# **1. Introduction**

Digital data is growing at exponential rates. Individuals are leaving digital footprints through their daily activities. Businesses accumulate data about customer behaviors and preferences, using them to improve efficiency and to facilitate exchanges. Governments are also taking initiatives on data accumulation by creating, for example, smart cities and incorporating data analytics into their policy making. If used well, data can foster inclusive economic growth and improve the delivery of public services. Concerns regarding data protection and security are mounting, however, as data breaches and potential violations of individual rights increase.

Governments have been adopting various approaches to improve data protection and security. For instance, the European Union has adopted the General Data Protection Regulation (GDPR), which emphasizes the rights of data subjects who might be either identified or identifiable. The United States and the Asia-Pacific Economic Cooperation (APEC) opt for a laissez-faire, or market-centric, approach by relying on voluntary private sector standards. But data sets that could serve as a reference point to assess the robustness a country’s regulatory environment on data governance are limited.

This Global Data Regulation Diagnostic (or “diagnostic” hereafter) aims to develop objective and standardized indicators to measure the regulatory environment for the data economy across countries. The structure of the indicators follows a “trust” framework proposed in the _World Development Report 2021: Data for Better Lives_ (WDR21). The framework identifies the legal and normative “safeguards” and “enablers” needed to engender trust and facilitate the development of a data-driven economy, using a conceptual framework developed specifically for the WDR21.

The indicators aim to serve as a diagnostic tool so countries can assess their adoption of regulatory elements that comprise a “trust” framework for the data economy. Diagnostic results could also be used to form a baseline to track relevant regulatory reforms over time. Understanding gaps in regulatory good practice is a necessary first step for governments when identifying and prioritizing reforms. This is especially important for emerging economies that need to catch up on reaping the benefits of the data economy while avoiding the risks associated with it. Meanwhile, it is important to emphasize that there is no one-size-fitsall approach to data governance. Although the diagnostic helps governments understand where they are with regard to the adoption of good practices in building a robust legal framework to promote the data economy, the design of such a sound regulatory environment needs to be responsive to local circumstances. Extensive consultation with citizens and market players, efficient enforcing authorities, and flexible mechanisms to ensure that the legislation is adapted to new technologies or business models are all indispensable to making sure that the regulatory environment is robust and effective.

This paper has six sections. The next section, section 2, provides a literature review and explains the theoretical background of the study, while section 3 describes the methodology and section 4 presents key findings from the diagnostic. The penultimate section (section 5) shares case studies on data governance and regulatory reforms during the COVID-19 pandemic. The final section, section 6, discusses policy implications and provides conclusions.

# **2. Literature Review**

In the evolving global data economy, trust has come under the spotlight. As the Organisation for Economic Co-operation and Development (OECD) observes, the data-rich and hyperconnected digital environment calls for trust to exploit the potential of the digital economy to support economic and social prosperity (OECD 2016). An influx of brand-new data-based products or services, as well as the virtual-interaction environment, imposes challenges for traditional ways to develop trust (O’Neill 2012). There is a lack of 2