Who Owns Your Data?

What Is on the Agenda?

Five findings on the table.

Ruleless tool use gets expensive

Unauthorised AI tools appear in roughly a fifth of breaches. They also add a serious sum to the average cost. Almost all those incidents hit companies without access controls. So the tool is not the problem. The missing frame is.

Duration drives the cost

Spotting and containing a breach takes 241 days on average. Anything past 200 days costs markedly more. At small scale the fixed costs dominate. Being small offers no protection. You carry the same load on a smaller turnover.

Scattered data does damage twice

Data spread across several environments costs more to breach. The same scatter also blocks use. So orderly data pays twice. It gets protected and it gets used.

An asset that cannot travel

Ownership means being free to walk away with what you own. Records locked inside one system fail that standard, whatever the paperwork claims. Trying an export once a year is the plainest check there is.

Buyers are asking too

Large customers have added data headings to supplier assessments. Which system holds it? Does it reach third parties? What is the retention period? Firms caught unprepared get eliminated despite their technical competence.

Why Is the Question Being Asked Now?

Four reasons.

Each subscription claims a share

A few systems once held everything. Now every service keeps its own slice. AI tools joined that queue too; each prompt leaves a trace. Nobody decides any of this. It simply happens until no one can account for the whole picture.

Systems are no longer long-lived

A programme installed once used to stay for a decade. Now prices change, services close, better options appear. Switching has become a frequent subject. And whoever lacks their data at that moment cannot negotiate.

Reading got easier

Reading a table and summarising it once required separate expertise. Today tools do it in minutes. The remaining difficulty is not technical. It is knowing what to ask. Only the person running the work knows that. So the obstacle sits in the question, not the tool.

The absence of rules produces risk

Where the organisation sets no rule, employees decide for themselves. Nobody acts in bad faith. But where the data goes stays unrecorded. Invisible use cannot be governed. A ban does not solve it either; it pushes the use out of sight and enlarges the risk.

What Is Wrong?

Four assumptions leave businesses unprepared.

Thinking the risk belongs to large firms

When headlines carry million-dollar figures the subject looks distant. Yet the notification, legal and investigation lines do not get cheaper at small scale. A hundred-record incident carries much the same burden as a thousand-record one. Fixed costs do not shrink with scale.

Treating security as software

Buying antivirus is one thing. Knowing who reaches what is another. Most effective measures are free. Clearing unclosed accounts, removing stray permissions, naming a single source. These get done with attention, not software. Half an hour of review can outperform a monthly subscription.

Leaving responsibility to the provider

The cloud provider protects the infrastructure. But which data goes there is your decision. So is who reaches it and how long it stays. When an incident happens the customer talks to you, not the provider.

Setting the arrangement up once and forgetting

New tools get added. Employees change. Providers update their terms. An arrangement left two years survives only on paper. Keeping it alive costs a few hours a year, far cheaper than rebuilding it.

The Real Mechanism

The data arrangement has four parts.

Part 1: the inventory

Which data sits where, in whose name, reachable by whom? One four-column table suffices and it should stay under twenty rows. The inventory comes out in half a day and lays the ground for the rest. Filling it in with someone who knows the work is essential; the technical team knows where data sits, not which parts are critical.

Part 2: the rule

Which data may not enter which tool, which output may not be used unchecked, who is responsible? One page suffices. The permitted area gets written too, so the rule stays credible. A rule banning everything regulates nothing, and an unenforced rule counts as unwritten.

Part 3: portability

Can you get your data out? A one-hour test answers it. The real stage is the third one: opening the resulting file in another programme and checking what is inside. Did the notes and attachments arrive too?

Part 4: use

The data gets protected, but does it turn into decisions? No table works without a decision question. The test is simple: can you say which decision this answer will change? If not, that question is curiosity rather than a need.

Who Is Affected, and How?

The same arrangement takes a different priority in four situations.

The business with data in one place

The most comfortable position. The inventory is short and the portability test finishes on one tool. The only risk here is excessive comfort: dependency on that single system runs high. An annual export habit balances it, because relying on one system feels easy but leaves you without options when the provider changes its terms.

The business with data spread across many tools

The most common situation and the profile needing most work. Inventory first, then the single-source decision. Which system counts as authoritative for each data type has to be written down, or the later steps produce nothing and two versions of the same information circulate — with meetings spent arguing which is right.

The business trading through a platform

Somebody else sets the rules and can change them. The priority here is building your own channel: moving customer communication partly outside the platform. A business tied to one channel is left without options when the rules shift, and accepts commission increases without negotiation.

The business starting to try new tools

Exactly the right moment. No data has accumulated and no dependency has formed. Three questions asked before subscribing take a tenth of the time the same questions take afterwards. And if you dislike the answers, you can pick another tool; leaving before data accumulates costs nothing.

Decision Order

Four steps, in order.

One: build the table

Four headings, a short list, half a day of effort. Sit down with whoever actually runs the process.

Two: mark the critical rows

One question per row: what happens if this data is lost or gets out? Four categories tend to surface first: who your clients are, how you price, what you have signed, and anything personal. Concentrate the effort there rather than spreading it evenly.

Three: try the exit route

Run the export on the system holding the marked data and open the file in another programme. This hour-long attempt shows your dependency level clearly. Even a bad result is valuable, learned on a calm day.

Four: write the rule and ask one question

Write the one-page usage rule and set this quarter’s decision question. The rule closes the risk; the question releases the value. Together they complete the arrangement, and either one missing leaves it half-built.

Where to Start?

The first month, four weeks.

Week one: the inventory

Fill in the four-column table and mark the critical rows. Half a day suffices, and asking a few colleagues enriches the list.

Week two: access and rule

Close the unnecessary access and write the one-page rule. Both are free, both take a few hours. Remember to explain the rule in a meeting.

Week three: the portability test

Test your most critical tool and open the resulting file elsewhere. Note the outcome in one line; that note serves you later at the negotiating table.

Week four: one decision question

Pick a real decision you face this quarter and answer it with a single table. By month’s end your data is both protected and used — an arrangement working on both sides.

What Not to Do?

Four habits break the arrangement.

Never cleaning up access

Permission granted for a temporary job stays for years. A departed employee’s account stays open. Without regular review that list grows quietly and the cheapest measure gets missed.

Accumulating critical data on personal devices

A quote archive kept on someone’s own machine sits outside the organisation’s control. What happens if the device is lost usually goes unconsidered — yet moving critical data to a shared space is a day’s work, and once done it becomes habit.

Deleting contract notifications unread

Terms change and the notice arrives by email. Those emails get deleted unread. Years later nobody knows what was agreed. An annual pass over the agreements you depend on closes that gap.

Looking at a dashboard and deciding nothing

Building an indicator screen is easy; extracting a decision from it is hard. A dashboard not tied to a question stops being opened by the third week. Measurement turned into decoration is no better than no measurement; every indicator needs a question behind it.

What to Watch?

Four indicators.

Inventory freshness

When was it last updated? Older than a year and it no longer reflects reality. Each new tool adds a row and the list ages quietly.

The access list

Have departed employees’ accounts been closed? This check belongs at every departure, not in the annual review.

Portability status

Which tool releases data, which does not? One line per critical system: does the export work, is the file usable? That note strengthens your hand in renewal talks.

The decision counter

How many decisions this quarter came from looking at data? If the answer is zero, data is accumulating without earning anything. Protected but unused data is an incomplete arrangement.

How Does This Period End?

Three separations will show.

Data order will become a sales matter

Corporate customers keep expanding the data questions in supplier audits. A business that answers cleanly will beat a technically equal rival. One that cannot will drop off the list. So keeping an inventory stops being a compliance chore and turns into a document that works at the sales table.

Those who can move will negotiate

A business able to retrieve its data holds an option when prices rise or service slips. One that cannot has to stay whatever the terms. That difference lands directly on price at renewal; providers work to keep customers who can leave, while those obliged to stay never even get an improved offer.

Those who ask questions will pull ahead

Data accumulates everywhere. The difference will appear among those who look at it and decide. Complex analysis is not required. A real question and a single table suffice for most businesses; the hard part is not finding a tool but framing the question and tying its answer to a decision.

A Solid Digital Foundation

Four documents, each one page.

The inventory table

A short list, growing by one row whenever a new system arrives. An annual review suffices.

The one-page usage rule

Which data may not be entered, which output may not be used unchecked, who is responsible? Three headings, one page. Reviewed every six months.

The exit status note

One line per critical system: does the export work, is the file usable? That note strengthens your position in renewal conversations.

The decision log

The decision itself, the figure it rested on, the review date. Kept short, and a year later it becomes the most consulted document you have.

Frequently Asked Questions

Where do we start? The list looks long.

Start with a single row. Note your single most valuable record, which is often the client list. Which system holds it? Under which account? Who has the keys? Those answers tend to sting a little, and the sting points straight at the next task. Trying to draw the whole inventory in one sitting leads to never starting. One row today, the rest this week.