Ensuring Compliance in Digital Transformation: Developing and Validating the Data Management Stage Model

Ineffective data management is a key reason for digital transformation failures. To address this, capability maturity models for data management have been developed over the past few decades. However, a systematic literature review revealed that most of the existing models insufficiently address legal compliance—a dimension increasingly critical in light of global regulatory developments such as the General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA), china’s Personal Information Protection Law (PIPL), and the European Union Artificial Intelligence Act (EU AI Act). These frameworks have introduced more stringent, complex, and cross-border obligations that challenge conventional data management practices. Neglecting compliance not only exposes organizations to legal risks and reputational damage but also undermines the ethical and secure handling of data, making it a foundational concern rather than a peripheral one. This study proposes a comprehensive data management stage model (DMSM), developed and validated through a Design Science approach that integrates Grounded Theory, conceptual mapping, two rounds of expert assessment for model validation, and empirical verification with ten real-world companies. The model spans six maturity stages (Stages 0–5) and ten dimensions, including Data Acquisition, Metadata Management, Data Storage, Data Sharing, Data Analytics, Data Visualization, Quality Control, Compliance, Operating Infrastructure, and Budget Allocation. These are further organized into subdimensions such as Strategic Planning, Governance, Leadership and Culture, Ability to Perform, Activities Performed, and Process Assessment. This article places particular emphasis on the Compliance dimension, which encompasses 33 capabilities, including cross-border policy alignment and regulatory preparedness, supported by transition tables for practical application. By embedding compliance within a structured maturity framework, the DMSM enables organizations to evaluate and strengthen their legal, ethical, and data security capabilities. It thus serves as both a theoretical contribution and a practical tool to support responsible digital transformation, offering a robust foundation for future research and model refinement.