Integrated data risk governance is the practice of governing privacy and cyber security as a single risk to the organisation’s data, owned at leadership level, rather than as two separate compliance functions. Security now runs on data, and much of that data is personal, so decisions about what to collect, keep and share are security and privacy decisions at once.
The idea travels under several names: integrated risk management, converged privacy and security governance, unified data governance, data-centric security and shared accountability for data. Each asks the same question: not whether the privacy team or the security team is right, but who decides for the organisation.
The frameworks already point in this direction. Article 32 of the UK GDPR requires appropriate technical and organisational measures to secure personal data. The NIST Cybersecurity Framework 2.0 (2024) places cyber risk strategy and oversight with leadership through its Govern function. In the European Union, the NIS2 Directive (EU) 2022/2555 requires management bodies of in-scope organisations to approve and oversee cyber security risk measures, and the Digital Operational Resilience Act (Regulation (EU) 2022/2554) gives the management body of a financial entity ultimate responsibility for ICT risk. For AI, the EU AI Act (Regulation (EU) 2024/1689) sets data governance requirements for the datasets used to build high-risk systems.
AI is where the gap is widening fastest. Of organisations that suffered a breach, 63% either had no AI governance policy or were still developing one, and one in five organisations studied reported a breach due to shadow AI, meaning AI tools used without approval (Source: IBM, Cost of a Data Breach Report, 2025).
This analysis draws on a recent conversation with Bojana Bellamy, President of the Centre for Information Policy Leadership (CIPL). We have translated the conversation into the decisions a board has to own.
Why can privacy and cyber security no longer be governed separately?
They can no longer be governed separately because each now depends on the other to succeed. Security teams detect threats by watching signals across systems, suppliers and borders. Bellamy puts it plainly: “Cyber needs brilliant data, and it needs data to be able to deliver its mission.” Much of that data is personal, and the techniques used to analyse it sit uneasily with privacy principles like data minimisation and purpose limitation.
The dependency runs the other way too. In Bellamy’s words, “You can simply not have privacy unless you have robust data security.” A privacy programme that restricts security’s view of the organisation weakens the protection that privacy law demands. When the two functions meet only during incidents or audits, the tension becomes delay and decisions nobody owns.
What does it mean to treat data as security infrastructure?
It means governing data with the same deliberateness as networks and endpoints, because security depends on it just as heavily. In most organisations, decisions about what data is collected, kept, accessed and shared are scattered across departments and inherited policies, with no single owner.
The discussion makes a point boards rarely hear: collecting more data is not inherently wrong if it is governed and proportionate, and over-restricting it can blind threat detection. The failure is data decisions that nobody made deliberately. The same foundations determine whether AI can be used safely at all, as we argue in AI Readiness Starts Before AI.
Why does AI make this urgent?
AI makes this urgent because it multiplies both the value of data and the ways it can leak. AI systems are trained on data, fed with it and able to surface it to people who were never meant to see it. Security teams are also adopting AI to monitor more signals, faster. Both trends expose governance gaps that were once tolerable.
Organisations facing privacy, cyber security, AI and sector rules often respond with more paperwork. Bellamy’s argument is that separate privacy impact assessments, cyber risk assessments and AI assessments should give way to integrated risk models that weigh benefits and harms together, building on the accountability elements mature privacy programmes already have.
The AIPEX view: make one executive accountable for data risk, and give the board one register
At AIPEX we see the separation of privacy, security and AI governance as an organisational choice, not a technical necessity, and one the board can change. Three decisions do most of the work.
- One accountable owner. Name a single executive who answers to the board for data risk across privacy, security and AI. The specialist functions keep their expertise; what changes is that trade-offs are resolved in one place.
- One risk view. Replace parallel assessments with a single data risk register that shows, for each significant use of data, the security need, the privacy impact and the AI exposure side by side.
- Explicit data mandates. Approve, at leadership level, what data security teams and AI systems may collect, analyse, retain and share, and for what purpose. Silence is not a policy.
This also changes the role of the specialists. Bellamy observes that “some privacy officers, they see their role as saying no, but that has to change.” The same applies to security: both functions should enable responsible use of data, not become a brake the business routes around.
How should the board oversee integrated data risk, and what should it expect from the executive team?
The board should oversee integrated data risk through one regular report that covers privacy, security and AI together, and it should expect the executive team to show decisions, not activity.
Integration also underpins speed in a crisis. The decisions described in AI-Speed Cyberattacks: What the Board Must Decide Before the Incident depend on knowing where sensitive data sits, and the access model in Zero Trust Is a Leadership Decision depends on knowing who should reach it.
What should the board ask about data risk?
The board should ask questions that reveal whether data decisions have an owner:
- Who, by name, answers to us for data risk across privacy, security and AI?
- Do we know where our most sensitive data sits, and which AI tools can reach it?
- How many separate assessments does one new use of data trigger, and do they reach the same conclusion?
- What data have we authorised our security teams and AI systems to collect and keep, and for what purpose?
- How would we detect AI tools in use that we have not approved?
If these questions have no clear answers, the gap is ownership. A Fractional Chief AI Officer can bring AI, privacy and security risk under one accountable executive without a full-time hire. The Executive Strategy Day maps your data decisions, who holds them today and how to consolidate them into a single view the board can oversee.
Frequently asked questions
Is data governance a board responsibility or an IT one?
It is a board responsibility, because decisions about what data is collected, kept and shared determine both security and privacy outcomes. Frameworks such as NIS2, DORA and the NIST Cybersecurity Framework 2.0 already place oversight of these risks with leadership. For a full explanation, see Privacy and Security Are One Risk: Why Data Governance Belongs to the Board →
Does data minimisation conflict with effective threat detection?
It can, because threat detection relies on monitoring signals that often include personal data. The answer is not to collect less or more by default, but to have leadership approve what security teams may collect, keep and share, and for what purpose. For a full explanation, see Privacy and Security Are One Risk: Why Data Governance Belongs to the Board →
How does data governance affect how quickly we can respond to a cyber incident?
Fast response depends on knowing where sensitive data sits and who is authorised to act on it before an incident begins. Organisations with scattered data ownership lose time establishing both. For a full explanation, see AI-Speed Cyberattacks: What the Board Must Decide Before the Incident →