Privacy enhancing technologies (PETs) are moving from research laboratories into products and services. Companies use them to analyse data they could not otherwise share, to train AI models without centralising sensitive information, to run computations in the cloud without exposing data to the provider and to prove facts without revealing the underlying data. A 2026 report by the European Commission’s Joint Research Centre and Europol, Horizon scanning on emerging privacy enhancement technologies, looks at these technologies from an unusual angle: what they mean for law enforcement, which may use them but must also investigate criminals who use them. For companies interested in adopting or offering PETs, the report is a useful map of the technologies, their maturity and the debates that will shape their regulation.

‍
1. What PETs are, and what they are for
There is no single definition. The report recalls those of the UN, the OECD and ENISA and proposes to view PETs as technologies that protect data privacy and security while enabling collaboration and data-driven innovation. The emphasis on collaboration is important for businesses. Following the UK Royal Society, the report notes that PETs reinforce data governance choices, serve as tools for data collaboration and enable accountability through audits, and are sometimes called “partnership enhancing technologies” or “trust technologies”: they can make it possible for organisations, including competitors, to work on shared data without exposing it to each other.
The report also reminds readers that PETs are not a silver bullet. Following the OECD, it stresses that they cannot replace legal frameworks but must operate within them, combined with enforceable obligations to protect privacy and data protection rights.

‍
2. A practical map
The OECD classification reproduced in the report divides PETs into four families:
• data obfuscation tools, such as anonymisation and pseudonymisation, synthetic data, differential privacy and zero-knowledge proofs, which allow a fact to be verified without disclosing the data, for example proving an age;
• encrypted data processing tools, such as homomorphic encryption, multi-party computation and trusted execution environments, which allow data to be processed without being exposed;
• federated and distributed analytics, such as federated learning, in which models are trained where the data are rather than by centralising them;
• data accountability tools, such as systems that set and enforce rules on access to data and keep immutable records of who accessed what, and personal data stores.
Other classifications distinguish input privacy, which protects data during processing, from output privacy, which ensures that results cannot be used to reconstruct the inputs. For a company, this distinction is a useful starting point: the right PET depends on whether the risk lies in sharing the data, in the processing environment or in what the results reveal.
Ask: In our project, where exactly is the privacy risk: in sharing data with partners, in processing it with a provider, or in what the results could reveal?

‍
3. Market and barriers
According to the figures cited in the report, the global PETs market was worth USD 2.6 billion in 2023, with expected annual growth of about 25% until 2030, driven by data growth, regulation, cloud migration and AI. Basic PETs such as encryption are already used by some 50 billion devices. More advanced PETs, however, face barriers: limited understanding within organisations, technology providers’ insufficient knowledge of deployment environments, difficulty in assessing costs and benefits, lack of expertise, doubts about market maturity and, notably, a lack of regulatory clarity, in particular on the status of data processed with PETs. The report also mentions risks arising from immature technologies, implementation mistakes and inadequate organisational measures.

‍
4. The technologies to watch
Several of the technologies the report highlights are directly relevant to companies:
• privacy-preserving machine learning, which combines federated learning, secure computation and differential privacy to train models on data that remain with their holders; the report sees it as particularly useful where relevant training data are scarce, but also warns of adversarial attacks;
• trusted execution environments, isolated hardware enclaves in which code and data are protected even from the host, with attestation that only the intended code is running; they protect data in use when processing is outsourced, for example to cloud providers, and are promoted by the Confidential Computing Consortium of the Linux Foundation;
• computation on encrypted data through fully homomorphic encryption, multi-party computation and zero-knowledge proofs, described by an interviewee as “the dream of cryptography”; these techniques are becoming practical but remain computationally demanding, currently around 100 times slower than standard processing, so they are likely to be used first where security matters more than performance, as in finance, healthcare and government;
• post-quantum cryptography, needed because future quantum computers could break current public-key algorithms; the “harvest now, decrypt later” strategy, in which attackers collect encrypted data today to decrypt it later, makes the transition urgent even though it will be complex and costly.

‍
5. The dual-use dimension
The report’s main perspective is law enforcement. The same PETs that protect legitimate users can be used to conceal criminal activity, and the report lists encrypted communications, homomorphic encryption, multi-party computation and trusted execution environments among the technologies that may make access to evidence more difficult. It also recalls the debate on lawful access to encrypted data, from exceptional access by service providers to obligations on suspects to decrypt. For providers of PETs, this means that their products may attract the attention of policy-makers and law enforcement, and that the regulatory environment for encryption and confidential computing is not settled. Companies offering these technologies should follow the debate and be prepared to explain how their products balance privacy with legitimate access requests.

‍
6. PETs and the GDPR
For companies, the decisive legal question is often whether data processed with a PET are still personal data. The answer depends on the technique and the context. Pseudonymised and encrypted data generally remain personal data for those who can re-identify them, although the Court of Justice has accepted that they may not be personal data for a recipient without reasonable means of re-identification. Synthetic data and models trained on personal data are not automatically anonymous, as the European Data Protection Board has stressed for AI models. PETs are therefore best understood as tools to implement data protection by design, reduce risks and support the balancing tests and impact assessments required by the GDPR, rather than as a way to escape it. In data spaces and data-sharing projects, they can make collaboration acceptable where it would otherwise be too risky.
Where to start
Companies interested in PETs should start from a concrete use case and identify where the privacy risk lies, then select the family of PETs that addresses it, test it in a limited pilot and document the residual risks in the data protection impact assessment. They should assess the costs in performance and energy, especially for encrypted computation, and ensure they have or can acquire the necessary expertise. All organisations handling long-lived sensitive data should begin planning the transition to post-quantum cryptography.

‍
The practical question is not which privacy technology is the most advanced? It is which technology solves our specific privacy risk, at what cost, and what will its legal effect be on the data we process?

‍