Ensuring Compliance in Digital Transformation: Developing and Validating the Data Management Stage Model
针对现有数据管理成熟度模型忽视法律合规性的问题，通过设计科学方法开发并验证了一个包含六个成熟阶段和十个维度的数据管理阶段模型，特别强调合规维度，帮助组织评估和加强法律、伦理和数据安全能力。
Ineffective data management is a key reason for digital transformation failures. To address this, Capability Maturity Models (CMMs) for data management have been developed over the past decades. However, a Systematic Literature Review (SLR) revealed that most existing models insufficiently address legal compliance—a dimension increasingly critical in light of global regulatory developments such as the GDPR, CCPA, China's PIPL, and the EU AI Act. These frameworks have introduced more stringent, complex, and cross-border obligations that challenge conventional data management practices. Neglecting compliance not only exposes organisations to legal risks and reputational damage but also undermines the ethical and secure handling of data, making it a foundational concern rather than a peripheral one. This study proposes a comprehensive Data Management Stage Model (DMSM), developed and validated through a Design Science approach that integrates Grounded Theory, conceptual mapping, two rounds of expert assessment for model validation, and empirical verification with 10 real-world companies. The model spans six maturity stages (Stage 0 to Stage 5) and ten dimensions, including Data Acquisition, Metadata Management, Data Storage, Data Sharing, Data Analytics, Data Visualisation, Quality Control, Compliance, Operating Infrastructure, and Budget Allocation. These are further organised into subdimensions such as Strategic Planning, Governance, Leadership and Culture, Ability to Perform, Activities Performed, and Process Assessment. This paper places particular emphasis on the Compliance dimension, which encompasses 33 capabilities including cross-border policy alignment and regulatory preparedness, supported by transition tables for practical application. By embedding compliance within a structured maturity framework, the DMSM enables organisations to evaluate and strengthen their legal, ethical, and data security capabilities. It thus serves as both a theoretical contribution and a practical tool to support responsible digital transformation, offering a robust foundation for future research and model refinement.