Category: Data Quality

Data Integrity

Simply put

Data integrity means that data stays accurate, complete, and consistent, and is not changed in an unauthorized way from the time it is created through its storage, transmission, and use. It is both a property that data can have and a set of processes an organization uses to protect and verify that data has not been improperly altered or corrupted. In practice, it helps ensure that the information people and systems rely on can be trusted.

Formal definition

Data integrity is generally defined as the property whereby data has not been altered in an unauthorized manner since it was created, transmitted, or stored, and more broadly as the set of controls and processes that maintain the accuracy, completeness, consistency, and validity of data across its lifecycle. As a security concept it aligns with the integrity element of the confidentiality-integrity-availability triad, encompassing controls such as authorization, change control, validation, and mechanisms to detect unauthorized or accidental modification. As a governance concern it also relates to data quality, consistency across formats, and freedom from discrepancies or errors. This entry covers the definitional scope only; it does not address specific technical control implementations, cross-border transfer mechanics, retention rules, or the relationship between integrity failures and regulatory obligations, which vary by jurisdiction, framework, and implementation.

Why it matters

Data integrity underpins the trustworthiness of nearly every decision, transaction, and record an organization produces. If data can be altered in an unauthorized manner or drifts into inaccuracy, incompleteness, or inconsistency, the systems and people relying on it may act on flawed information without realizing it. Because integrity is one of the three elements of the confidentiality-integrity-availability triad, it sits at the core of information security programs, but its consequences extend well beyond security into operational reliability, reporting accuracy, and the defensibility of business decisions.

Integrity failures are frequently more insidious than outright data loss because corrupted or silently modified data can continue to be used as though it were correct. Ensuring that data remains accurate, complete, and consistent across its lifecycle, and free from discrepancies or errors, is what allows individuals and automated processes to rely on the information at hand. This entry addresses the concept and its definitional scope; it does not evaluate the effectiveness of any particular control, nor does it establish that maintaining integrity alone satisfies any specific regulatory obligation, which varies by jurisdiction, framework, and implementation.

Who it's relevant to

Information security professionals

Security teams treat integrity as one of the three core elements of the confidentiality-integrity-availability triad. They are typically responsible for the authorization, change control, validation, and detection mechanisms that guard against unauthorized or accidental modification of data throughout its lifecycle.

Data governance and stewardship leads

Governance functions focus on the accuracy, completeness, consistency, and quality of data across formats and over time. They address integrity as a data quality and stewardship concern, distinct from but overlapping with the security controls that prevent improper alteration.

Compliance and data protection officers

Those accountable for demonstrable governance rely on data being accurate, complete, and consistent to support defensible records and reporting. Note that this entry does not establish how integrity failures map to specific regulatory obligations, which vary by jurisdiction and framework and should be assessed in context.

Data engineers and platform teams

Teams building and operating data pipelines and storage systems implement validation and consistency checks that help ensure data remains free from discrepancies or errors as it moves across systems, storage, and transmission.

Inside Data Integrity

Accuracy and Correctness

The property that data reflects the real-world values or facts it is intended to represent, and remains free from unauthorized or unintended alteration throughout its lifecycle. In a data protection context, accuracy also connects to controller obligations, though the security dimension of integrity focuses on preventing corruption or tampering rather than on the legal accuracy principle itself.

Consistency

The requirement that data remains coherent across systems, copies, and over time, so that the same value is not contradicted by another instance. Consistency spans both governance concerns (such as lineage and reconciliation) and security concerns (such as detecting unauthorized divergence).

Completeness

The property that data is whole and not partially lost, truncated, or missing elements required for its intended use. Incomplete records can undermine both operational reliability and the trustworthiness of downstream processing.

Validity

Conformance of data to defined formats, ranges, types, and business rules. Validity is typically enforced through governance controls such as validation rules and data quality checks rather than through security controls alone.

Integrity as a Security Objective

One of the three core information security objectives alongside confidentiality and availability. In this sense, integrity concerns protecting data from unauthorized modification and detecting tampering, and is supported by controls such as access restriction, change logging, and cryptographic integrity mechanisms.

Integrity as a Governance Objective

The stewardship dimension covering ownership, data quality management, lineage, and policy that keeps data fit for purpose. This overlaps with, but is distinct from, the security controls that protect data from tampering; governance addresses whether data is correct and well-managed, while security addresses whether it is protected from unauthorized change.

Common questions

Answers to the questions practitioners most commonly ask about Data Integrity.

Is data integrity the same as data security?

No. Data integrity is one property within information security, generally understood as the assurance that data is accurate, complete, and not improperly altered across its lifecycle. Information security more broadly addresses confidentiality, integrity, and availability together. Integrity controls overlap with security controls, but treating the two as synonymous collapses a useful distinction: a system can maintain confidentiality yet still suffer integrity failures, and vice versa. Note also that integrity in the security sense differs from data quality within a governance program, which additionally covers fitness for purpose, consistency, and lineage.

Does maintaining data integrity mean the data is accurate for its intended business use?

Not necessarily. Integrity in the security sense typically means data has not been altered or corrupted in an unauthorized or unintended way, so it remains as recorded. That is distinct from data quality and accuracy in the governance sense, which concern whether the data is correct, current, and fit for a given purpose. Data can retain integrity, being unchanged from what was entered, while still being inaccurate or outdated. Conflating the two can lead teams to assume that integrity controls alone satisfy accuracy expectations, including any accuracy-related obligations that may arise under applicable regimes.

What controls typically support data integrity in practice?

Common measures include access controls and authorization to limit who can alter data, checksums or hashing to detect unintended changes, input validation, audit logging of modifications, version control, and referential constraints in databases. The appropriate combination depends on context, the sensitivity of the data, and the threat model. This entry does not prescribe a specific control set as sufficient for any given jurisdiction or standard, and no single control should be treated as guaranteeing integrity.

How can an organization demonstrate data integrity for accountability purposes?

Under governance and accountability frameworks generally, demonstrable evidence matters more than stated intent. Organizations typically rely on audit trails that record who changed what and when, documented change-management processes, integrity-check results, and records of monitoring and remediation. What constitutes adequate evidence varies by framework and context, and this entry does not address the specific evidentiary expectations of any particular regulator or standard.

Who is accountable for data integrity across controllers, processors, and internal roles?

Accountability is generally allocated by role and by contractual and legal arrangements. Where processing is outsourced, a data controller typically retains overarching accountability while a data processor operates under instructions and agreed measures; the specific integrity-related obligations depend on the applicable regime and the agreement between the parties. Internally, data governance roles such as data owners and stewards are often assigned responsibility for integrity within their domains. This entry does not resolve how obligations are apportioned in any specific jurisdiction or contract.

How does data integrity relate to detecting and responding to unauthorized changes?

Integrity controls typically enable both prevention and detection: preventive measures restrict who can alter data, while detective measures such as hashing, logging, and monitoring surface unauthorized or unintended changes so they can be investigated and remediated. Detection of an integrity failure may also carry implications under security or breach-related processes, but the scope, timing, and notification requirements of those processes are governed by the relevant regime and are outside the scope of this entry.

Common misconceptions

Data integrity and data security are the same thing.

Integrity is one specific objective within information security, alongside confidentiality and availability, and it also has a governance dimension relating to data quality and stewardship. Security controls protect data from unauthorized modification, while governance addresses whether data is accurate, complete, and fit for purpose. The two overlap but should not be collapsed into one another.

Encryption guarantees data integrity.

Encryption primarily addresses confidentiality. While certain cryptographic mechanisms can support integrity detection, applying encryption or tokenization does not by itself ensure that data is accurate, complete, or unaltered, and it does not make data non-personal. Integrity requires its own dedicated controls.

Data integrity is purely a technical control problem.

Maintaining integrity generally requires both technical controls (such as validation, access restriction, and change logging) and governance measures (such as ownership, stewardship, data quality rules, and lineage). Treating it as solely a technical concern typically leaves quality and accountability gaps unaddressed.

Best practices

Distinguish integrity as a security objective from integrity as a governance concern in your policies, assigning clear technical controls for tamper prevention and clear stewardship roles for data quality.

Implement validation rules that enforce format, range, type, and business-rule conformance at points of data entry and transformation to support validity and completeness.

Maintain change logging and access restrictions so that unauthorized or unintended modifications can be prevented and, where they occur, detected and attributed.

Establish reconciliation and consistency checks across systems and copies to detect divergence in values that should match.

Assign documented ownership and stewardship for data assets, and retain demonstrable evidence of quality and integrity controls rather than relying on stated intent, in line with accountability expectations under governance frameworks.

Avoid treating encryption or tokenization as an integrity control; select mechanisms specifically designed to detect or prevent unauthorized alteration where integrity assurance is required.