When this was first published on 26 Aug 2014, there was no GDPR, no DPDP Act, no CCPA, no AI governance code. Data protection meant a six-line Privacy Policy in the footer. Consent was a pre-ticked checkbox. In that regulatory vacuum, CDR was not written as a response to compliance — there was nothing to comply with. It was written as a voluntary act of board responsibility, because the physical world had CSR since the 1960s, but the digital world had nothing.
Back in 2014 we had all grown up hearing about Corporate Social Responsibility (CSR) for quite some time then.
It actually started gaining popularity in the 1960's when corporate leaders started to think how they could contribute to the society on which they are depending upon for their own existence. Some did it solely to give back to the society with genuine intentions, some to gain popularity and some purely as an eyewash.
Times have changed and we were witnessing the Digital Explosion. I call it an explosion since it took less than a decade for more than 50% of the world's population to get hooked to. More than 70% of companies globally were depending on Digital Technology. In 1970s people had only Radios, then Television, then mobile, and now Internet that changed perceptions completely.
From Relevance to Predation
Built large-scale systems where learning algorithms moved in under 3 years from delivering relevance to practicing predation — using PII to feed adverts that knew too much.
Casual Handling, Permanent Footprint
NDAs signed, clauses existed, but digital data always leaves a footprint — some traceable, some not. Once lost, never fully retrieved. Joining the dots between the two trenches made CDR inevitable.
Corporate Digital Responsibility (CDR) is a corporate conscience to ensure responsible handling of digital information and to build ethical corporate practices around digital data — when no law asked us to.
The Five Functions of CDR 1.0
Defined on 26 Aug 2014 — when no law asked for it. Five duties that made responsibility operational.
Original 2014 Archive
Background: Why CSR Was Not Enough
CSR had taught the physical world accountability since the 1960s. The digital world had no equivalent. CDR was proposed...
The Five Functions of CDR
If CSR had environment, labor, and community, what would CDR have? Five functions were defined to make responsibility operational.
From Compliance Cost to Brand Asset
In 2014 privacy was seen as a cost. CDR argued it would become a brand moat. Trust, not clicks, would compound.
What was an ethical choice in 2014 became law in 2018 and a balance-sheet asset in 2026.
No regulator asked for it. Boards could ignore data governance. CDR 1.0 proposed custodianship as voluntary responsibility because nothing else existed.
GDPR makes purpose limitation, minimization, and breach notification enforceable. Fines scale to 4% revenue. Ethics becomes compliance.
DPDP Act, CCPA enforcement, AI governance. Data trust is now a valuation driver. CDR moves from policy page to board pack, from footer link to P&L.