Data protection and business value: What the new regulators' study shows

A large customer database sounds valuable. Then someone planning a new project asks where the data came from, which uses are available and what unresolved risks come with it.

Data protection and business value are connected through more than potential fines. A new joint study by CNIL, ICO and CNPD examines data governance as an economic issue: in data valuation, accounting, business transactions and organisational governance.

CNPD introduced the study on 7 October 2026; CNIL covered it on 16 October. This is recent research, not a new law or a data breach announced today.

What the study examines

The October 2026 report combines literature review, interviews and company surveys. It starts with financial-market participants and data-driven organisations. Its findings should not be treated as representative statistics for every small or medium-sized business.

The ICO describes the central relationship as one between data protection compliance, data governance and value creation. Well-managed data can support trust and resilience. In investments and transactions, the quality of that work may matter to the assessment of an organisation.

The study does not establish a formula that more data protection produces a higher valuation. It does not assign a standard price premium to certification. CNPD expressly describes the findings as exploratory and non-binding.

Why this is also a cybersecurity question

An organisation using data needs to understand its availability, integrity and confidentiality. A collection contributes little to a business model if nobody can explain its origin, permissions are unclear or an outage removes the only usable access.

The study therefore includes cybersecurity in the economic risk picture. Our practical interpretation is that data protection, information security and business teams need shared facts, while retaining their different responsibilities and decisions.

A data inventory should help answer a business question: can this collection responsibly support the proposed use? Record counts alone provide little help.

Data protection due diligence starts with the proposed use

Imagine an acquisition in which a customer database matters to the business case. The data room contains a list of systems, record counts and security measures. A meaningful assessment still needs answers:

These are our working questions, not an official assessment catalogue. They do not replace due diligence. They help identify the information worth requesting rather than treating a large document repository as a completed review.

Three decisions instead of another repository

For a new data or AI project, the practical workflow can stay manageable:

Specify the use. Explain the outcome the project should achieve and the data it needs. “We want to use AI” is too broad to assess access and unanswered questions.

Assign the gaps. Unclear origin, excessive access or a missing assessment needs an owner and a next step. Otherwise the same question returns at the next approval.

Keep the decision connected to changes. Record which use was assessed under which conditions. A changed purpose, data source or provider should make the need for reassessment visible.

This turns an inventory into a basis for decisions. The relevant specialists remain responsible for substantive and legal assessments.

Where Kopexa can help

Kopexa can connect requirements, risks, tasks and evidence. When preparing a data project, an open review can be linked to an owner and the supporting evidence rather than left as an isolated data-room note.

Kopexa does not derive a business valuation or provide legal clearance to use data. Its value here is making the necessary work and its progress traceable.

Our article on ISO 27001 and data protection explains cooperation between the two disciplines. The Xandr case addresses a different issue: processing in an advertising data supply chain. This article focuses on governance and the assessment of data collections.