Be a Data Custodian, Not a Data Owner

While data may be the new oil, businesses can no longer view it as an asset to be extracted and exploited. The reality is that no company owns customer data — rather, customers entrust them with it. Instead of thinking like “data owners,” companies must act as “data custodians” who protect personal information and use it only with a customer’s best interests in mind. Drilling for data can seem like a limitless source of profit, but trust is the real resource that businesses should be mining. The organizations that succeed in protecting consumer data in the coming years will be those that build long-term, trusted relationships with customers by humanizing data and taking responsibility as its custodians.

“Data is the new oil.” In the years since mathematician Clive Humby coined this phrase in 2006, the idea has taken on new meaning. For businesses today, personal data is not just a resource — it is a core profit-driver. But the value placed on “drilling for data” has come with a high price at the human level: a dangerous mindset of data entitlement, whereby companies collect personal information and use it to make money, with little regard to the people who lent it to them in the first place.

Data entitlement puts a business’s reputation and customer trust at risk. It can be immensely expensive, as companies such as British Airways and Marriott learned firsthand when they were fined hundreds of millions of dollars following major data breaches, under the General Data Protection Regulation (GDPR), the data privacy regulation implemented by the European Union in May 2018. The personal information being leaked is not just a collection of files stored on a server somewhere; it amounts to the intimate details of peoples’ lives.

While data may still be the new oil, businesses can no longer view it as an asset to be extracted and exploited. The reality is that no company owns customer data — rather, customers entrust them with it. Instead of thinking like “data owners,” companies must act as “data custodians” who protect personal information and use it only with a customer’s best interests in mind.

Becoming a data custodian does not require expensive infrastructure changes or writing a single new line of code. Often, irresponsible data use is cultural — fixing it involves weaving data custodianship into employees’ day-to-day processes. Four cost-effective tactics can help any business get started:

A monthly or quarterly “data accountability report” is a simple and effective way to promote transparency and peer-accountability around personal data use. The report can be straightforward, listing how many customer records each employee or team has accessed in the past month or quarter. Making someone’s actions visible is a proven method for changing human behavior — just look at how step counters have encouraged people to be more active.

To be clear, accountability is not about shame or blame; instead, it is about empowering employees with knowledge. Simply seeing how many times they have accessed personal data compared to colleagues can make them think and act differently. Distribute reports without rankings, commentary, or judgment.

Flip the data owner mindset on its head by celebrating the teams that access the least amount of personal data to perform their jobs.