Every year on 10 December, Human Rights Day marks the adoption of the Universal Declaration of Human Rights (UDHR), reaffirming the global commitment to uphold dignity, freedom, and equality for all. Though the declaration predates the digital era, its principles are more relevant and vital today than ever before.  

Today, personal data is deeply embedded in how we work, communicate, travel, shop, and live. Organisations increasingly rely on data-driven systems to deliver services, evaluate performance, manage risks, and make decisions—and the way they handle that personal data directly affects people’s autonomy, security, equality, and freedoms.  So, with this reliance comes a clear responsibility: to respect the inherent dignity and rights of every individual whose data is collected or processed. 

This is why data dignity must become a core principle of data protection and privacy. Data dignity places the individual, not the data, at the centre of organisational decision-making. It reframes data protection from a technical exercise aimed at regulatory compliance into an ethical responsibility.  

Why this matters now 

The rapid proliferation of digital services, cloud infrastructure, remote working, AI, automation and data analytics has expanded both opportunities and risks. Every new tool or channel is another potential path through which personal data might be misused, mismanaged or exposed. 

Human behaviour remains a primary vulnerability, as research continues to show that breaches are significantly enabled by unintentional actions or oversight by individuals. Meanwhile, according to the HIPAA Journal, in 2024 alone, over 1.7 billion individuals had personal data compromised in major breach incidents, a stark reminder of how widespread and consequential data risk has become.  

Given this landscape, data dignity is not a nice-to-have; it is a practical imperative. Organisations that take it seriously are better placed to protect individuals’ rights and their own reputations and stability. 

What organisations can do 

Organisations that aim to treat data dignity as more than rhetoric should embed respectful data practices throughout their operations. That involves thoughtful, rights-centric strategies. 

One starting point is to conduct what you might call a “Human Rights–Centric Data Review,” going beyond traditional privacy assessments. This means evaluating whether data collection, processing, and retention practices could have unintended impacts on individuals’ autonomy, fairness and freedom.  

It means asking important questions like: 

  • Should we collect this data, not just can we? 

  • Are individuals treated fairly when decisions are informed by their data? 

  • Do people understand what is being done with their information? 

  • Are vulnerable groups protected from disproportionate harm? 

  • Could certain practices lead to unfair profiling or discriminatory outcomes? 

  • Are we minimising power imbalances and avoiding intrusive surveillance? 

  • Have we built safeguards that treat people as rights-holders, not data points? 

Transparency and informed consent are also critical. It is not enough to issue generic privacy notices, organisations should strive for clarity, accessibility, and genuine understanding. Individuals should know what data is collected, why, how it will be used, for how long, and how they can exercise their rights. This becomes especially important in contexts involving automated decisions, profiling or sensitive personal data. 

Where automated decision-making or predictive systems (e.g. AI, analytics, behavioural profiling) are used, organisations must proactively address fairness, bias and accountability. This may involve regular fairness audits, explainability measures, human oversight, and mechanisms for individuals to challenge decisions. Data dignity demands treating people as individuals with rights and agency. 

Privacy-by-design should also be a core principle. This includes data minimisation (only collecting what is strictly necessary) and robust data security measures. It also means limiting intrusive surveillance or monitoring, especially for employees or end-users, unless absolutely justified, proportionate and transparent. 

Importantly, individuals should have real channels for redress, including the ability to access their data, correct it, request deletion, or raise concerns. Without meaningful redress, privacy rights remain theoretical. 

Finally, and perhaps most critically, organisations should empower their Data Protection Officers (DPOs) or privacy governance leads to champion data dignity. DPOs bring a unique blend of legal, ethical and operational oversight, as they can help shape policies, guide risk assessments, oversee fairness in data use, and ensure accountability across all data-driven systems. 

Strong governance builds trust 

Protecting data dignity is not just about avoiding breaches or regulatory fines. It is about safeguarding human rights, building stakeholder trust, and establishing organisational integrity. 

In practice, organisations that embed dignity into their data practices tend to cultivate greater loyalty from customers and employees, attract partners who value ethical conduct, and build resilience against reputational or regulatory damage. They also position themselves as leaders in a digital economy where people matter more than data. 

At HewardMills, we believe that data governance should be rooted in humanity, not just regulations. Our experienced team of DPOs and privacy professionals works with organisations worldwide to embed data dignity practically and operationally. If you would like to explore how to embed human-centric values into your personal data handling, reach out; we are here to support you.