Data Protection as a Public Social Responsibility: Adapting the UM-DPCSR Framework for Ethical Data and AI Governance in the Public Sector

This thesis explores how the UM-DPCSR (University of Maastricht – Data Protection as a Corporate Social Responsibility) framework can be adapted as a voluntary, incentive-driven model for European public institutions. Through theoretical analysis, a private vs. public comparison, and case studies, it identifies the public entities most likely to adopt the framework and evaluates the reputational, operational, and societal benefits of doing so. It argues that embedding the framework’s principles transforms data protection and AI oversight from a compliance task into an ethical, citizen-centric process that strengthens trust, mitigates algorithmic bias, and aligns with the GDPR and the 2024 AI Act. Finally, by recognising resource and bureaucratic hurdles, this thesis shows how open-source software, AI-based privacy tools, and EU digital-sovereignty initiatives can minimise adoption costs and technical barriers.