Recommendation 29

The BBC welcomed the recommendations made by the NAO which included on managing potential data risk and said it was taking action on oversight and policy. It outlined some actions taken in recent years to improve its approach, stressed that these things were key parts of the organisation, and that development of governance in this respect was crucial to make sure the BBC did not breach its data regulations.52 While it would inevitably be collecting more data in future, the BBC felt the framework it had in place meant it was in a good position to mitigate any risk.53 However, in reviewing BBC planning documents on using customer data the NAO found no references to its approach to the management and mitigation of reputational and other potential risks that could arise as it increases its use of such data.54