Study examines interplay between data protection and value creation

The Information Commission (ICO), together with the data protection authorities (DPAs) of Luxembourg (CNPD) and France (CNIL), conducted a joint study examining the interplay between data protection compliance, data governance, and economic value creation.

The study drew on primary and secondary research, including literature reviews, stakeholder interviews, and quantitative surveys across the UK, France, and Luxembourg. The study gathered insights from the financial sector; however, the authors note that its findings are relevant to organisations across the digital economy facing similar data management challenges. 

The research focused on three principal areas: 

• The perception of compliance as a strategic asset rather than merely a regulatory overhead; 
• The recognition and valuation of data within formal accounting standards; 
• The impact of data governance on mergers and acquisitions (M&A) and investment due diligence.

A key conclusion is that robust data protection acts as an indicator of organisational resilience, consumer trust, and long-term performance. In corporate transactions and M&A evaluations, data quality, security, and statutory compliance increasingly sway risk appraisals and commercial outcomes. The findings also support the need for integrated approaches to managing data-related risks and opportunities within data protection, cybersecurity, and artificial intelligence (AI) governance operations. On this point, the report recommends a two-step strategy: first, assess the positive contributions of compliant data assets to future cash flows, and subsequently quantify and mitigate data risks that could undermine those benefits.

The findings offer emerging best practices to help account for compliant data assets, prepare for due diligence, and translate regulatory adherence into measurable economic advantages that foster market transparency, fair competition, and consumer confidence.

Training Announcement: Freevacy offers a range of independent data protection qualifications from IAPP and BCS. Our certified courses are available at foundation and practitioner levels and cover multiple legal jurisdictions, data protection operations management, and the implementation of complex privacy solutions in technical environments. Find out more.