Elevating data protection in the AI governance age

At our recent roundtable led by João Barreiro, Chief Privacy and Data Ethics Officer at BeOne Medicines and Monica Mahay, Chief Compliance Officer (VP) at SkyShowtime, we explored how data protection and privacy leaders can reposition data protection as a driver of trust, innovation and business value – especially as AI accelerates data use and regulatory scrutiny.

Moving beyond tick-box compliance

As long-established data protection recruiters, we know it’s common for privacy to be treated as a regulatory burden: a “cost of doing business.” Today, that mindset is shifting. Organisations are recognising that privacy can strengthen resilience and unlock opportunity.

This approach aligns with the UK ICO’s Accountability Framework, which advocates embedding privacy into governance and operational processes. Boards respond to narratives about resilience and growth, so framing privacy as a risk mitigator and trust enabler positions compliance as a strategic asset rather than a legal obligation.

Linking privacy to ESG and investor confidence

Privacy is no longer just a compliance issue; it’s a marker of corporate integrity and investor trust.

PWC research backs this up: strong data governance underpins ESG reporting and influences investor confidence. Nearly 80% of global investors consider ESG factors, including data governance, important in decision-making. With frameworks like CSRD and IFRS Sustainability Standards requiring governance-related disclosures, privacy risk management is now integral to ESG strategy. Treating privacy KPIs (such as breach rates and DPIA completion) as part of ESG dashboards demonstrates transparency and long-term value creation.

Practical steps for reframing the conversation

João shared a maturity model approach, mapping current and target states across 15 privacy domains. This visual, risk-based method resonates with boards because it shows progress beyond compliance.

Recommended actions for measuring the value of data protection:

• Benchmark against global standards
  Adopt frameworks like ISO/IEC 27701 for Privacy Information Management Systems. The 2025 update allows standalone certification, reinforcing privacy as a governance pillar
• Integrate privacy KPIs into corporate dashboards
  Best practice includes aligning KPIs with ESG materiality, e.g. data breach frequency, DPIA coverage, AI ethics compliance. See ESG KPI guidance
• Frame compliance as an innovation enabler
  In AI-driven projects, privacy-by-design reduces risk and accelerates deployment. Governance automation can cut dataset approval times from weeks to days, unlocking speed and cost savings while maintaining compliance

Compliance in the AI governance age

AI introduces new governance challenges: bias, explainability and data provenance. Strategic AI governance frameworks now integrate privacy and ethics as core principles. Boards increasingly expect AI risk to be managed with the same rigour as financial and operational risks.

Emerging best practices include:

• Establish AI governance policy stacks (acceptable use, risk classification, transparency protocols)
• Conduct bias audits and privacy impact assessments for AI models
• Link AI governance to ESG reporting for investor assurance
• Hire the correct skills for AI governance

As AI accelerates data use and regulatory complexity, privacy leaders must position compliance as a strategic enabler, not a defensive mechanism. Done well, compliance mitigates risk, enhances trust, drives innovation and strengthens competitive advantage.