# **6. Conclusion**

The rapid development of the data economy, entailing as it does a boom in various data-driven products, services, and business models, calls for adaptive policies and regulations. A robust regulatory framework for data governance, ecompassing both safeguards to protect rights of market players and enablers to facilitate use/reuse of data, is important to engender trust and encourage participation in the data economy. However, a comprehensive global stocktaking of various good data governance regulatory practices is missing. Governments, especially those in developing countries, lack a reference point to understand their distance from the global frontier of regulatory best practices, and help prioritize regulatory reforms.

The Global Data Regulation diagnostic is so far the most comprehensive assessment of laws and regulations on data governance. It covers the regulatory practices for both safeguarding and enabling across 80 countries. Under the safeguarding and enabling pillars, the diagnostic produces quantitative measurements of the regulatory environments for country data governance, across the dimensions of safeguards for personal and nonpersonal data, cross-border data flows, and cybersecurity, as well as enablers for public and private intent data, and e-commerce transactions. Two aggregated indicators—covering enablers and safeguards—are constructed to summarize good practice policies for benchmarking country performance.

Diagnostic results show that countries have put in greater effort in adopting enablers than safeguards. However, the regulatory development of both safeguards and enablers remains at an intermediate stage: just 41 percent of good safeguard practices and 47 percent of enabler good practices are adopted across countries. High-income countries perform better than lower-income countries in general, but nonetheless present significant regulatory gaps. Except for Sub-Saharan African countries, presently lagging, other regions have relatively similar performance on the enabler pillar, with the East Asia and Pacific region taking a slight lead. Europe and Central Asia is doing better than many other regions on its regulatory safeguards.

Across all dimensions measured, no income group demonstrates advanced regulatory frameworks. All country income groups achieve their highest scores on the e-commerce dimension. Enabling access to public intent data as well as safeguarding cybersecurity are two dimensions where countries are performing relatively well, except for low-income countries. On average, countries have adopted about half the recommended regulatory practices for enabling access to public intent data. Although more than 60 percent of the countries surveyed have adopted comprehensive regulatory provisions on cybercrime, significant regulatory gaps persist in the framework for cybersecurity. Meanwhile, all income groups are at evolving or basic levels for enabling the use/reuse of private intent data and facilitation of cross-border data flows. The recent COVID-19 pandemic has provided the impetus for many countries either to adopt missing personal data protection legislation or to strengthen or clarify such legislation already in place.

An important value addition of the diagnostic, compared with other tools, is that it does not merely track the existence of legislation but captures the overall robustness and completeness and completeness of that regulation by recording the presence or absence of key provisions within the legislation. The diagnostic finds that countries are typically far more advanced with the passage of overarching legislation, than they are with the robustness of that legislation, or with administrative measures to support its implementation. A better characterization of the enforcement of data governance frameworks, as well as a deeper understanding of their economic and social impact, remain topics for future research.

29