The Global Risks Forum (GRF)
Digital and data governance decides who may collect, use, share and act on data and on the systems built from it, and how those choices are answered for. As public services, markets and infrastructure come to depend on data platforms and automated decisions, the risks become governance risks: privacy harm, security failure, concentration, opaque algorithms and lock-in. This page sets out how these failures develop, how digital governance can be read, and which decisions sit with legislators, regulators, boards and public bodies.
GRF · Established · service level R0
Data governance is the set of rules and responsibilities that decide who may collect, use, share and act on data and on the systems built from it, and how those choices are answered for. As services and infrastructure depend on platforms and automated decisions, privacy, accountability, concentration and security become governance risks.
For digital and data governance, in GRF's situational-awareness reading, the map opens on population density, night lights and flood water with night lights tonight from NASA GIBS, framed on Asia; every other NASA layer, live feed and forecast waits in the layer list.
The interactive map needs JavaScript; the layer list and sources are below.
Layers 3
Connected activity, for this page
Keyboard, with the map focused
Hold Ctrl or ⌘ and scroll to zoom
Latest available
NASA GIBS / EOSDIS · ASTER GDEM (METI, NASA) · Blue Marble (NASA) · © OpenStreetMap contributors (ODbL) · Natural Earth
Loading the latest NASA imagery.
Drag to move. Ctrl or ⌘ and scroll, pinch or the buttons to zoom; hover for the values under the pointer; reset returns to the region.
For digital and data governance, in GRF's situational-awareness reading, the map opens on population density, night lights and flood water with night lights tonight from NASA GIBS, framed on Asia; every other NASA layer, live feed and forecast waits in the layer list.Satellite and model products as NASA publishes them, each with its own date; indicators, not assessments of any place; claim ceiling INTEGRATED.
Layers and dates
The working screen behind this subject: its structure, terms and states. Names are placeholders and values illustrative.
Digital and data governance · Council A · Meeting 20
| Risk appetite statement | P-817 | Approve | None | Discussing |
| New member admission | P-539 | Approve | Declared | Next |
| Safeguards annual review | P-880 | Note | None | Next |
| Data charter | P-458 | Consult | None | Done |
in place, of 12
Technology and information stewardship. The dossier below sets out how the risk develops, what is measured, where the data come from, how it is modelled and who decides.
When a model informs or makes a decision, responsibility spreads across data providers, developers, deployers and operators. Without a named owner and a record of how the system was tested, affected people cannot find who answers.
Data collected for one purpose is reused, combined and retained. Each step is small, but together they create exposure to breach, profiling and misuse that no one approved as a whole.
Public bodies and firms come to rely on a few cloud, identity and software providers. Switching costs and opaque contracts limit oversight, and a single provider outage or policy change reaches many services at once.
Unpatched legacy systems, incomplete asset inventories and thin security staffing accumulate risk silently. A breach then exposes not only data but the governance choices that let the debt grow.
Each term as this page uses it. Where a standard-setting body defines the term, the wording follows that body.
| Term | Definition |
|---|---|
| Data protection | Legal rules on processing personal data, such as the GDPR, enforced by data protection authorities. |
| Algorithm register | A public list of the algorithmic systems a government uses, with their purpose and safeguards. |
| Security debt | Accumulated unaddressed security weaknesses in systems, which raise the cost and risk of later failure. |
Each indicator carries its unit, its cadence, the kind of source behind it and the evidence label a value would carry. No values are shown: a programme supplies them under its own authority.
| Indicator | Unit | Cadence | Source type | Label |
|---|---|---|---|---|
| Comprehensive data protection law in force | yes or no, with independent supervisory authority | per change | UNCTAD data protection legislation tracker | OFFICIAL |
| Data protection authority resources | staff and budget per authority | annual | Authority annual reports | OFFICIAL |
| Personal data breach notifications | count of notifications by sector | annual | Supervisory authority reports | OFFICIAL |
| National cybersecurity commitment | score by pillar: legal, technical, organizational, capacity, cooperation | per edition | ITU Global Cybersecurity Index | ESTIMATED |
| Public register of algorithmic systems | yes or no; number of systems registered | annual | Government publications | OFFICIAL |
| Data governance and availability | scores by module | per edition | Global Data Barometer | ESTIMATED |
| Digital government maturity | index score by dimension | per edition | OECD Digital Government Index | ESTIMATED |
The topic as a computational graph: named sources feed the methods, an evidence review gates the outputs, and the decisions stay with the authorities that hold them.
Fig. 02Nodes carry their type, two metric rows and a state; connectors show what feeds what; dashed frames name the owners; the timeline is the cadence. Design of the pipeline, not a record of a run.
Named public datasets and institutional records, each with its licence class. Sources by agreement are used only under their terms and never republished.
| Source | What it gives | Licence class |
|---|---|---|
| UNCTAD Data Protection and Privacy Legislation Worldwide | Status of data protection and privacy legislation by country | Free, attribution and UN terms |
| ITU Global Cybersecurity Index | Assessment of national commitments to cybersecurity across five pillars | Free, attribution and ITU terms |
| Global Data Barometer | Expert assessments of data governance, capability, availability and use | Free and open, CC BY 4.0 |
| OECD.AI Policy Observatory | Database of national AI policies, strategies and governance initiatives | Free, attribution (OECD terms) |
| OECD Digital Government Index | Comparative assessment of digital government maturity | Free and open, attribution (OECD terms) |
| Data protection authority annual reports | Complaints, breach notifications, investigations and sanctions | Public records, terms per authority |
Governance Nexus prepares evidence. The decisions below are taken by the authorities named, under their own rules, and never by the platform.
| Who decides | The question | Evidence this page serves |
|---|---|---|
| Legislators | How to assign duties for data protection, AI and critical digital services, and to whom | Comparative regimes, accountability maps, case evidence |
| Data protection, cyber and competition authorities | Where to focus supervision and enforcement | Breach and complaint records, sector cases, authority resources |
| Boards and chief executives | How data, cyber and AI risks are owned, reported and tested | Board oversight guidance, decision-rights maps, comparable incidents |
| Public bodies deploying automated systems | Whether a system may be used, and with what safeguards, records and review | Accountability maps, impact assessment practice, algorithm register models |
Data governance defines roles and rules for data across their life cycle: who owns or stewards them, for what purposes they may be used, how quality is ensured and how individuals' rights are protected. Data protection law sets minimum standards in many jurisdictions, but governance goes further, covering data sharing for public interest, open data and the stewardship of data held on behalf of communities.
AI and algorithmic systems raise specific challenges: opacity, bias inherited from training data, difficulty of contesting automated decisions and rapid change. Oversight approaches include impact assessment, human review of consequential decisions, audit and transparency registers. Institutions that procure technology may lose the expertise to oversee it, creating dependency on vendors whose systems they cannot inspect.
Concentration of digital infrastructure in a few providers creates systemic risk, as outages or security incidents can affect many institutions at once.
Public trust depends on these arrangements. When people cannot understand or contest how data about them are used, or when systems fail without clear accountability, trust in the institutions that deploy them declines, with consequences that reach well beyond the technology itself.
Data protection and algorithmic impact assessments; quality varies and they can become formalities.
Testing systems for bias and performance; access to systems is often restricted.
Comparing regulatory approaches across jurisdictions.
Limits: technology changes faster than governance research, and evidence on what oversight approaches work is still developing.
The current service level is R0: information and enquiries. An enquiry receives a reference and names the next step; applications, payments, compute allocations and registrations open only when their team, terms and review capacity exist.