Data ethics
A separate governance perspective on the Organisational layer: asking whether the exercise of scoped authority is proportionate, fair, transparent and justifiable to the people and communities affected.
A use can be lawful and contractually permitted yet still create avoidable harm or exclude the people who bear its effects. Ethics makes that responsibility visible without pretending there is one universal score.
Data ethics is a separate perspective on the Organisational layerThe four layersThe three rights apply across Data, Software, Hardware and an Organisational layer described through data compliance and data ethics.Read more →, alongside data complianceData complianceThe enforceable side of the Organisational layer: the applicable laws, jurisdictions, contracts, licences, policies, decision rights and supplier commitments that set what an organisation may and must do with data.Read more →. Even where an action is lawful and contractually permitted, it remains necessary to ask whether taking it in this context and in this way is responsible.
A responsible review considers purpose and necessity, less intrusive alternatives, the distribution of benefits and harms, unfair or discriminatory effects, clear communication, meaningful participation and routes to question or remedy an outcome. Consent is relevant where it is valid and appropriate, but it is not the only legal basis or the only form of agency.
Ethics applies across all three rights. Possess asks whose interests and dependencies must be respected when continuity material is retained. Use asks whether authority is exercised proportionately and accountably. Dispose asks how deletion, retention, transfer and exit affect people and communities as well as the organisation.
Governance operates across both lenses. It assigns responsibility, approves policy, records evidence and exceptions, includes affected perspectives and provides review and escalation without handing discretionary control back to a supplier.
Data ethics is not a legal verdict, score or certification. It does not determine or change a conclusion about practical control. Keep its observations separate from compliance findings and practical-control findings, so one does not silently stand in for another. It can still lead to a separate, owned governance action.
Common misconceptions
If a use is compliant, it is ethical.
Law and contracts set enforceable boundaries. Ethical review also asks who benefits, who bears risk, which alternatives exist and whether affected people can understand and challenge the choice.
An ethics framework makes the answer objective.
A framework structures evidence, responsibility and disagreement; it does not remove judgement or certify a system as ethical.