Data Resources

Commissioned by William the Conqueror to assess the wealth of his new kingdom, the survey recorded landholdings manor by manor, an early demonstration that systematic data collection was a tool of state power as much as administration.

The tahrir defterleri registers recorded land, households and tax obligations province by province, giving Istanbul one of the most systematic data-driven administrations of its era and a model later studied by European states building their own registries.

Mechanised counting cut census processing time from years to months and demonstrated that large national data collection exercises could be automated, launching a company that later became IBM and the modern data-processing industry with it.

His paper describing data organised in tables linked by shared values became the basis for nearly all commercial database systems that followed, giving governments and companies a practical way to manage large collections of structured data.

Enacted after Watergate-era concerns about government surveillance, the law restricted how federal agencies could collect, use and share personal records, an early recognition that government-held data was a resource requiring formal governance rather than unrestricted use.

The guidelines set out principles such as purpose limitation and individual access that later shaped national data protection laws across Europe, Asia and Latin America, well before most countries had any comprehensive data legislation of their own.

Data governance at the macro level first took shape in the early 2000s as a political concept within international relations and Internet governance. It established data as an object of state-level rule-making rather than purely an organisational management concern, distinguishing it from corporate data governance.

At the Data Governance Conference in Orlando, Florida, practitioners running successful programmes characterised the discipline as overwhelmingly a matter of communication rather than tooling. The claim shaped subsequent understanding of what makes data governance capability succeed within organisations.

Enrolling more than a billion residents through fingerprint and iris data, Aadhaar became the backbone of India's digital public infrastructure, linking welfare payments, banking and tax records to a single identity number and inspiring similar schemes elsewhere.

The framework set out data principles, data quality, metadata, data access and data lifecycle as the constituent components of organisational data governance. It gave institutions a structured way to delegate authority over data and to treat data holdings as managed strategic assets.

Revelations about the scale of American signals intelligence collection prompted governments including Brazil, Germany and later India to pursue data localisation and domestic cloud requirements, treating dependence on foreign-held data as a strategic vulnerability.

The law required operators in sectors deemed critical to store certain data inside China and pass security reviews before sending it abroad, an early and influential model for treating data storage location as a matter of national security.

The International Organization for Standardization issued a formal framework for the governance of data, joining other recognised frameworks such as ISO 8000, the CMMI Data Management Maturity Model and DAMA-DMBOK. Standardisation allowed organisations and regulators to reference a common baseline for how data assets should be governed.

The law gave users of connected devices and cloud services a right to move their data between providers and imposed interoperability duties that American hyperscalers argued exceeded the compliance burden faced by smaller European rivals.

The rules set out consent-management mechanisms, obligations for firms handling children's data and conditions for cross-border transfer, moving India's 2023 data protection law from statute toward practical enforcement after a public consultation period.

The scheme, which lets individuals authorise sharing of their own financial records between institutions, was widened to medical records, positioning South Korea's data-portability infrastructure as a model other Asian regulators studied for their own reforms.

The National Data Protection Authority penalised companies for data-handling breaches at scale for the first time, signalling that Latin America's largest data protection regime, largely dormant for several years after passage, had moved into active enforcement.

Exchanges in Shanghai, Beijing and other provinces widened the range of datasets bought and sold under Beijing's policy of treating data alongside land, labour and capital as a formal economic input, though liquidity on most exchanges stayed thin.

A two-year transition period given to businesses to comply with consent, breach-reporting and data-controller obligations expired, exposing companies operating in Southeast Asia's largest data market to fines and other penalties for the first time.

The law, overseen by the Saudi Data and AI Authority, imposed consent, breach-notification and cross-border transfer requirements on companies operating in the kingdom, part of a wider Gulf shift toward treating personal data as a regulated national asset.

The Emirati Genome Programme continued sequencing citizens at population scale, building one of the larger national genomic databases and linking it to health records for research and drug development intended to benefit the domestic population first.

Regulators imposed further penalties and, in some cases, slowed access to services that stored Russian users' personal data on servers outside the country, continuing a localisation regime in force since 2015 that pushed Western platforms toward exit or restriction.

The guidelines clarified registration duties for data controllers and processors and set out sanctions for non-compliance, part of a wider pattern across Kenya, Nigeria and South Africa of turning framework data-protection laws into enforceable rules.

Prompted by the growing use of large language models and the vast datasets required to train them, the paper argued for governing data collections through a human rights lens. It marked the extension of data governance thinking from organisational value management to the ethical constraints on training data.

The regulation set strict consent, processing and cross-border transfer rules backed by large fines, and became the template that dozens of countries, from Brazil to India, drew on when writing their own data protection laws.

The survey found 54% of respondents citing efficiencies in processes as the key driver, 39% regulatory requirements and only 7% customer service. The findings indicated that adoption of data governance was motivated chiefly by internal operational gains rather than external compliance or service pressures.