New Digital Products and Business Models

New Digital Products and Business Models as a Source of Opportunity and New Vulnerability

New digital products and business models open markets, accelerate service delivery and enable forms of value creation that could hardly be achieved within traditional processes. Platforms, digital marketplaces, self-service environments, embedded finance, digital identity solutions, subscription models, data-driven personalisation, AI-supported decision-making and automated customer interaction can significantly increase customer convenience, efficiency and reach. At the same time, every new digital proposition shifts the distribution of risk and responsibility. Where service delivery may previously have been linear, transparent and relatively contained, digital business models often create layered ecosystems in which data are continuously collected, enriched, linked, shared, analysed and reused. This increases not only the commercial value of data, but also their legal and operational sensitivity. A product that appears simple at the front end may, at the back end, depend on complex processing chains, external suppliers, algorithmic selections, identity controls, payment routes and security mechanisms, each of which may introduce vulnerabilities.

The core of this vulnerability lies in the fact that digital products are not only used, but continuously generate data about behaviour, preferences, relationships, transactions, locations, devices, risk indicators and interaction patterns. Those data may be commercially valuable, but they may also create an attack surface for phishing, social engineering, credential stuffing, account takeover, online payment fraud, data breaches and misuse of digital identities. An organisation that develops new digital products without systematically testing this risk profile runs the risk that commercial innovation becomes an entry point for Digital Crime Risks. That risk is not limited to technical intrusion or data loss. It also affects the reliability of customer acceptance, the quality of authorisations, the integrity of transactions, the trustworthiness of communications, the protection of vulnerable users and the credibility of representations made to the market and regulators. New digital products and business models may therefore be both a source of growth and a source of structural exposure.

Within Integrated Digital Crime Risk Management, digital innovation must therefore be treated as an early-stage risk domain, not as an end product to be reviewed only after completion. The relevant question is not merely what opportunities a product creates, but also what dependencies, data flows, behavioural incentives and abuse scenarios it generates. A digital proposition that prompts users to make quick decisions, processes sensitive data or grants access to financial, legal or personal information must be assessed for susceptibility to deception, access risk, evidentiary robustness, auditability and recovery options in the event of an incident. This applies with particular force where the business model is based on scale, automation or low friction. The faster and larger a product can grow, the faster errors, vulnerabilities and abuse can also scale. The commercial promise of digital innovation can therefore only be realised sustainably where product development is connected from the outset with Digital Crime Control, data protection, security, compliance and board-level responsibility.

Privacy, Cybersecurity and Integrity Risks in the Design Phase of Digital Innovation

The design phase of digital innovation is the stage at which the most important legal and operational choices are effectively embedded. It is at this stage that decisions are made about which data are collected, which functionalities are built, which user journeys are designed, which third parties are connected, which security levels are adopted, which consent mechanism or legal basis is used and what degree of transparency is provided to users. Where privacy, cybersecurity and integrity risks are assessed only after development, there is a significant likelihood that fundamental choices have already become embedded in code, processes, contracts, dashboards, databases and customer interfaces. Remediation after the fact is then costly, slow and often incomplete. A product may be technically ready, yet legally vulnerable, operationally difficult to control or socially difficult to explain. The design phase is therefore not a preparatory technical step, but a decisive governance moment.

Privacy risks often arise subtly during this phase. A product team may choose to collect data that appear useful for personalisation, analytics or future product improvement, without sufficiently determining whether those data are genuinely necessary for the specific purpose. An interface may request consent in a way that is commercially effective, but insufficiently free, specific, informed or unambiguous. A customer profile may be enriched with data from multiple sources, while insufficient regard is given to the reasonable expectations of the data subject. An automated decision rule may be efficient, but insufficiently explainable or insufficiently supported by human oversight. In all these situations, the issue is not an isolated privacy problem, but an integrity question: the organisation creates a digital relationship with users in which information asymmetry, dependency and influence play a significant role. The legal defensibility of the product then depends not only on documentation, but on the substantive fairness, proportionality and controllability of its design.

Cybersecurity and Digital Crime Risks must be considered in the same design phase, because security cannot be effectively added as a cosmetic layer on top of a vulnerable product. Authentication, authorisation, logging, monitoring, session management, fraud detection, access management, encryption, data segmentation, incident response and recovery procedures must correspond to the risk profile of the product. A digital service that processes sensitive personal data, facilitates payment flows or uses identity data requires different controls from a low-risk informational tool. Integrated Digital Crime Risk Management therefore requires abuse scenarios to be considered at the design stage. Which data are attractive to criminals? Which users can be deceived? Which transactions can be manipulated? Which accounts can be taken over? Which signals indicate automated attacks? Which supplier access creates a chain risk? By asking these questions at the outset, digital innovation is not restricted, but equipped with the controls required to sustain trust, continuity and legal defensibility.

Product Development as the Moment When Risks Can Be Embedded or Prevented

Product development is not a neutral process in which functionality alone is added. Every choice concerning data, access, default settings, user behaviour, commercial incentives and technical integrations helps determine the future risk profile of the product. Risks do not become visible only when an incident occurs; they often arise at the moment an organisation decides to collect certain data, relax certain controls, steer certain user choices or accept certain dependencies on external parties. Where speed and market launch dominate, a development environment can quickly emerge in which risks are not consciously weighed, but implicitly embedded. This may result in products that are attractive to users and appear commercially successful, while beneath the surface they remain vulnerable to abuse, regulatory scrutiny, complaints, data breaches or reputational harm.

Customer onboarding provides a clear example. A low-threshold registration process may accelerate growth, but may also open the door to false identities, automated accounts, misuse of third-party personal data or fraudulent transactions. Default settings provide another example. Where privacy-friendly choices are not made the starting point, and users must actively navigate settings to limit tracking, profiling or data sharing, the product may contain a transparency and trust problem from the outset. Dashboards, data models and internal access rights can likewise embed risks. If too many employees or suppliers have access to too much data, the likelihood of unauthorised use, internal error, data breaches or insufficiently controllable processing increases. Product development therefore determines not only how a product functions, but also how vulnerable it becomes when placed under pressure.

Preventing embedded risks requires a product development process in which legal, technical, commercial and governance questions are addressed simultaneously. This means that a business case must not consist only of revenue potential, user growth and scalability, but must also include an explicit assessment of data necessity, security level, fraud resilience, transparency, contractual dependencies, regulatory sensitivity and recovery capability in the event of incidents. Within Integrated Digital Crime Risk Management, product development thereby becomes a control point for Digital Crime Control. A product designed from the outset with clear data minimisation, appropriate access restrictions, explainable decision rules, robust monitoring, traceable decision-making and clear user communication has a fundamentally different risk profile from a product in which those elements are repaired only afterwards. The difference lies not only in compliance, but in the extent to which the digital product remains governable and defensible when questioned by clients, regulators, contractual counterparties, victims of fraud or society at large.

New Data-Driven Revenue Models as a Governance and Normative Challenge

Data-driven revenue models shift the centre of value creation from the delivery of a separate service to the collection, analysis and use of information about individuals, transactions, behaviour and preferences. This may generate legitimate benefits, such as improved service delivery, risk-based controls, faster processes and more relevant customer communications. At the same time, this revenue model carries a significant governance and normative responsibility. Where the economic value of a product depends materially on data, there is a temptation to collect ever more data, combine ever more purposes and create increasingly detailed profiles. The boundary between customer-oriented service and excessive influence may then become blurred. The boundary between necessary processing and commercial exploitation also becomes less clear where product development is driven by data potential rather than by proportionality and legal protection.

This challenge is not exclusively legal. It concerns the type of digital relationship an organisation seeks to establish with users. A data-driven business model may formally be supported by privacy notices, consent mechanisms and contractual terms, yet still be problematic where users do not in fact sufficiently understand which data are collected, how profiles are created, what conclusions are drawn from them and how those conclusions affect their access, price, treatment or choice environment. In such circumstances, a gap arises between legal documentation and substantive transparency. That gap may be amplified by asymmetry: the organisation has access to data, analytics and behavioural insights, while the user sees only a simplified interface. The governance question is then whether the business model can be defended not only as permissible, but also as reliable, fair and explainable.

Within Integrated Digital Crime Risk Management, data-driven revenue models must also be tested for their susceptibility to abuse. The more value is embedded in data, the more attractive the product becomes to attackers, fraudulent users, internal bad actors and parties seeking to manipulate information. Profiling can be misled by false signals. Automated risk models can be circumvented. Personalised communications can be imitated by criminals to make phishing or social engineering more credible. Customer data can be used for identity fraud or targeted attacks. A data-driven business model is therefore not only a privacy issue, but also a matter of Digital Crime Control. Governance responsibility requires the organisation to look not only at the commercial value of data, but also at the risks that arise when data are collected, linked, analysed, retained, shared or deployed for automated influence.

The Relationship Between Innovation, Scalability and Digital Controllability

Innovation and scalability are often presented as self-evident objectives of digital product development. A product must be capable of rapid growth, easy rollout, multi-market deployment, repeatable application and support for more users at limited marginal cost. That scalability is an important commercial advantage, but it also magnifies the consequences of errors, vulnerabilities and deficient governance. A defective process that appears manageable for one hundred users may, with one hundred thousand users, lead to mass complaints, data breaches, incorrect decisions, fraudulent transactions or regulatory investigation. A weak identity control that is barely visible in a pilot phase may, after wider rollout, become a structural gateway for account takeover or synthetic identities. An unclear consent text that initially attracts little attention may, in the context of large-scale processing, become a fundamental problem of lawfulness and transparency.

Digital controllability means that an organisation is capable not only of building and growing a product, but also of continuously controlling its operation, risks, dependencies and effects. This requires insight into data flows, supplier chains, access rights, algorithmic logic, security measures, incident reports, complaints, user behaviour and anomalous patterns. Scalability without controllability produces vulnerable growth. A platform may technically be able to process more transactions, but without adequate monitoring it may also facilitate abuse more quickly. An AI application may handle more files or customer queries, but without testing it may also repeat errors systematically. An embedded service may integrate smoothly into external environments, but without contractual and technical control it may become dependent on parties whose security, data practices or compliance position are insufficiently clear. The value of innovation is therefore determined in part by the extent to which growth can be supported in governance, legal and operational terms.

Integrated Digital Crime Risk Management therefore requires scalability to be linked from the outset with Digital Crime Control and risk management. Product design must account for peak loads, abuse at scale, automated attacks, anomalous transaction patterns, data quality, logging capacity, evidentiary position and incident response. A product that can grow quickly must also be able to detect anomalies quickly. A business model that can onboard thousands of users must also be able to distinguish between legitimate users and fraudulent registrations. Automated customer interaction must not only be efficient, but must also contain escalation pathways where errors, vulnerability or abuse become visible. Innovation is therefore not viewed separately from control, but assessed by reference to whether growth can take place without undermining lawfulness, security, explainability and trust.

Product Governance as a Condition for Sustainable and Explainable Digital Propositions

Product governance constitutes the governance layer that determines whether new digital products and business models are not only commercially attractive and technically feasible, but also legally defensible, operationally controllable and explainable to users, regulators, contractual counterparties and internal decision-makers. Without product governance, there is a risk that digital innovation will be driven by isolated decisions made by product teams, commercial departments, data specialists or external suppliers, without sufficient coherence between value creation and responsibility. A digital proposition may appear to function well in individual respects, while no one has an integrated view of the underlying data flows, algorithms used, access rights, security choices, contractual dependencies, user communications and risk assessments. Product governance brings these elements together and clarifies who is responsible for what, which criteria apply to approval, which risks must be assessed in advance and which controls must remain in place after launch.

A sustainable digital proposition requires important choices not to disappear implicitly into technical specifications, commercial assumptions or default settings. The choice to process certain personal data, build certain profiles, use certain external data sources, automate certain decisions or treat certain user groups differently must be capable of being justified explicitly. The same applies to choices concerning logging, retention periods, access management, data sharing, monitoring, incident response and complaint handling. Where such choices cannot be traced back to clear decision-making, the product model becomes vulnerable. In the event of a complaint, data breach, regulatory enquiry or fraud incident, the organisation must be able to explain why the product was designed in this way, which alternatives were considered, which risks were accepted, which safeguards were implemented and how the interests of data subjects were weighed. Explainability is therefore not a communications add-on after the fact, but a governance characteristic of the product itself.

Within Integrated Digital Crime Risk Management, product governance has particular significance because new digital products and business models often create abuse scenarios that are not fully visible from the perspective of any single discipline. Legal may assess the legal basis, yet may not have a complete view of fraud patterns. Security may identify technical vulnerabilities, yet may not always see how commercial friction reduction increases risk. Compliance may interpret supervisory expectations, yet requires additional input on data quality, customer behaviour and operational escalation. Audit may assess controllability, yet depends on clear documentation and decision trails. Product governance must therefore ensure an integrated assessment process in which digital propositions are tested against privacy, cybersecurity, Digital Crime Risks, consumer protection, data quality, supplier risks, operational resilience and reputational sensitivity. Only then does a product emerge that not merely works, but can also be carried at governance level when placed under pressure.

New Business Models as a Test of Proportionality, Legitimacy and Trust

New digital business models constitute a direct test of proportionality because they often depend on the question of how much data, how much automation, how much influence and how much dependency can be justified in pursuit of a particular commercial objective. A business model that offers users convenience in exchange for extensive data processing, personalised offers, continuous tracking or automated profiling must demonstrate more than technical functionality and market demand. It must make clear why the chosen processing is necessary, why less intrusive alternatives are insufficient, how the interests of data subjects are protected and how misuse is prevented. Proportionality therefore requires a substantive assessment of the product: whether the intensity of data processing corresponds to the purpose, to the reasonable expectations of users and to the sensitivity of the data involved. Where that balance is absent, the business model becomes legally and socially fragile, even where commercial results initially appear positive.

Legitimacy goes beyond formal compliance. A digital proposition may have terms and conditions, privacy notices, cookie settings, consent screens and contractual provisions, yet still lack sufficient legitimacy where users do not in fact understand what is happening, or where the product creates an imbalanced relationship between organisation and user. That risk is significant in business models where behaviour is steered through interface design, personalised pricing, risk selection, automated recommendations or opaque ranking mechanisms. The user experiences a simple digital environment, while complex analyses, behavioural predictions and commercial optimisations operate behind it. Legitimacy requires the organisation not only to ask whether something can be legally constructed, but also whether the product remains defensible when fully explained. A business model that depends on ambiguity, information asymmetry or passive acquiescence carries a structural integrity risk.

Trust is not a soft reputational factor in this context, but a hard condition for digital continuity. Users, clients, regulators and commercial partners accept digital products only for as long as they can trust that data are handled carefully, security is appropriate, choices are presented fairly and incidents are addressed diligently. When trust is lost, a digital business model can quickly be affected by complaints, cancellations, negative publicity, regulatory questions, contractual claims and lower user adoption. Integrated Digital Crime Risk Management therefore connects trust with Digital Crime Control. A product that is susceptible to identity fraud, account takeover, phishing, misleading communications, data breaches or transaction manipulation undermines not only security, but also the legitimacy of the business model. New digital products and business models must therefore be assessed by reference to whether they establish a trustworthy digital relationship in which commercial value creation is not achieved at the expense of legal protection, transparency and controllability.

The Role of Privacy by Design and Security by Design in Digital Development

Privacy by design and security by design are not abstract principles, but concrete design requirements that determine whether digital products are resilient from the outset against legal, technical and operational pressure. Privacy by design means that data protection is not confined to a privacy notice or consent text, but is embedded in the product’s functionality, data flows, default settings, retention periods, access rights, user information and internal controls. Security by design means that security is not added after the functionality has been completed, but is considered from the earliest design choices in relation to authentication, authorisation, encryption, logging, monitoring, segmentation, supplier integrations and incident response. Both principles have in common that they do not treat risks as residual issues, but as part of responsible digital design.

The practical significance of this is substantial. A product that applies privacy by design does not process more data than necessary, does not silently use data for new purposes, provides clear information at relevant moments and makes privacy-friendly settings the default. The product also contains mechanisms to effectively support data subject rights, such as access, rectification, erasure, restriction, data portability and objection where applicable. A product that applies security by design makes abuse more difficult through strong access control, risk-based verification, protection against automated attacks, limitation of internal access, detection of anomalous behaviour and clear measures in the event of incidents. It is important in this respect that privacy and security do not replace one another. A product may be well secured while processing too much data. A product may pursue data minimisation while remaining insufficiently protected against credential stuffing, social engineering or data breaches. Both dimensions must be assessed together.

Within Integrated Digital Crime Risk Management, privacy by design and security by design form the operational translation of digital responsibility. They ensure that Digital Crime Risks are not revealed only after harm has occurred, but are taken into account in product choices that will later be difficult to reverse. This applies, for example, to the design of customer journeys, where reducing friction must be weighed against identity controls and fraud prevention. It applies to API integrations, where commercial integration must be balanced against access restrictions, logging and supplier control. It applies to AI functionalities, where speed and personalisation must be weighed against transparency, data quality, bias risk and human intervention. Privacy by design and security by design therefore do not make digital innovation slower or more formalistic, but more reliable. They prevent products from later having to be rebuilt because fundamental choices prove insufficiently lawful, secure or explainable.

Innovation Without Governance Discipline Increases Digital Exposure

Innovation without governance discipline leads to digital exposure because speed, experimentation and commercial ambition are then insufficiently limited by responsibility, control and testability. In digital environments, a product can reach large numbers of users, collect significant volumes of data and become deeply embedded in operational processes within a short period of time. Where the underlying governance lags behind, a situation arises in which the organisation digitalises faster than it can control. This may become visible in unclear ownership, fragmented data flows, deficient documentation, weak supplier arrangements, insufficient security testing, incomplete risk assessments or absent escalation procedures. The digital proposition grows, but the ability to manage risk does not grow at the same pace.

Governance discipline means that innovation is subject to clear decision-making, assessment criteria and lines of responsibility. It must be visible which risks have been identified, which measures have been taken, which residual risks have been accepted and who is authorised to decide on them. Without that discipline, a culture emerges in which product teams implicitly make normative choices about data use, security levels, customer protection and abuse prevention, even though those choices have governance significance. This is not a matter of administrative formality, but of whether the organisation is able to explain and defend its digital conduct. A product launched without a clear assessment of privacy, cybersecurity, Digital Crime Risks, consumer protection and operational controllability creates a risk that later far exceeds the time saved at launch.

Integrated Digital Crime Risk Management therefore requires digital innovation to be embedded in a decision-making process in which commercial opportunities and risk discipline are treated on an equal footing. This means that a product requires not only a go-to-market assessment, but also an integrity assessment. Such an assessment includes questions concerning data minimisation, identity control, fraud resilience, vulnerability to phishing or social engineering, dependency on suppliers, data transfers, logging, incident response, complaint handling and regulatory transparency. Where these questions are not asked in time, the organisation increases its digital exposure without fully understanding which obligations and vulnerabilities are being created. Governance discipline is therefore not a brake on digital innovation, but a condition for preventing innovation from resulting in uncontrollable risk accumulation.

Strategic Digital Integrity Management Begins with Responsible Digital Design

Strategic digital integrity management begins with responsible digital design because the fundamental characteristics of a product are shaped before it reaches the market. During the design phase, decisions are made about how users are identified, which data are requested, which choices are offered, which default settings apply, which decisions are automated, which controls are embedded and which dependencies on external parties arise. These choices later determine whether the product can operate lawfully, securely, explainably and controllably. Where responsible design is absent, the organisation must attempt after the fact to mitigate risks that are already embedded in the product. This often leads to emergency remediation, additional terms, restricted functionality, higher recovery costs and reputational harm. Responsible design prevents digital integrity management from becoming defensive after launch.

Responsible digital design requires the product to be assessed through multiple perspectives at the same time. From a legal perspective, the focus is on legal basis, transparency, proportionality, data subject rights, contractual safeguards and regulatory transparency. From a cybersecurity perspective, the focus is on access management, protection of data, vulnerabilities, attack scenarios, monitoring and incident response. From an operational perspective, the focus is on feasibility, data quality, recovery capability, responsibility and controllability. From a governance perspective, the focus is on legitimacy, risk appetite, reputation, continuity and social acceptability. From the perspective of Digital Crime Control, the central question is how the product may be misused for identity fraud, account takeover, phishing, social engineering, online payment fraud, data breaches, manipulation or unauthorised access. Only by bringing these perspectives together in the design process can a digital proposition emerge that does not depend on incidental compliance after the fact.

Integrated Digital Crime Risk Management provides the connecting framework for this. It makes clear that new digital products and business models cannot be assessed from a single discipline, because their risks move across technology, behaviour, data, law, security, commerce and governance. Strategic digital integrity management therefore requires a design practice in which product teams, the board, legal, compliance, data, security, audit and operations do not work alongside one another in isolation, but answer the same core question: can this digital proposition create value without undermining lawfulness, reliability, security, explainability and trust? Where that question is central from the outset, innovation becomes stronger because it is not only technically and commercially considered, but also resilient to regulatory scrutiny, incidents, abuse and public criticism. Responsible digital design is therefore the starting point for sustainable digital value creation and effective management of Digital Crime Risks.