GRF · Governance Nexus
Digital and data governance
Digital and data governance decides who may collect, use, share and act on data and on the ezinqamula built from it, and how those choices are answered for. As public services, markets and infrastructure come to depend on data platforms and automated decisions, the risks become governance risks: privacy harm, security failure, concentration, opaque algorithms and lock-in. This page sets out how these failures develop, how digital governance can be read, and which decisions sit with legislators, regulators, boards and public bodies.
Digital and data governance in seven parts.
- 01The questionDigital and data governance: how the risk develops
- 02IzinkombaWhat is measured, and how well
- 03ImithomboWhere the evidence comes from
- 04DecisionsWho decides, and what the evidence serves
- 05Core questionsThe questions experts ask
- 06MechanismsStewardship, oversight and dependency
- 07Methods and dataMethods and their limits
Digital and data governance: how the risk develops.
Technology and information stewardship. The dossier below sets out how the risk develops, what is measured, where the data come from, how it is modelled and who decides.
Accountability blurs in automated decisions
When a model informs or makes a decision, responsibility spreads across data providers, developers, deployers and operators. Without a named owner and a record of how the system was tested, affected people cannot find who answers.
Data outlives its purpose
Data collected for one purpose is reused, combined and retained. Each step is small, but together they create exposure to breach, profiling and misuse that no one approved as a whole.
Dependence concentrates
Public bodies and firms come to rely on a few cloud, identity and software providers. Switching costs and opaque contracts limit oversight, and a single provider outage or policy change reaches many services at once.
Security debt compounds
Unpatched legacy ezinqamula, incomplete asset inventories and thin security staffing accumulate risk silently. A breach then exposes not only data but the governance choices that let the debt grow.
Connected activity in Asia.
Night lights, population density and flood water over Asia, from NASA GIBS. Each layer carries its own date.
Imephu esebenzisanayo idinga i-JavaScript; uhlu lwezendlalelo nemithombo luphansi.
Izendlalelo 3
Connected activity, for this page
Ikhibhodi, kugxilwe emephini
Bamba u-Ctrl noma u-⌘ bese uskrola ukuze usondeze
Okutholakala kwakamuva
NASA GIBS / EOSDIS · ASTER GDEM (METI, NASA) · Blue Marble (NASA) · © OpenStreetMap contributors (ODbL) · Natural Earth
Iyalayisha izithombe zakamuva ze-NASA.
Donsa ukuze unyakazise. U-Ctrl noma u-⌘ bese uskrola, ucindezele ngeminwe emibili noma izinkinobho ukuze usondeze; beka isikhombi ukuze ubone amanani aphansi kwaso; ukusetha kabusha kubuyisela esifundeni.
Connected activity, framed on Asia.Imikhiqizo yesathelayithi nemodeli njengoba i-NASA iyishicilela, ngayinye nosuku lwayo. Ziyizikhombisi, ayisikho ukuhlolwa kwanoma yiphi indawo.
Data: NASA GIBS · ASTER GDEM · Blue Marble · © OpenStreetMap contributors · Natural Earth · NASA EONET · NASA/NOAA VIIRS · U.S. Geological SurveyImithombo namalayisense
- We acknowledge the use of imagery provided by services from NASA's Global Imagery Browse Services (GIBS), part of NASA's Earth Science Data and Information System (ESDIS). Colours redrawn from the published colour map; values averaged into hexagonal cells where shown (modified). Idatha evulekile ye-NASA
- We acknowledge the use of imagery provided by services from NASA's Global Imagery Browse Services (GIBS), part of NASA's Earth Science Data and Information System (ESDIS). Colours redrawn from the published colour map; values averaged into hexagonal cells where shown (modified). Idatha evulekile ye-NASA
- VIIRS Black Marble night-time lights, NASA Goddard Space Flight Center; distributed by the NASA Level-1 and Atmosphere Archive and Distribution System (LAADS DAAC); imagery via NASA GIBS. Colours redrawn from the published colour map; values averaged into hexagonal cells where shown (modified). Idatha evulekile ye-NASA
- Center for International Earth Science Information Network (CIESIN), Columbia University. 2018. Gridded Population of the World, Version 4 (GPWv4): Population Density, Revision 11. NASA Socioeconomic Data and Applications Center (SEDAC). Licensed under CC BY 4.0. Colours redrawn from the published colour map; values averaged into hexagonal cells where shown (modified). doi:10.7927/H49C6VHW. CC BY 4.0
- VIIRS near-real-time products (flood, land surface temperature, snow cover, corrected reflectance), NASA LANCE; imagery via NASA GIBS. Colours redrawn from the published colour map; values averaged into hexagonal cells where shown (modified). Idatha evulekile ye-NASA
- NASA Fire Information for Resource Management System (FIRMS), VIIRS 375 m active fire product, NASA LANCE; vector tiles via NASA GIBS. Colours redrawn from the published colour map; values averaged into hexagonal cells where shown (modified). Idatha evulekile ye-NASA
- MODIS land products (vegetation indices, gross primary production, land cover), NASA LP DAAC and LANCE; imagery via NASA GIBS. Colours redrawn from the published colour map; values averaged into hexagonal cells where shown (modified). Idatha evulekile ye-NASA
- ASTER GDEM is a product of METI and NASA (ASTER Global Digital Elevation Model V003, NASA LP DAAC); imagery via NASA GIBS. Colours redrawn from the published colour map; values averaged into hexagonal cells where shown (modified). Cite as: NASA/METI/AIST/Japan Spacesystems and U.S./Japan ASTER Science Team (2019). ASTER Global Digital Elevation Model V003. doi:10.5067/ASTER/ASTGTM.003. Idatha evulekile ye-NASA
- Kwenziwe nge-Natural Earth. Idatha yamamephu yamahhala ye-vector ne-raster ku-naturalearthdata.com. Esizindeni somphakathi
- © OpenStreetMap contributors (ODbL), via NASA GIBS (coastlines, boundaries, roads and place names). Colours redrawn from the published colour map; values averaged into hexagonal cells where shown (modified). ODbL
- Blue Marble, NASA Earth Observatory; imagery via NASA GIBS. Colours redrawn from the published colour map; values averaged into hexagonal cells where shown (modified). Idatha evulekile ye-NASA
- Umongo ephaseleni nasemephini oyisicaba: amagoda olwandle, imingcele, imigwaqo namagama ezindawo avela emaleyeni ereferensi e-NASA GIBS (idatha ye-OpenStreetMap, ODbL, © abafaki be-OpenStreetMap); izithombe ze-Blue Marble njengesisekelo ongasikhetha; umhlaba we-3D nokufundwa kokuphakama okuvela enkombeni yombala wokuphakama ye-ASTER GDEM (amakilasi e-5 m kuya ku-200 m, andiswe ukuze afundeke kahle). Imingcele idwetshwe njengoba ishicilelwe futhi ayisho sikhundla ngasiphi isifunda.
- Imicimbi eqondene nesikhathi samanje: NASA Earth Observatory Natural Event Tracker (EONET); imicimbi iyisikhombisi kuphela futhi igcina izixhumanisi zomthombo wayo wokuqala.
- Observed (EO): NASA/NOAA VIIRS (Suomi NPP). We acknowledge the use of imagery provided by services from NASA's Global Imagery Browse Services (GIBS), part of NASA's Earth Science Data and Information System (ESDIS).
- Bukhoma: NASA EONET Imicimbi iyisikhombisi, akuyizixwayiso zesiphathimandla.
- Bukhoma: U.S. Geological Survey Imicimbi iyisikhombisi, akuyizixwayiso zesiphathimandla.
- Siyabonga ngokusetshenziswa kwezithombe ezinikezwa yizinsizakalo ze-Global Imagery Browse Services (GIBS) ye-NASA, ingxenye ye-Earth Science Data and Information System (ESDIS) ye-NASA.
- Optional layers (5 sources in the layer list: live, forecast, observed and context) print their provider credit on the map and here when switched on; forecasts are model output and derived indices are estimates.
Izendlalelo nezinsuku
- Amalambu ebusuku, nsuku zonke: VIIRS Black Marble (VNP46A2), NASA LAADS DAAC · 12 Okt 2026
- Ukuminyana kwabantu, 2020: Abantu: CIESIN, Columbia University, Gridded Population of the World v4.11 (2018), NASA SEDAC, CC BY 4.0 · okungashintshi
- Umbala weqiniso: VIIRS NOAA-20 corrected reflectance, NASA LANCE · 13 Okt 2026
- Amanzi esikhukhula, inhlanganisela yezinsuku ezi-3: VIIRS Global Flood Product, NASA LANCE · 14 Okt 2026
- Imililo esebenzayo nokungajwayelekile kokushisa: VIIRS NOAA-20 375 m (FIRMS), NASA LANCE FIRMS · 13 Okt 2026
- Land cover type (IGBP), yearly: MODIS Terra and Aqua land cover (MCD12Q1), NASA LP DAAC · 2024
What is measured, and how well.
Each indicator carries its unit, its cadence, the kind of source behind it and the evidence label a value would carry. No values are shown: a programme supplies them under its own authority.
| Indicator | Unit | Cadence | Source type | Label |
|---|---|---|---|---|
| Comprehensive data protection law in force | yes or no, with independent supervisory authority | per change | UNCTAD data protection legislation tracker | Published statistics |
| Data protection authority resources | staff and budget per authority | annual | Authority annual reports | Published statistics |
| Personal data breach notifications | count of notifications by sector | annual | Supervisory authority reports | Published statistics |
| National cybersecurity commitment | score by pillar: legal, technical, organisational, capacity, cooperation | per edition | ITU Global Cybersecurity Index | ESTIMATED |
| Public register of algorithmic ezinqamula | yes or no; number of systems registered | annual | Government publications | Published statistics |
| Data governance and availability | scores by module | per edition | Global Data Barometer | ESTIMATED |
| Digital government maturity | index score by dimension | per edition | OECD Digital Government Index | ESTIMATED |
Deliberation and decision desk.
The screen a team would use to follow this subject: its measures, states and decisions. Names are examples and values are illustrative.
Deliberation and decision desk
Digital and data governance · Council A · Meeting 20
Agenda
| Risk appetite statement | P-817 | Approve | None | Discussing |
| New member admission | P-539 | Approve | Declared | Next |
| Safeguards annual review | P-880 | Note | None | Next |
| Data charter | P-458 | Consult | None | Done |
Anti-capture safeguards
in place, of 12
Decision record
- M-12DECAppetite statement approved with two dissents recorded
- M-18ACTSecretariat to publish reasons within 30 days
- M-16REVReview date set
Where the evidence comes from.
Named public datasets and institutional records, each with its licence class. Sources by agreement are used only under their terms and never republished.
| Umthombo | What it gives | Licence class |
|---|---|---|
| UNCTAD Data Protection and Privacy Legislation Worldwide | Status of data protection and privacy legislation by country | Free, attribution and UN terms |
| ITU Global Cybersecurity Index | Assessment of national commitments to cybersecurity across five pillars | Free, attribution and ITU terms |
| Global Data Barometer | Expert assessments of data governance, capability, availability and use | Free and open, CC BY 4.0 |
| OECD.AI Policy Observatory | Database of national AI policies, strategies and governance initiatives | Free, attribution (OECD terms) |
| OECD Digital Government Index | Comparative assessment of digital government maturity | Free and open, attribution (OECD terms) |
| Data protection authority annual reports | Complaints, breach notifications, investigations and sanctions | Public records, terms per authority |
Compare instruments: rules, incentives and information.
Three families of instruments side by side against the baseline, each with its own lag and adoption speed, under the coverage and compliance you set; effect sizes are teaching values to replace with evidence. Scenario: named assumptions about the future, not a forecast. The map on this page shows Asia; the model itself is not tied to a place.
Controls
- Baseline trend of the outcome
- 2.0% a year
- Coverage of the instrument
- 70%
- Ukuthobela imithetho
- 75%
- Effect size, against the teaching value
- 100%
- Years ahead
- 20 years
Readouts
- Largest reduction at the horizon
- Regulation
- Its reduction against the baseline
- 21%
Numbers, methods and sources
| Year | Isisekelo | Regulation | Economic incentive | Information and capacity |
|---|---|---|---|---|
| 0 | 100.0 | 99.5 | 98.8 | 99.1 |
| 1 | 102.0 | 101.2 | 100.1 | 99.8 |
| 2 | 104.0 | 102.5 | 101.1 | 99.9 |
| 3 | 106.1 | 103.5 | 101.6 | 100.0 |
| 4 | 108.2 | 103.7 | 101.8 | 100.7 |
| 5 | 110.4 | 103.2 | 101.7 | 102.1 |
| 6 | 112.6 | 102.0 | 101.6 | 103.9 |
| 7 | 114.9 | 100.4 | 101.6 | 105.9 |
| 8 | 117.2 | 99.2 | 102.1 | 108.0 |
| 9 | 119.5 | 98.6 | 102.9 | 110.1 |
| 10 | 121.9 | 98.9 | 104.2 | 112.3 |
| 11 | 124.3 | 99.7 | 105.7 | 114.5 |
| 12 | 126.8 | 101.1 | 107.4 | 116.8 |
| 13 | 129.4 | 102.7 | 109.4 | 119.2 |
| 14 | 131.9 | 104.5 | 111.4 | 121.6 |
| 15 | 134.6 | 106.5 | 113.5 | 124.0 |
| 16 | 137.3 | 108.5 | 115.7 | 126.5 |
| 17 | 140.0 | 110.7 | 118.0 | 129.0 |
| 18 | 142.8 | 112.9 | 120.4 | 131.6 |
| 19 | 145.7 | 115.1 | 122.8 | 134.2 |
| 20 | 148.6 | 117.4 | 125.2 | 136.9 |
Izindlela
- Tools of government Hood (1983), The Tools of Government, Macmillan
- Carrots, sticks and sermons Bemelmans-Videc, Rist and Vedung (1998), Transaction
- Diffusion of innovations Rogers (2003), Diffusion of Innovations, Free Press
- Uncertainty fan (parameter Monte Carlo) Spiegelhalter, Pearson and Short (2011), Visualising uncertainty about the future, Science 333
- One-at-a-time sensitivity (tornado) Saltelli and others (2008), Global Sensitivity Analysis: The Primer, Wiley
Idatha
The model runs on the teaching values set by the controls. To calibrate it for a place, read it against these admitted layers and series, which this page's map can draw:
- Borders Natural Earth
- Amadolobha Natural Earth
Across the six pillars, led by Nexus Consortium
- Experiments Amalabhorethri
- Built in Governance Nexus in Foundry
- Tested at Governance Nexus in Universe
- Codified in Foundations and Governance in Standards
- Published in Governance Nexus in Reports
- Taught in Faculty of Governance, Policy and International Affairs in Academy
Who decides, and what the evidence serves.
Governance Nexus prepares evidence. The decisions below are taken by the authorities named, under their own rules, and never by the platform.
| Ubani onqumayo | The question | Evidence this page serves |
|---|---|---|
| Legislators | How to assign duties for data protection, AI and critical digital services, and to whom | Comparative regimes, accountability maps, case evidence |
| Data protection, cyber and competition authorities | Where to focus supervision and enforcement | Breach and complaint records, sector cases, authority resources |
| Boards and chief executives | How data, cyber and AI risks are owned, reported and tested | Board oversight guidance, decision-rights maps, comparable incidents |
| Public bodies deploying automated ezinqamula | Whether a system may be used, and with what safeguards, records and review | Accountability maps, impact assessment practice, algorithm register models |
Outputs this topic produces
- Accountability maps for automated decision systems, naming each role from data to deployment
- Case studies of data breaches, algorithmic failures and platform outages and their governance lessons
- Guidance on board oversight of data, cyber and AI risk
- Comparative notes on data protection and AI governance regimes
From mandate to evaluation, by pillar.
The steps an instrument takes from mandate to evaluation, each with the pillar that runs it, and the decisions that stay with the authority. Teaching model with stated illustrative values, not a prediction. The map on this page shows Asia; the model itself is not tied to a place.
- Mandate and problem framing Competent authority (outside the programme)
A competent authority frames the problem and the mandate under its own rules. Howlett, Ramesh and Perl (2009) - Evidence and system model I-Foundry
The system is modelled with its feedbacks, data and stated limits. OECD (2014), principle 2 - Options appraised with scenarios I-Foundry
Instruments are compared under scenarios, with uncertainty shown. Hood (1983) - Exercise with stakeholders I-Universe
The options are tested in an exercise with those who would implement and bear them. OECD (2014), principle 3 - Standard or guidance drafted Nexus Standards
What works is codified as a standard or guidance, open to comment. Nexus Standards process - Decision by the authority Competent authority (outside the programme)
The authority decides, outside the programme, with the evidence on record. Howlett, Ramesh and Perl (2009) - Capacity and training Risk Academy
Those who implement are trained on the decided instrument and its data. Sendai Framework (2015), priority 2 - Monitoring and public report Imibiko
Indicators are published with sources, limits and corrections. OECD (2014), principle 5 - Evaluation and revision Nexus Standards
Results return to the standard and the model: the cycle closes. Howlett, Ramesh and Perl (2009)
Izindlela
- Policy cycle Howlett, Ramesh and Perl (2009), Studying Public Policy, Oxford University Press
- Governance of critical risks OECD (2014), Recommendation of the Council on the Governance of Critical Risks
- Layered drawing of directed graphs Sugiyama, Tagawa and Toda (1981), IEEE SMC 11
Across the six pillars, led by Nexus Consortium
- Experiments Amalabhorethri
- Built in Governance Nexus in Foundry
- Tested at Governance Nexus in Universe
- Codified in Foundations and Governance in Standards
- Published in Governance Nexus in Reports
- Taught in Faculty of Governance, Policy and International Affairs in Academy
The questions experts ask.
- Who decides how data are collected, used and shared, and on what legal basis?
- How are algorithmic and AI ezinqamula in public and critical services overseen?
- How do institutions keep accountability when they depend on vendors and platforms?
- How are privacy, security and openness balanced?
- How are digital systems governed across borders?
Exercise a cascade in digital and data governance with the people who decide.
Assembled from the Nexus Standards area profile Political and governance risk standards: the hazards it names, the ezinqamula and communities that carry the loss, the controls and institutions that dampen it and the data that observe it. Pick an initiating event and step through the cascade to see where mandates meet and which decisions fall to whom. The Map view places the run on an example geography with open data. Every weight is a stated assumption. An exercise for dialogue, not a forecast, an assessment or a position. To model a place of your own choosing, open the full System Builder.
Systems and couplings
Controls
NS-0Umthethosisekelo nezimisoNS-9Ama-UNI omongo (ukufakwa, izibonelo, izibonelo zohlelo)NS-10Policies and clauses (machine-readable obligations: definition, binding, evaluation and enforcement)NS-11Ukuqinisekisa nokuqapha (ubufakazi, izifakazelo, ukuqapha ukuhambisana ngaphandle kokwethembana)NRS-H112Hazard family: Governance and institutional failure (NHS-1 soc.governance)NRS-U9I-Universe platform profile: Financial Regulation NexusNRS-H59Hazard family: Economic shocks and governance failure (NHS-1 soc.economic)NRS-H118Hazard family: Organised crime and illicit economies (NHS-1 soc.crime)NRS-A5Built-in licensing and rightsNRS-U24Universe platform profile: Policy Nexus
Observation
- Worldwide Governance Indicators (listed for reference)
- V-Dem dataset (listed for reference)
- Global SDG Indicators Database (listed for reference)
- Proportion of population satisfied with their last experience of public services
- Proportion of population who believe decision-making is inclusive and responsive
- Number of countries that adopt and implement national DRR strategies in line with the I-Sendai Framework
Stewardship, oversight and dependency.
Data governance defines roles and rules for data across their life cycle: who owns or stewards them, for what purposes they may be used, how quality is ensured and how individuals' rights are protected. Data protection law sets minimum standards in many jurisdictions, but governance goes further, covering data sharing for public interest, open data and the stewardship of data held on behalf of communities.
AI and algorithmic ezinqamula raise specific challenges: opacity, bias inherited from training data, difficulty of contesting automated decisions and rapid change. Oversight approaches include impact assessment, human review of consequential decisions, audit and transparency registers. Institutions that procure technology may lose the expertise to oversee it, creating dependency on vendors whose systems they cannot inspect.
Concentration of digital infrastructure in a few providers creates ingozi yesistimu, as outages or security incidents can affect many institutions at once.
Public trust depends on these arrangements. When people cannot understand or contest how data about them are used, or when systems fail without clear accountability, trust in the institutions that deploy them declines, with consequences that reach well beyond the technology itself.
Why now: institutions depend on a small number of digital providers and data flows, and oversight of that dependence is new for many boards. Governance Nexus compares how institutions govern digital dependence and can propose common records to the Nexus Standards.
How digital and data governance is governed: instruments, mandates and commitments.
The instruments, mandates, actors and accountability arrangements a policymaker, diplomat or development agency works with, citing the agreements that set them. Structures follow the frameworks named. Any state or progress drawn is illustrative, not a record.
Policy instrument matrix
The kinds of instrument available on digital and data governance, by level of government and cooperation.
| Instrument type | Local | Kazwelonke | Regional | Umhlaba wonke |
|---|---|---|---|---|
| Regulatory | Zoning, building codes | Laws, standards, licensing | Harmonised rules | Conventions and treaties |
| Economic | Local levies, grants | Budget lines, taxes, insurance schemes | Risk pools, regional funds | Financing mechanisms |
| Information | Local warnings | Disclosure, early warning, statistics | Data sharing arrangements | Global monitoring and reporting |
| Institutional | Local committees | Lead agencies, coordination councils | Regional bodies and secretariats | Multilateral mandates |
| Cooperative | Community agreements | Partnership compacts | Memoranda and joint programmes | Agreements and joint commitments |
Methods and their limits.
Impact assessment
Data protection and algorithmic impact assessments; quality varies and they can become formalities.
Algorithm audit
Testing ezinqamula for bias and performance; access to systems is often restricted.
Comparative law and policy
Comparing regulatory approaches across jurisdictions.
Limits: technology changes faster than governance research, and evidence on what oversight approaches work is still developing.
How it is studied, and what the methods cannot say.
- 01Ubunjiniyela bezinhleloDecision-rights and interface mapping · Assurance and control designApplied here
- 02Ukuhlaziya izinqumo ngaphansi kokungaqinisekiRisk appetite and tolerance setting · Multi-criteria appraisal of institutional optionsApplied here
- 03Policy, institutional and decision scienceInstitutional role mapping · Comparative governance case studiesApplied here
Questions and answers.
What is the difference between data protection and data governance?
Who is accountable for an automated decision?
Why does a rising breach count not mean things got worse?
How does this differ from AI and Digital Governance?
Does the platform assess AI systems?
Is data governance only about privacy?
Nikela ngobufakazi kusuka kuleli khasi.
Imibiko is the Consortium's quarterly publication. What you know about this subject can become evidence, a case or a correction in the next edition, credited to you and published under CC BY 4.0 where it is your own work.
- I-imeyiliGateway GW-GRFYithumele kuleli khasiUbufakazi, ukulungiswa, icala, indlela, ukubuyekeza, ukuhumusha noma okufakwayo kwephrofayili. Ifika ifakwe uphawu lwaleli khasi, ukuze umhleli walo ayithole.
- ZenodoUkufakwa okuvulekileYifake bese uyethula emphakathiniShicilela irekhodi lakho ku-Zenodo nge-ORCID iD yakho, bese uyethula emphakathini we-Reports lapho. Abagcini bayalibuyekeza; i-DOI ihlala ingeyakho.
- ImibikoGlobal Risks ForumBona zonke izindlela zokunikelaIzinhlobo zokunikela, ukuthi ngayinye ibuyekezwa kanjani, isikweletu oluthola sona, ilayisense nalokho okungemukelwa nhlobo.
Ungalokothi uthumele idatha yomuntu siqu, imininingwane ebucayi yengqalasizinda noma noma yini ongenalo ilungelo lokuyabelana ngayo. Umnikelo ubuyekezwa ngaphambi kokusetshenziswa; ukuwuthumela akunikezi ubuqambi noma amalungelo okuhlela, futhi ukusekela akuthengi muphumela.
Bring a governance question to the Forum.
Information and enquiries are open today. An enquiry receives a reference and names the next step; applications, payments, compute allocations and registrations open only when their team, terms and review capacity exist.
Legal documents.
Show all 18 legal documents
Maps, data and figures on this site are shown for context and general information. They are not advice, forecasts or warnings; the limits of the information are set out in the Disclaimers and Data Notices.