, intensifying its scrutiny on American businesses with established laws like GDPR. Correspondingly, the U.S. is adopting a more regional approach, illustrated by the recent introduction of laws such as the Colorado AI Act and the California Consumer Privacy Act. This interplay signals an increase in regulatory divergence, urging organizations to cultivate localized strategies that meet the unique compliance demands of different jurisdictions.

In Europe, exciting new cybersecurity regulations are poised to make waves, comparable to the impact of GDPR on companies operating there. The upcoming Cyber Resilience Act and EU AI Act promise to reshape the operational landscape for AI developers and users distinctly. Specifically, the EU AI Act is set to bring much-needed clarity and establish uniform frameworks for risk management. This legislative shift will completely transform how organizations enhance their security strategies throughout 2025 and beyond.

Embracing a ‘Data Sovereignty First’ Security Approach

The emergence of more localized data regulations will prompt a ‘data sovereignty first’ mindset among organizations and governments alike. Countries are expected to develop specific frameworks prioritizing the control and protection of regional data, which will inevitably complicate compliance for companies operating on a global scale. In tandem, businesses will need to adapt by focusing on upskilling their teams to better understand these evolving regulations and refining data classification and governance policies specifically tailored to local standards.

While these new policies may introduce extensive compliance protocols, they ultimately pave the way for a stronger security posture. Companies will be held accountable not just for their documentation but for real implementation and effectiveness in security protocols. In today’s landscape, relying on outdated policies is perilous, and demonstrating effective security controls will lead to meaningful improvement across organizations.

Evolving AI Security Strategies

As enterprises increasingly embrace AI tools, spending on application and data security is expected to see a significant boost—notably a more than 15% increase as organizations prioritize safe deployment of these advanced technologies. As generative AI continues to grow in popularity, investing in comprehensive data governance, management, and resilience strategies will become essential to ensure returns on these AI investments.

The dramatic rise in AI adoption, combined with the intricate web of global data regulations, underscores a critical message: prioritizing advanced data governance, management, and security strategies in 2025 and beyond should be at the forefront of every enterprise’s agenda. Companies must ensure that leveraging AI tools does not compromise data safety but rather enhances it through robust security measures.

Dana Simberkoff, the Chief Risk, Privacy and Information Security Officer at AvePoint, Inc., plays a pivotal role in guiding organizations through the complexities of risk management, compliance, and data governance.