Survey Finds Security Incidents Drive Data Protection Buys
A Foundry survey of 308 IT decision-makers in Australia, India and the Middle East and Africa examines what prompts organisations to invest in data protection.
Updated on Nov. 3, 2026 in Cybersecurity
Live Poll
Do you think most companies protect your personal data well enough today?
Foundry's 2026 Enterprise Survey of 308 IT decision-makers across Australia, India and the Middle East and Africa finds that 99% of respondents are confident in their organisation's resilience. Security incidents were the most common trigger for new data protection purchases in India, where 64% of organisations reported buying after an incident.
Why it matters
The findings suggest that many organisations invest in data protection reactively rather than in advance of a breach. Rising costs of managing fragmented tools and upcoming regulatory obligations under India's Digital Personal Data Protection Act may further shape spending decisions.
Organisations spend an average of 15 hours each week managing data protection across separate solutions, and 5% spend 40 hours or more. Among the surveyed organisations, 43% use real-time or continuous data protection while 57% depend on daily, weekly or monthly backups.
The players
Foundry
Foundry is a technology research and advisory firm that publishes enterprise IT surveys and market research.
The details
Foundry surveyed 308 IT decision-makers in Australia, India and the Middle East and Africa. Infrastructure upgrades and cost reduction were the leading purchase triggers, with 29% of Indian respondents also citing regulatory requirements.
Timeline
The 2026 Enterprise Survey was conducted by Foundry among IT decision-makers.
Core obligations of the Digital Personal Data Protection Act take effect in May 2027.
Data protection investment is expected to grow by 14% to 15% over the next two years.
The Tech Race
India's Digital Personal Data Protection Act, whose core obligations take effect in May 2027, is positioned to add a regulatory trigger to the incident-driven purchasing the survey documents. Currently 29% of Indian respondents cite regulatory requirements as a purchase trigger.
Organisations face recurring time costs of about 15 hours weekly when data protection runs across separate tools. Teams weighing new purchases may find that consolidating solutions or planning ahead of regulatory deadlines affects both workload and budget.
The takeaway
Many organisations invest in data protection after a security incident, so reviewing backup frequency and tool consolidation before a breach may reduce both risk and management time. Planning for upcoming regulatory deadlines can also spread costs more evenly.
What happens next
The core obligations of India's Digital Personal Data Protection Act take effect in May 2027.
Further reading
Explore more Cybersecurity coverage for context on how organisations respond to security threats.
Live Poll
Do you think most companies protect your personal data well enough today?
