Data Maturity: How It Is Assessed and What Comes Next

Part of our topic guides on Data Literacy and AI Skills for Business.

By James Cotton, Founder, iO-Sphere

What data maturity means, and what a level is

The Data Maturity Assessment for Government framework, published in March 2023 by the Government Digital Service and the Central Digital and Data Office, "has been created specifically for use in the public sector". This guide borrows it as a reference for companies.

It opens on a definition: "An organisation's data maturity - its capability, effectiveness and readiness to use data - is fundamental to achieving its strategic, operational and corporate priorities."

It is a self-assessment, and how an organisation runs it "can provide a deep or shallow, wide or narrow picture of its data maturity". There are five levels: Beginning, Emerging, Learning, Developing and Mastering. "When read in order," the framework says, "the characteristics in each of the levels describe a progression from low to high maturity."

How the government's assessment scores a row and a topic

The framework's publication page dates it to 27 March 2023, and since 23 July 2026 it has said that a new version is being developed. The current text is "a self-assessment framework", "organised around 10 topics, intersected with six themes, arranged across rows, with each row providing 5 maturity levels".

Each row is one criterion of the assessment, with a statement for each level. Row 37, "Basing decisions and organisational planning on data", reads "Uses past and current data to understand trends and support some decision making" at Level 3 and "Uses past, present and forward looking data for business planning and decision making" at Level 5.

The ten topics, in the framework's order, are Engaging with others; Having the right data skills and knowledge; Having the right systems; Knowing the data you have; Making decisions with data; Managing and using data ethically; Managing your data; Protecting your data; Setting your data direction; and Taking responsibility for data. The delivery guide published with it puts the comprehensive assessment at 97 rows.

For each row, an organisation "chooses the maturity level which best describes their current state", and one of the guide's principles settles the choice: "Default to the lower maturity level: if you do not meet all the criteria of a level, choose the level below." A row that meets most of Level 3 is scored at Level 2.

The framework says an assessment "does not generate a single 'score'"; it gives "a matrix view of maturity across the topics and themes". The government's results spreadsheet averages row levels into topic results, excluding unassessed rows from each topic's average, and if "fewer than 40 rows are assessed, maturity results cannot be generated".

Ties go down as well. The spreadsheet's note reads: "When there is an even split of levels for a topic or a theme, the average score and data maturity level defaults to the lower level."

Its example: "a topic with 3 rows at level 2 and 3 rows at level 3 would have an average score of 2.5 and data maturity level of 2 - Emerging." The note's reason is that a topic has to be clearly over the threshold to reach the next level.

Ranking the ten topics and testing the lowest

Those ten topic results are what you rank, lowest first. The framework says why low areas matter: "Areas of low data maturity that present a risk to the delivery of organisational priorities can be identified and resolved. Areas of good or high maturity that are critical to successful delivery can be maintained."

The delivery guide asks for recommendations on which lower-maturity areas to prioritise "for improvement" and which higher ones "for monitoring or maintenance". It takes the risk register for the assessed area as an input, and asks whether any low area presents "a challenge, barrier or risk" to that area's aims, and whether lower maturity is costing it efficiency.

Put the bottom topic through both questions. The answers say what its weakness puts at risk, and they settle which topic goes first when two tie. The guide's example of a result line reads: "Our result for the topic 'Having the right systems' was Level 2 - Emerging."

The six themes help explain why a topic sits low: the framework calls them "a lens" on "the drivers of high or low maturity", and the spreadsheet warns that theme results "are less robust than for the topics, and should not be used as a standalone measure".

In its 2021 announcement of the model, the Government Data Quality Hub, based in the Office for National Statistics (ONS), said the prototype, then called the Government Data Maturity Model, "can only reveal what needs to be done".

Our view: a board that wants one line should get the lowest topic and its level, named as a floor, not a score, because the topic sitting there is where the work starts.

Running the assessment so the result holds up

The delivery guide records that for the first round, in 2023 to 2024, senior leaders in government were asked to give accountability for the first year's goals to an appropriate officer: a data specialist, or a non-specialist such as the chief operating officer, with the data office advising and leading delivery.

It asked for a "deep" assessment, drawing on several sources of evidence, of "a strategically important part of the organisation", even one "where you may not be confident of achieving a strong maturity result". For smaller organisations without separate business units, it suggested a "whole organisation" approach.

The guide allows a smaller assessment that still includes all ten topics in proportion, leaves the wording of the rows alone and runs to about 50 rows or more, above the spreadsheet's floor of 40. The guide warns: "Take care to not eliminate rows because they may return a low maturity score."

Inputs should include "expert views, non-expert views, information and evidence", with judgements based on "the typical and usual" so that outliers count for little. Documents get questioned too: "The existence of documentation is not in itself proof of a particular maturity level."

The guide accepts that "there is no single methodology which will guarantee impartial, fair and accurate results". One expert as the only source is unlikely to guard against bias, so it sets out stages of validation, from design and delivery to confirming the results are fair and remedying any that are not.

The Hub piloted the model in 11 government organisations for six months from November 2021. Its 2022 account of the pilot found that "although generating data maturity scores is useful, the process of conducting a self-assessment is greatly beneficial".

For government bodies, a standard now backs this. Government Functional Standard GovS 005: Digital, version 2.2, issued in September 2026 by the Government Digital and Data function, says each organisation "shall assign senior accountability for data", a mandatory element, and "should assess data maturity across technical, governance, cultural, skills and leadership factors using an appropriate framework", an advisory one. It names no framework.

Other maturity models, and what their levels mean

A level number means something only beside the name of the framework that set it.

In The DAMA Guide to the Data Management Body of Knowledge (DAMA-DMBOK2R), DAMA International defines a data management maturity assessment as "A method for ranking practices against maturity levels for handling data used by the organization to characterize the current state of data management and opportunities for improvement".

Its steps run from "Plan the Assessment Activities" to "Re-assess Maturity", and "Employees" sit among the participants beside "Maturity Assessors". DAMA's DMBOK page adds that the body of knowledge "does not prescribe specific tools, technologies, or methodologies".

The government's framework says it "has been adapted from the Data Orchard Data Maturity Framework", which the Hub, having led the government version's development and testing, described in 2022 as "originally designed for use in the third sector". Data Orchard's framework has five stages, Unaware, Emerging, Learning, Developing and Mastering, and seven themes: uses, analysis, data, tools, leadership, culture and skills.

Its stages sit on a 0 to 5 scale, from 0 to 1 for Unaware up to 4 to 5 for Mastering. Data Orchard asks whole organisations to take part, because knowledge about data maturity "is collectively held", and calls a combined organisational score "a 'truer' and more accurate reflection of your organisation's data maturity".

The EDM Council, now trading as the EDM Association, publishes its Data Management Capability Assessment Model (DCAM). Version 3, launched in June 2025, organises 34 capabilities and 101 sub-capabilities in eight components, scored on engagement, process and evidence, and EDM says "DCAM is available exclusively to our member firms."

The DCAM page shows, in a graphic from before version 3, a scale of six levels from "Not initiated" to "Enhanced", with the step from Developmental to Defined labelled "CROSSING THE CAPABILITY CHASM".

ISACA, which owns CMMI, added a Data Management domain to it in April 2023, sold under a model licence. CMMI's general maturity levels run from Level 0, Incomplete, to Level 5, Optimizing, separate from those of its older Data Management Maturity model.

Where most organisations sit today

The ONS's Management and Expectations Survey asked UK firms about their management practices in 2023. It went to 53,433 businesses with 10 or more employees, excluding agriculture, financial services and the public sector, ran from November 2023 to March 2024, and had a 27% response rate.

Its bulletin, Management practices in the UK: 2016 to 2023, reports that 28% of firms used little or no analysis for important decisions in 2023 (firms could name more than one type of analysis). That bears on the Making decisions with data topic, and places no firm at any level.

In the top tenth of firms by management practice score, 5% used little or no analysis in 2023; in the bottom tenth, 79% did, and firms below the median were four times more likely to use little or no analysis.

Data Orchard's State of the Sector: Data Maturity 2025 draws on organisations that chose its own tool and rated themselves, from many countries, most in the UK. Over the five years to March 2025, 50 of 1,088 reached Mastering, 5%; in 2024 to 2025, 6% of 269 did, and most were at Learning or Developing.

The same report finds "no correlation between the size (by annual income) of organisations and their data maturity". Income was missing for 657 organisations, mostly commercial and public sector ones, which matters when the finding is applied to companies.

EDM's 2026 benchmark, a global survey of the association's own members and contacts, finds the same middle: "most organizations continue to operate within the 'Developmental' or 'Defined' capability ranges" across nearly all DCAM components. Its press release reports that 77% of those surveyed have established analytics capabilities and 19% demonstrate mature adoption and education.

When skills sit at the bottom

In Data Orchard's 2025 report, again from its users' self-assessments, its Skills theme is the weakest in every sector, five years running, and the report calls the skills challenge "a problem in leadership teams and across the whole workforce". The government framework's separate topic, Having the right data skills and knowledge, covers "the data and analytical literacy you need and have in your organisation".

Over the last two years of its data, staff in 52% of organisations said their leaders know data is important but are not convinced of its value; in 34%, staff called their leadership engaged and active in harnessing it.

Row 12 of the government grid runs from senior leaders who "require specialist support" at Level 1 to Level 5, where "All senior leaders are confident in making extensive use of analyses and data independently or with minimal support". Data Orchard's advice to commercial organisations is: "Develop workforce-wide data literacy: Move beyond specialist roles to embed data skills across all teams."

On row 18, closing skills gaps, Level 1 reads: "Uses a single method for addressing skill gaps such as contracting, upskilling, recruitment, without considering or weighing the options." Level 5 reads: "Fully considers all options when addressing data skill gaps in line with the organisation's long and short term skill needs." Row 21's Level 5 reads: "Proactively seeks to upskill existing staff to meet upcoming needs."

The leaders, specialists and other data users a low skills result names are the people our team training teaches. For a board or executive team, we build a custom session around the board's own papers and decisions. The person taking on the organisation's data governance, data quality or data management can train on our Data & AI Governance (Level 4) apprenticeship.

The step out of each level

Beginning. The Level 1 rows describe acting only when forced: row 14 funds data training "only where it is externally mandated by legal or policy requirements", and row 27 funds tools "only when critical systems fail or when changes are legally required". The step is the first decision taken unforced: someone who answers for data, and a record of what data the organisation holds.

Emerging. At Level 2 the framework describes data "seen as an IT or administrative responsibility" and left to specialists, and a governance policy that is "not understood, known or possible to implement" (row 91). The step takes data beyond IT, with policy that people understand, which is how the Level 3 description reads.

Learning. At Level 3 non-experts still need specialists, and quality is fixed at the root (row 58). The step is Level 4: non-expert users with "little or no reliance on specialist support", quality assessments "evidence-based and tracked over time" (row 65) against the data quality dimensions in the government's 2020 framework, and a senior person or team bringing organisation-wide data together (row 96).

Developing. Practice is uneven at Level 4: row 14 has upskilling that "occurs inconsistently across the organisation without coordinated senior oversight". The step is the same practice everywhere: at Level 5 of row 14, "Plans for improving data literacy are aligned with wider business plans", and at Level 5 of row 87, data strategy is planned and prioritised within the organisation's strategy.

Mastering. The step from Mastering is to hold it: keep up the areas delivery depends on, as the framework and the delivery guide both suggest, and assess again. The Government Data Quality Hub said in 2021 that data maturity "can vary substantially over time, for example as a result of changes in data availability, analytical capability or even leadership".

Frequently asked questions

Is there a data maturity assessment made for companies?

Data Orchard's was revised for that in 2022: its State of the Sector 2025 report says it became "completely sector agnostic and useable for any organisation in any sector". It "takes about 20 minutes to complete", and a free individual version exists. Data Orchard sells the organisation assessment: commercial packages run from £2,999 plus VAT (Bronze, annual income less than £1M) to £15,999 plus VAT (Gold, £10M+).

Which comes first, data maturity or AI?

What the organisation has to deliver decides it, and there is no fixed order: some organisations start with their data, some with AI and some with both. The Government Digital Service's AI Playbook of February 2025 made a narrower point about the government's own AI governance structures: they can still be taking shape when a first AI project starts.

How long does it take to reach Mastering?

Eight to ten years of concerted effort, by the self-reported account of the organisations at the forefront in Data Orchard's 2025 report on users of its own tool. Those that reach Mastering are also far more likely than organisations at earlier stages to agree they are investing enough in data.