Data may be moving from being an enterprise cost to becoming an enterprise asset — and potentially, a new source of revenue.

That shift has implications well beyond the technology function. If organisations can identify high-value data, establish who owns it, assure its quality, govern its use and create trusted ways to share or exchange it, data could begin to be managed with the same commercial discipline applied to other strategic assets.

One thought from the recently concluded ETCISO Annual Conclave has stayed with me.

Across the conversations I moderated and listened to, there was a recurring tension around data: how do you protect it, comply and still make it useful to the business? We spoke about AI increasing the volume and velocity of data, about privacy and regulatory obligations, about visibility and control, and about the difficulty of knowing where sensitive data actually sits once it moves across increasingly complex technology environments.

But one conversation took that debate somewhere else.

A DPO spoke about putting data through a six-point framework before it can genuinely be put to work. Then came the question that caught my attention: could enterprises eventually create data exchanges — and think of data itself as a profit centre?

That was not the usual privacy conversation.

And I found myself thinking about it long after the Conclave.

Because we have spent years talking about data as something to protect, govern and comply with. Then AI came along and made us talk about data as fuel.

Perhaps the next conversation is about data as an economic asset.

Not about selling data indiscriminately. Not about putting a price on people’s information.

But about something more fundamental: if an organisation can make its data trusted, governed and usable, can it create measurable economic value from it?

The six-point framework the DPO described was refreshingly practical: identify where the value is; map the data that can create it; establish ownership and quality; put security, privacy and compliance around it; build the technology and lineage to make it usable; and then package it, take it to market and measure the return.

It sounds straightforward.

Yet many organisations are still struggling with the question that comes before all of this:

What data do we actually have — and can we trust it?

And perhaps that is where the real conversation about data monetisation needs to begin.

From “Can we use it?” to “What can it create?”

The privacy conversation has understandably been about boundaries.

If the data is properly governed, what value can we create from it?

That subtly changes the role of the DPO.

There is potentially a much more valuable role in helping the business understand what it can responsibly do with data — and under what conditions.

Because data isn’t automatically an asset simply because an organisation has a lot of it.

Poor-quality data isn’t valuable.

Trust, therefore, may become one of the defining attributes of valuable data.

The data exchange

We are already comfortable with marketplaces for products, services, cloud capacity and computing power.

Could data eventually have its own trusted exchange?

That doesn’t necessarily mean companies putting raw datasets up for sale.

It could mean controlled access to data, exchanging datasets, sharing insights or allowing a partner to use specific information for a defined purpose.

But building that kind of ecosystem would require much more than a technology platform.

It would need provenance, permissions, security, quality standards, accountability and visibility into how the data is being used — particularly as AI increasingly sits between the data and the eventual business outcome.

So perhaps a data exchange is as much a governance challenge as it is a technology opportunity.

What is the data worth?

This is the part I find most interesting.

Companies already spend heavily on collecting, storing, securing, cleaning and managing data.

But how many can actually put a number to the value that data creates?

If data starts being treated as an economic asset, that question could eventually move beyond the CIO, CDO, DPO and CISO and into the CFO’s office.

• What is our data worth?
• What more could it be worth if combined with other data?
• What makes one dataset more valuable than another?
• And who should capture that value?

Those are very different questions from the ones enterprises have traditionally asked of their privacy and security teams.

They may increasingly have to become part of the conversation. But there is an important caveat. There is a danger in making “data monetisation” the destination.

The moment data gets a price tag, there can be a temptation to maximise its commercial value. That cannot come at the expense of privacy, consent or trust.

The more valuable data becomes, the more important governance becomes.

The real test of a data exchange won’t be how much data it can move. It will be how much value it can create without compromising trust.

And perhaps that is the more interesting data conversation ahead.

AI has made enterprises acutely aware of the value locked inside their data. At the same time, it is exposing just how messy, fragmented and poorly governed some of that data can be.

So the next data transformation may not simply be about putting more data into AI.

It may be about building the trust infrastructure that allows data to move safely, responsibly — and commercially.