Organizations have made progress in managing who can access information, but maintaining control over it when it is shared with third parties, downloaded, or used outside of typical environments remains a challenge. This is one of the main conclusions of the first State of Data Protection Report 2026, prepared by SealPath based on a study aimed at CISOs and security and technology professionals. The document focuses on the need to strengthen the protection of critical data throughout its life cycle.
The report is released at a time of growth and international expansion for SealPath. During the first three quarters of 2026, the company has increased its activity by more than 20% in markets such as Europe and Asia, reinforcing its international presence and its commitment to solutions designed to protect critical data against unauthorized access and possible exposures.
The results show a gap between access management and control of information once shared. Although 85% of participants say they apply the principle of least privilege, only 36% say they can modify the permissions of a document after sending it. Furthermore, only 21% report having persistent protection, which accompanies the file when it changes location. This limitation makes it difficult to maintain control over critical data as it leaves the corporate environment.
Collaboration and AI expand exhibition scenarios
Collaboration with third parties is common, as the report confirms: 72% of participants say they share sensitive information with other organizations at least occasionally. However, only 46% claim to be able to revoke access to shared information and 32% can audit third-party access. These results highlight the difficulties in ensuring that critical data remains protected even when shared with suppliers, business partners or other entities.
The adoption of artificial intelligence adds new avenues of exposure. 48% confirm that sensitive information has been entered into AI tools and another 20% suspect that this has occurred. Still, only 41% say they have complete visibility into the AI tools used in their organization. Entering information into an AI tool is not in itself an incident: its scope depends on the destination of the data and whether that use is authorized. However, a lack of visibility and control can increase risks when it comes to critical data, especially if it contains sensitive or strategic information.
The study also reflects that having technology does not always translate into a high perception of effectiveness. 91% declare they have at least one protection technology, but only 42% rate its overall effectiveness as quite or very high. In relation to AI, 59% say that their controls do not stop the exposure of sensitive information or only partially do so. To protect critical data, therefore, it is not enough to deploy security tools: it is also necessary to verify that the controls work and allow action on the information when it changes location, recipient or context of use.
Protect information beyond the perimeter
“We are increasingly sharing more sensitive information, with more people, through more channels and with more tools. Artificial intelligence has further expanded the ways in which this information can circulate, increasing exposure to risk when there are no adequate controls. Therefore, protecting information cannot be limited to controlling who accesses it within the organization: it is essential that protection accompanies the document wherever it goes,” says Luis Ángel del Valle, CEO of SealPath.
Maintaining protection beyond the perimeter allows organizations to strengthen control over documents
This need is especially relevant in the case of critical data, whose exposure can compromise the confidentiality of corporate information and increase the risks associated with its shared use. Maintaining protection beyond the perimeter allows organizations to strengthen control over documents and reduce reliance on security measures tied solely to the environment in which they are stored.
The State of Data Protection 2026 report offers a vision of the practices declared by participating professionals and analyzes the challenges associated with information control, collaboration with third parties and the use of AI. The field work was carried out in July and August 2026. This is an exploratory study based on self-reported responses, so its results are not intended to statistically represent the entire market. Their conclusions highlight the importance of adopting strategies that maintain control and protection of critical data throughout its life cycle.
