Human resources are lacking. With the exception of those employed at highly mature privacy organizations, respondents cited additional staffing as the number-one resource they desired. For those who wear a privacy hat among many others, this was even more necessary because their other duties often precluded them from spending sufficient time developing more than the most rudimentary privacy resources. Even for those who hold full-time privacy positions, comments were nearly universal about needing an additional staff member to help cover contract reviews, policy creation, privacy training, and other critical tasks. Privacy professionals reported that, if given additional staff, they could spend more time engaging in strategic conversations about privacy across the institution.

Getting privacy involved on the front end of decision-making is difficult. Although they characterized this as far from impossible, privacy professionals reported difficulty in persuading decision makers at their institutions to involve them earlier in their planning processes. Far too often, privacy professionals are asked to give a stamp of approval at the eleventh hour of a contract or policy development, with insufficient time to make thoughtful recommendations.

Interviewees primarily attributed the lateness of this review cycle to a lack of privacy awareness and knowledge among institutional decision makers. This is an especially common issue in immature privacy programs that haven't had time for privacy staff to build relationships with offices across campus. As one interviewee said, "It's difficult to get people to think about the long-term consequences if they don't include privacy. It takes a cultural change to get people to think about these things." But, as programs develop over time, levels of privacy education and awareness rise, and several privacy professionals reported one of their proudest accomplishments as being contacted to review a contract that came with a proposed data management plan.

Students are not well informed about how institutions use their data. In the EDUCAUSE 2020 Student Technology Report, a survey of 16,162 students across 71 US institutions, only 22% agreed or strongly agreed that they understood how their institution uses their personal data, and only 25% agreed or strongly agreed that they benefit from their institution's data collection (see figure 5). These responses show a large gap of understanding that institutions need to bridge between administrative plans and policies and student knowledge. But some institutions are working to bridge that gap. Sol Bermann at the University of Michigan see this issue as "less of a challenge and more an opportunity to start building the culture of privacy awareness in a more consistent way."