Context of the initiative
This report is the result of a joint initiative led by the National Commission for Data Protection (CNPD) in Luxembourg, the National Commission for Information Technology and Civil Liberties (CNIL) in France and the Information Commissioner’s Office (ICO) in the United Kingdom.
It forms part of a wider discussion on the interplay between personal data protection, data governance and the monetisation of data assets in the financial sector.
Whilst data has become a strategic asset for businesses and an essential element in the development of digital technologies (and artificial intelligence systems), issues relating to its governance, quality and compliance are proving to be a crucial challenge for economic, financial and institutional stakeholders today.
The report examines the extent to which data protection – as a fundamental right and a framework of trust for data usage, going beyond mere compliance with regulations – can help to strengthen confidence in data-driven assets and support their exploitation and contribution to value creation in the economy. It provides an overview of best practice in this area.
GDPR compliance, like data itself, is a strategic asset with multiple dimensions (reputation, cyber resilience, data quality, etc.) and, conversely, non-compliance can be a hindrance to the operations of businesses whose business model is data-driven (reputational, financial and operational risks, etc.). The aim of a sound data strategy is to maximise these opportunities and minimise these risks.
Purpose of the report
The study explores the following question:
To what extent can data protection contribute to value creation beyond mere compliance with regulatory obligations?
Through this analysis, the report examines the role that data governance, compliance, risk management and trust mechanisms can play in the economic valuation of data assets and within organisations whose value creation increasingly relies on data and artificial intelligence.