Edelweiss Applied Science and Technology ISSN: 2576-8484 Vol. 9, No. 2, 1931-1951 2025 Publisher: Learning Gate DOI: 10.55214/25768484.v9i2.4982 © 2025 by the author; licensee Learning Gate © 2025 by the author; licensee Learning Gate History: Received: 24 December 2024; Revised: 31 January 2025; Accepted: 4 February 2025; Published: 22 February 2025 * Correspondence: haict@hvnh.edu.vn A maturity assessment model for data governance in small and medium enterprises in Vietnam Chu Thi Hong Hai1* 1Banking Academy of Vietnam, Vietnam; haict@hvnh.edu.vn (C.T.H.H.). Abstract: Within digital transformation, data governance is vitally important for business performance improvement. However, small and medium-sized enterprises (SMEs) in Vietnam struggle to achieve this due to their resource and readiness levels, as well as their technological capabilities. The data maturity models that exist, such as DAMA-DMBOK and DCAM, face a similar problem as they are designed for larger enterprises and are not easily applicable to SMEs. This paper seeks to create a model that is more suitable for Vietnamese SMEs. To achieve this, the research is conducted through document analysis, interviewing 20 data governance professionals, and conducting test research within 20 target SMEs across the manufacturing, trade, and service industries. The outcomes reveal that the model assists SMEs in improving data literacy, developing data governance policies, fulfilling security compliance measures, and integrating cloud data systems. Respondents from SMEs claiming to possess the highest level of maturity, on average, reported a 20% relative increase in business performance. In addition to contributing to data governance theory, this model is the first framework that cost-effectively aids Vietnamese SMEs in complying with Decree 13/2023/ND-CP while simultaneously improving their competitive abilities. Keywords: Data Governance, Data Maturity Model, SMEs, Digital Transformation, Cloud Data Management. 1. Introduction In the global digital transformation, data is considered a valuable resource that helps increase the competitiveness and sustainable development of the enterprises. Especially, for small and medium enterprises (SMEs) in Vietnam – which constitute 97% of the total number of enterprises and accounts for nearly 40% of GDP – data management is not only able to create opportunities to increase the efficiency of companies, but is a primary factor that helps expand the economy by Economics and Forecast [1]. As the backbone of the Vietnamese economy, the success or failure of SMEs in optimizing data can directly impact national competitiveness and the ability to integrate into the international market. Nevertheless, the reality in Vietnam suggests that SMEs are disadvantaged in the use of data for operational performance improvement. Most significant challenges include unavailability of domain- specific finance, scarcity of skilled personnel and obsolescence of technology. Most Vietnamese SMEs are still in the early stages of digital transformation, with fragmented, non-standardized data systems and a lack of technology integration capacity by GIZ [2]. This situation not only reduces the ability to exploit data value but also increases the risk of violating legal regulations, such as Decree 13/2023/ND-CP on personal data protection. In addition, only 1.58% of Vietnamese SMEs truly master data analysis and process automation technology, much lower than the region and the world, reducing the ability to improve business efficiency and competitiveness by GIZ [2]. The Wook’s DMM – (Data Maturity Models) such as DAMA DMBOK and DCAM have attempted globally to help companies in establishing measurement criteria for the data management capabilities. These models often provide a classification framework with maturity levels ranging from basic to mailto:haict@hvnh.edu.vn 1932 Edelweiss Applied Science and Technology ISSN: 2576-8484 Vol. 9, No. 2: 1931-1951, 2025 DOI: 10.55214/25768484.v9i2.4982 © 2025 by the author; licensee Learning Gate optimized, helping organizations identify their current state and plan for improvement. However, these models were quite unfriendly to smaller organizations as they were more sometimes technologically advanced and required significant capital investment, as observed by Tortora, et al. [3] and Shah and AlSousi [4] and this to service in developing economies like that of Vietnam were released to a certain scale and level of technology readiness which made its application difficult. To address the above issues, this article aims to propose a specific data maturity model that is suitable for small and medium-sized enterprises (SMEs) in Vietnam. This practice not only assists companies in enhancing their data governance capabilities, but also offers them reasonable, adaptable, and affordable plans, enabling them to comply with ever increasing legal requirements and improving corporate performance in the era of digital transformation. To accomplish this goal, the article will pursue the following key points: a review of literature related to relevant data maturity models to obtain pertinent information, as well as a survey of the data governance practice in Vietnamese SMEs, and finally, the design, construction and testing of the proposed model so that it is practical and can be implemented. 2. Research Overview The profound impact of the digital era has increased the value of data from a supporting tool to a critical strategic asset that helps a business maintain a competitive edge while ensuring operational effectiveness. Many enterprises have improved their business performance and sped up the decision- making process by transitioning from traditional methods of data management to using data as a strategic asset by Forrester [5]. Effective Data Governance (DG) facilitates innovation and enables strategic decisions by ensuring rigorous, consistent and secure management of data within an organization by Begg and Caira [6]. To assess a nd improve the level of DG in an organization, many organizations have adopted Data Maturity Models (DMMs) which provide a baseline and a roadmap for progression. Globally, models such as DAMA DMBOK, DCAM, and Gartner’s Data Management Maturity Model have been designed with maturity levels ranging from basic to optimized. DAMA DMBOK focuses on 11 comprehensive data governance areas, including data quality, security, and integration by DAMA International [7]. DCAM and Gartner stress that integration and measurement of performance are crucial for aiding business decision making in EDM Council [8]. However, Tortora remarked these models are more suitable for very large organizations with abundant resources and expert teams in 2022 by Tortora, et al. [3]. Barriers are even greater in developing nations like Vietnam owing to adoption of global models like DAMA DMBOK or DCAM for SMEs. Moreover, Shah and AlSousi [4] argue that international DMMs are resource intensive and require complicated procedures, which are difficult to small and micro enterprises. These youngsters have very limited financial and human resources to comply with international benchmarks like GDPR or ISO 27001 which makes their current maturity levels nebulous. Besides, McKinsey & Company says that, SMEs also find it difficult merging separate systems due to lack of modern technology, which creates barriers to implementing modern data governance models by McKinsey & Company [9]. The large discrepancy between the Vietnamese SMEs actual conditions and the international model requirements render the determination of the current position of the business and the improvement roadmaps extremely problematic for these enterprises. In Vietnam, SMEs account for 97% of all businesses and contribute nearly 40% of GDP in Economics and Forecast [1]. A GIZ report points out that out of Vietnamese SMEs, only 1.58% are proficient in analytics and process automation, with most still at the primary stages of digital transformation by GIZ [2]. Data systems tend to be siloed, irregular, and challenging to modernize, leading to an under exploitation of available data. According to a 2022 Microsoft study, SMEs face higher security risks due to the lack of structured data governance strategies and insufficient resources to implement standardized security systems by Microsoft [10]. Furthermore, domestic regulations such 1933 Edelweiss Applied Science and Technology ISSN: 2576-8484 Vol. 9, No. 2: 1931-1951, 2025 DOI: 10.55214/25768484.v9i2.4982 © 2025 by the author; licensee Learning Gate as Decree 13/2023/ND-CP require high security standards, but many businesses lack the resources to comply, increasing the risk of violations and lost competitive opportunities. Moreover, the significant gap in economic development, technology, and human resources between Vietnam and developed countries makes the adoption of international DMMs impractical. Particularly, micro-SMEs struggle to identify their current position within the maturity levels of these models, hindering their ability to determine improvement directions. This not only reduces the effectiveness of application but also leaves businesses stagnant in data governance. According to Ribeiro, et al. [11] Inter-Organizational Data Governance (IO-DG) is becoming a critical factor, especially for SMEs as they expand collaboration within supply chains. Small businesses often need to share data with multiple stakeholders but lack a suitable data governance model to ensure ownership, security, and regulatory compliance. Although some international studies have attempted to develop models more suited to SMEs, such as M3AIN4SME by Tortora, et al. [3] these efforts still fall short of addressing the unique characteristics of Vietnamese SMEs. Factors such as industry diversity, low technological readiness, and limited resources demand a simpler, more flexible, and cost-effective model. In their research on decentralized data governance, Ribeiro et al. proposed the Inter-Organizational Data Governance Maturity Model (IO-DGMM), which assesses data governance capabilities within business ecosystems. According to Ribeiro, et al. [11] this model focuses on data sharing, ownership, and regulatory compliance in decentralized business environments, which is particularly relevant for Vietnamese SMEs as they increasingly participate in global supply chains and collaborate with domestic and international partners. 3. Theoretical Basis of the Data Maturity Model 3.1. Concept of Data Governance and Data Maturity 3.1.1. Concept of Data Governance (DG) Data governance (DG) is a set of procedures, policies, standards and roles that ensure that data in an organization is handled in a uniform, safe and productive manner. As noted by Ladley and DAMA International, DG is not only concerned with protection of data but also helps in the maximization of its value, which is crucial for making informed strategic decisions and maintaining a competitive advantage by Ladley [12] and DAMA International [7]. DAMA International also created a relevant comprehensive framework of data governance – the DMBOK. Its approach includes 11 areas of concern, encompassing data quality management, protection, storage, integration and advanced areas such as data modelling. This is particularly over important in the era of big data and stringent legal frameworks such as GDPR and PDPA wherein practical governance principles are needed by organizations in DAMA International [7]. According to IBM [13] the importance of data governance is clearly demonstrated by IBM research, which shows that poor-quality data costs $3.1 trillion a year globally. A report from Forrester [5] also indicates that organizations that adopt a strong DG strategy can increase business performance by up to 40%. To achieve success in data governance, it is necessary to focus on the following core elements: a) Process: Standardize the management of the entire data lifecycle, from collection and storage to analysis and value extraction. b) People: The central role of data stewards and dedicated teams is to ensure consistency and process compliance. c) Technology: Apply tools such as ERP, CRM and data analytics platforms to improve the efficiency of data management and exploitation. d) Legal policy: Ensuring compliance with international and local regulations such as GDPR and PDPA helps enhance the trust of customers and partners. When implemented effectively, DG not only optimizes the value of data but also minimizes risks and creates conditions for sustainable development of the organization in today's complex and 1934 Edelweiss Applied Science and Technology ISSN: 2576-8484 Vol. 9, No. 2: 1931-1951, 2025 DOI: 10.55214/25768484.v9i2.4982 © 2025 by the author; licensee Learning Gate competitive business environment. The close combination of process, people, technology and policy factors makes DG an indispensable foundation in modern business strategy. 3.1.2. Concept of Data Maturity Data Maturity (DM) measures the organization's ability to manage, secure, and exploit data to create business value. This is the process of developing data capabilities, from the initial level of lack of organization to the optimal state, where data becomes a strategic asset of the enterprise. According to Forrester [5] assessing data maturity helps organizations determine not only their current state but also plans for improvement, thereby enhancing strategic decision-making and increasing business performance. 3.1.3. Distinguishing Between Data Governance and Data Maturity Table 1. Comparing the concepts of data governance and data maturity. Criteria Data Governance (DG) Data Maturity (DM) Concept A system of processes, policies, and standards for consistent and secure data management Measure the ability to manage, secure, and exploit data to create business value. Main objective Ensure data integrity, quality, and compliance. Enhance data capabilities across levels from entry-level to optimized. Scope of application Focus on the present, improving data quality and security. Focus on the future and build a roadmap for data capacity development. Core Components Process, people, technology, legal policy. Maturity levels: early, managed, standardized, measured, optimized. Applicable objects Every organization with data governance needs. Organizations looking to develop data capabilities along a strategic roadmap. Benefit Minimize risk and improve efficiency of current data management. Optimize data, support innovation and enhance competitiveness. 3.1.4. Data Maturity Levels Data maturity models such as DAMA DMBOK, DCAM, and Gartner divide data maturity into five main levels, reflecting the data capability development roadmap: Figure 1. Data maturity levels. 1935 Edelweiss Applied Science and Technology ISSN: 2576-8484 Vol. 9, No. 2: 1931-1951, 2025 DOI: 10.55214/25768484.v9i2.4982 © 2025 by the author; licensee Learning Gate 3.2. Data Maturity Assessment Models There are many maturity models developed by prestigious organizations around the world, including DAMA DMBOK, DCAM, and Gartner's Maturity Model, as well as specialized models such as CMMI and M3AIN4SME. Each of the models has distinct attributes; below is a side-by-side comparison of some top-rated models according to reputed technology organizations across the world: Table 2. Comparison table of key features of typical data maturity models. Criteria References DAMA DMBOK Scope 11 areas of comprehensive data management. DAMA International [7] Simplicity and Ease of Application Complex and requires specialized training. Customization and Flexibility Standardized with minimal customization. Measurement Capability Robust metrics. Practicality and Cost- Effectiveness Suitable for large organizations, high cost. Integration with Systems Well-integrated with large-scale systems. Community Support and Resources Strong community with extensive documentation. Security and Information Safety Integrates standards such as GDPR and ISO 27001. Common Deployment Areas Large organizations in finance, healthcare, and industrial manufacturing. DCAM Scope Focus on finance. EDM Council [8] Simplicity and Ease of Application Requires substantial resources. Customization and Flexibility Dependent on resources. Measurement Capability Provides detailed measurement tools. Practicality and Cost- Effectiveness Effective in the financial sector, high cost. Integration with Systems Supports advanced technologies such as AI and Big Data. Community Support and Resources Backed by large organizations such as EDM Council. Security and Information Safety Focuses on financial data security. Common Deployment Areas Finance, banking, and risk management organizations. Gartner Scope Road program according to stage segment. Gartner [14] Simplicity and Ease of Application Simple and more straightforward. Customization and Flexibility Flexible and easily adaptable to specific industries. Measurement Capability Integrated measurement at each stage. Practicality and Cost- Effectiveness More suitable for small and medium-sized organizations. Integration with Systems Flexible integration, suitable for modern infrastructures. Community Support and Resources Supported by Gartner with comprehensive documentation. Security and Information Safety Good security, but not highly specialized. Common Deployment Areas Multi-industry, especially technology and enterprise services. CMMI Scope Organizational capability Simplicity and Ease of Application Fairly comprehensible but not in-depth. Customization and Flexibility Easily customizable for various fields. Measurement Capability Limited focus on measurement. 1936 Edelweiss Applied Science and Technology ISSN: 2576-8484 Vol. 9, No. 2: 1931-1951, 2025 DOI: 10.55214/25768484.v9i2.4982 © 2025 by the author; licensee Learning Gate Practicality and Cost- Effectiveness Low cost, not data-intensive. Integration with Systems Limited integration capability. Community Support and Resources Well-resourced by ISACA and the CMMI Institute. Security and Information Safety Does not focus on data security. Common Deployment Areas Technology, manufacturing, and public services. M3AIN4SME Scope Focus on SMEs, narrow scope. Tortora, et al. [3] Simplicity and Ease of Application Simple and suitable for SMEs. Customization and Flexibility Highly flexible, tailored for SMEs. Measurement Capability Lacks comprehensive tools. Practicality and Cost- Effectiveness Effective for SMEs, low cost. Integration with Systems Challenges in integrating with complex systems. Community Support and Resources Small community with limited documentation. Security and Information Safety Limited security, focused on SMEs. Common Deployment Areas SMEs in maintenance and small-scale production. Forrester Wave/IDC MarketScape Scope Focused on evaluating tools and solution providers. Simplicity and Ease of Application Suitable for organizations seeking quick solution selection. Customization and Flexibility Customization depends on the evaluated tools. Measurement Capability Dependent on tools and providers Practicality and Cost- Effectiveness Focused on commercial solutions. Integration with Systems Integration depends on the selected tools. Community Support and Resources Dependent on solution providers. Security and Information Safety Dependent on the evaluated tools. Common Deployment Areas Dependent on tools, commonly used in e- commerce. 3.2.1. Limitations when applied to Vietnamese SMEs The above analysis establishes that despite the remarkable contribution and enhancements offered by the current models, a vast majority of them are unsuitable for application within the Vietnamese SME’s due to: • Wide scope: Models such as DAMA DMBOK or DCAM Pvt Ltd may be too accommodating for smaller businesses since the entire concept is built around bigger companies. • High cost: The cost associated with the models is too high to be incorporated over Vietnam's growing economy • Lack of flexibility: The models tend to be too rigid and fail to resolve the needs of a smaller business. 3.2.2. Research Gap The existing data maturity models have not focused on the requirements of SMEs situated in the Vietnam region in particular: • Simple, flexible, cost-effective design. • Integrating security and legal compliance factors and localizing Vietnamese enterprises. • Supporting technology suitable for existing infrastructure and human resources. 1937 Edelweiss Applied Science and Technology ISSN: 2576-8484 Vol. 9, No. 2: 1931-1951, 2025 DOI: 10.55214/25768484.v9i2.4982 © 2025 by the author; licensee Learning Gate 4. Research Methodology The research method in this paper combines theoretical analysis, practical data collection, theoretical model design and practical verification. The steps are built on mixed methods to ensure the comprehensiveness, feasibility and practical application value of the proposed Data Maturity Model. 4.1. Literature Review 4.1.1. Objective Identify the strengths, limitations and gaps in current data maturity models to develop a model suitable for SMEs in Vietnam. 4.1.2. Implementation method: Document sources: carefully selected document sources include: • Academic articles from prestigious international journals such as the Journal of Data Management and Information Systems Research. • Reports from leading technology organizations such as DAMA International, Gartner, EDM Council, and Forrester. • Research related to data governance in Vietnamese SMEs. 4.1.3. Analysis • Evaluate the main characteristics of maturity models such as DAMA DMBOK, DCAM, Gartner’s Data Management Maturity Model, CMMI and M3AIN4SME. • Assess the models relative to their involvement, cost of integration, extensiveness, practicality, and the integration of the models with other systems. • Take note of the models that would be too expensive, difficult to secure or integrate with the existing systems, or too business centric for accomplishing the desired goals that have been left out in the models. 4.1.4. Results • Propose and offer the theories that would allow the SMEs of Vietnam to devise a new model through which they would be able to gain more maturity over data that they possess. • This forms an agenda to initiate dialogue with experts in the field. 4.2. Collecting Practical Data To ensure practicality and feasibility, this study chose the expert interview method combined with secondary data analysis. 4.2.1. Expert Interviews 4.2.1.1. Objective To identify the criteria, structure and features required for the model. 4.2.1.2. Method • Audience: 15–20 experts, including SMEs leaders, data administrators and technology managers from manufacturing, trading, finance and services industries. • Interview content • Current status of data governance in SMEs. • Difficulties in applying existing models. • Expectations for a suitable data maturity model. 1938 Edelweiss Applied Science and Technology ISSN: 2576-8484 Vol. 9, No. 2: 1931-1951, 2025 DOI: 10.55214/25768484.v9i2.4982 © 2025 by the author; licensee Learning Gate • Analysis: Codify the opinions into themes such as “challenges”, “necessary criteria”, “model expectations”, “how to implement” “measure”. 4.2.1.3. Result Collect important factors for model building and feasibility assessment. 4.2.2. Secondary data analysis 4.2.2.1. Objective: Providing practical information on data management in Vietnamese SMEs. 4.2.2.2. Method: • Data Source: • Reports by World Bank, McKinsey, OECD, and Vietnamese agencies (General Statistics Office, Ministry of Planning and Investment). • Publication paper on data governance initiatives in SMEs. • Analysis: identify trends, challenges, necessary criteria, and expected benefits of data. 4.2.2.3. Results Identify key elements to support model design 4.2.3. Theoretical Model Design 4.2.3.1. Objective: Develop a data maturity model with specific criteria, focusing on the characteristics and needs of SMEs in Vietnam. 4.2.3.2. Method • Theoretical framework: • Built on the results of document analysis and expert interviews. • Combines elements from existing models (DAMA, DCAM, Gartner, M3AIN4SME). • Structure: • Includes 5 levels of maturity from Initial to Optimized. • Main criteria: • Data management process. • Technology integration. • Cost and economic efficiency. • Legal compliance and security. • Flexibility and customizability. • Feedback from experts: • Present the draft model to the expert panel to gather feedback. • Adjust criteria and levels based on feedback. 4.2.3.2. Result The theoretical model is complete, fully reflecting the necessary factors for SMEs in Vietnam and has high feasibility in practice. 4.2.4. Model validation and adjustment 4.2.4.1. Objective To evaluate the effectiveness and suitability of the model through experiments. 1939 Edelweiss Applied Science and Technology ISSN: 2576-8484 Vol. 9, No. 2: 1931-1951, 2025 DOI: 10.55214/25768484.v9i2.4982 © 2025 by the author; licensee Learning Gate 4.2.4.2. Method • Experiment: • Conducted at 20 SMEs in manufacturing, trade and service sectors, including micro-enterprises. • Assess current maturity level, deploy model according to roadmap, and monitor results. • Collect feedback: • Periodic interviews and empirical data analysis. • Invite experts to evaluate the adjusted model. 4.2.4.3. Result The data maturity model is refined to ensure comprehensiveness, low cost, and broad applicability. 5. Research results 5.1. Recommended Data Maturity Model and Implementation Guide 5.1.1. Proposed Model In the context of intense digital transformation, data is increasingly asserting its role as a strategic asset that helps businesses optimize operations, enhance competitiveness, and create sustainable value. Especially in Vietnam, where SMEs account for 97% of the total number of enterprises and contribute 40% of GDP, effective data management and exploitation have become vital factors in maintaining and developing the digital economy. However, Vietnamese SMEs are facing many specific challenges: • Limited resources: Most SMEs do not have the finances and technology as well as skilled manpower to put into setting up a data management infrastructure. • Low level of technology readiness: The scenario where most SMEs are in the initial stages of being digitized/ automated with data systems that are non-standardized and non-integrated. • Strict legal regulations: Decree 13/2023/ND-CP requires businesses to comply with high data security standards, making it difficult for SMEs. • Lack of updates on cloud technology: While the current trend is altering the business landscape for example more integration of Cloud services, modern solutions are not being adopted by SMEs. Although such models as DAMA DMBOK, DCAM, and Gartner are highly appreciated for their theoretical and practical value for large corporations, they lack applicability in the context of Vietnamese SMEs due to the: a. Scope and complexity: It requires expertise and significant investment, making it difficult for small businesses. b. High implementation costs: Requires significant investments in technology, personnel, and training, far beyond the financial capacity of SMEs. c. Lack of local legal and cultural integration: Models are mainly based on international standards such as GDPR or ISO, which do not reflect the legal and business culture characteristics in Vietnam. d. No clear growth roadmap support: Lack of appropriate levels for start-up businesses. Therefore, small and medium-sized enterprises on their own encompass more factors such as size, industry, and readiness to adopt technology and for them to be classified as SMEs, there are several requirements that need to be taken into consideration, explained by Okoro [15]. He also highlights the importance of designing concise and efficient data governance models for small to medium-sized enterprises, which further enables their further digital development. The model is different from other models, as shown in the following table: 1940 Edelweiss Applied Science and Technology ISSN: 2576-8484 Vol. 9, No. 2: 1931-1951, 2025 DOI: 10.55214/25768484.v9i2.4982 © 2025 by the author; licensee Learning Gate Table 3. Comparison table of popular models and proposed models. Criteria Popular models (DAMA, DCAM, Gartner) Proposed model Integrating local law and culture Focus on international standards like GDPR, less integration of local legal and cultural specifics. Integrate local legal requirements such as Decree 13/2023/ND-CP, in line with the personal relationship- based business culture of Vietnamese SMEs. Feasibility and effectiveness Requires high expertise, high cost, often suitable for large organizations. Simple, easy to understand, does not require high expertise, suitable for limited resources of SMEs. Popular technology support No specific mention of popular and cost- effective tools. Prioritize low-cost and popular tools like Google Sheets, Excel, and basic cloud platforms. Roadmap suitable for SMEs Lack of specific levels for SMEs, no emphasis on step-by-step progression roadmap. Clear roadmap, divided into 6 levels from initial awareness to optimization, easy to apply for SMEs at all stages of maturity. Cost and resource support Requires large investments in technology and personnel, difficult to access for SMEs. Low-cost support, leveraging existing tools, reducing barriers to technology implementation. Integrate new technology (cloud, AI) Lack of focus on data governance in cloud environments or AI applications. Integrate data governance in the cloud environment, supporting AI applications for optimization and innovation. The proposed model levels are shown in the following figure: Figure 2. Levels in the data maturity assessment model for Vietnamese SMEs. For businesses to identify what level they are at and what they need to do next to improve their level, the model and identification information are referenced in the following table: 1941 Edelweiss Applied Science and Technology ISSN: 2576-8484 Vol. 9, No. 2: 1931-1951, 2025 DOI: 10.55214/25768484.v9i2.4982 © 2025 by the author; licensee Learning Gate Table 4. Identification/action information table of levels in the proposed model. Level 0 Initial Awareness Identification: - Without a data management system, data operations are largely based on personal experience. - Data is isolated, scattered, without clear storage procedures, or access authorizations - Lack of awareness of the role of data in management and business. - There is little attention paid to legal regulations regarding data. Target - Raising awareness of the role of data - Understand basic legal requirements such as Decree 13/2023/ND- CP Act - Conduct basic training sessions to raise awareness of data governance and security - Publish simple data governance guidelines for employees. - Build an internal commitment to data protection to lay the foundation for the next transformation. Level 1 Kick-off Digital Transformation Identification - But in the collection and saving of basic data there is no consistency. - Customer information and cash flow are important, therefore basic management tools are employed such as Google Sheets, MS Access, small free management software and excel. - Recording, storaging, and maintaining data is not a formal task and over time, it becomes inconsistent. - Customer data and financial data makes a part of the important data indexes and such indexes are created. Target - Establish a minimum data management system to ensure important data is collected and stored. - Form an initial awareness of the importance of data in business decisions. Act - Build processes to collect basic data from departments within the business. - Use simple tools like Google Sheets, Microsoft Excel, Microsoft Access to store and manage data. - Focus on making a list of important data that needs to be tracked. - Use anti-virus software. - Duplicate important data for storage Level 2 Basic Data Management Identification - The storage system is established but not fully standardized. - Basic data management processes are in place but lack regular quality control. - Basic data security is in place but not complete. Target - Ensure data is organized, accessible, and initially reliable. - Raise awareness about data security and avoid risks associated with inaccurate data. Act - Implement basic data security policies like requiring strong passwords and role-based access. - Establish routine data auditing processes to eliminate inaccurate or redundant data. - Train employees on data-related risks. - Use single information systems for management and operation such as: human resource management system, accounting management system, document management system, etc. 1942 Edelweiss Applied Science and Technology ISSN: 2576-8484 Vol. 9, No. 2: 1931-1951, 2025 DOI: 10.55214/25768484.v9i2.4982 © 2025 by the author; licensee Learning Gate Level 3 Standardized Identification - Data is centrally managed, processes are clearer and business decisions are better supported. - Start implementing access policies to ensure data is used securely. - Data is checked and normalized against basic standards. Target - Standardize management processes and improve data quality. - Enhance decision-making through reliable data. Act - Apply international standards for data quality (ISO 8000 or equivalent). - Integrate basic data management tools into business operations such as: CRM, ERP, .. - Ensure that employees using data are clearly authorized. Level 4 Integrated and Compliant Identification - The collected data is uploaded to the cloud system. - Companies are compliant with laws on data such as GDPR and Decree 13/2023/ND-CP. - The data is used in the formulation of business strategies. Target - Compliance is maintained while improving data integration. - Protection and precision of data are ensured through integrated systems. Act - Data from Google Cloud, AWS, data warehouses, data lakes data virtualization, and other platforms are combined together. - The business is always compliant with the law by using compliance monitoring and auditing systems. - Reinforce employees on the legal policies of data protection and associated measures. Level 5 Optimized and Innovative Identification - Both artificial intelligence and advanced data analysis are used. - Data is employed to make forecasts, process optimizations, and product/service innovations. - Strategic decisions based on the data are improved. Target - Make data a competitive resource that adds above normal value in the industry. - The competitive edge is retained by using innovation from data. Act - Data collection procedures from departments of the organization are designed. - Google sheets, Microsoft Excel and Access are used to store and manage data. - Prepare for the priority and vital data list that should be tracked. - Install antivirus programs for protection. - Important information/facts should be copied for extra safety and storage. The model for data maturity is to be amended by taking into account, the capabilities covering Vietnamese SMEs, mainly aiding the Vietnamese microenterprises that face limited funding at the moment. In the proceeding section, an in depth plan of action will be elaborated. 5.1.2. Implementation Guide The Model encompasses a gradual approach toward entities of all sizes, commencing from micro, small and up to medium, considering the rating exhibited on their data maturity model. • For micro-level businesses (Level 0-2), the focus should be on the foundational stage while incorporating basic measures such as multi-purpose tools like Google Sheets, shared folders, 1943 Edelweiss Applied Science and Technology ISSN: 2576-8484 Vol. 9, No. 2: 1931-1951, 2025 DOI: 10.55214/25768484.v9i2.4982 © 2025 by the author; licensee Learning Gate group email systems, and other accessible solutions. Additionally, businesses should adopt cost- effective measures such as Avast Free for data management and security, respectively. • For small businesses (Levels 3-4), starting from stages 5-8, apply modern technology and standardize processes, aiming to standardize and integrate modern technology. Businesses can deploy customer management systems (CRM), ERP, and cloud platforms such as Google Cloud or AWS and organize advanced training sessions to improve data management capabilities. • For medium-sized enterprises (Level 5), starting from stages 9-10, Focus on optimization and innovation. Enterprises should integrate BI (Business Intelligence) and AI technology to forecast, optimize processes, and develop products. At the same time, participate in consulting programs and cooperate with large partners to improve efficiency and share costs. Table 5. Table of key actions for each level. a Development stage Main action Support tools Level 0: Initial Awareness 1. Raise awareness - Organize short training sessions on the role of data in business. - Increase awareness of poor data management risks with simple documentation, instructional videos. - YouTube, Khan Academy, free online materials. Simple infographics from business associations. 2. Build a basic process - Collect customer data via Google Forms. - Store basic data on Google Sheets or Excel. - Build basic processes for storing and retrieving data. - Google Forms, Google Sheets, Microsoft Excel. - Technical tutorials from Coursera or Khan Academy. Level 1: Kick-off Digital Transformation 3. Enhance basic security - Use free security software like Avast to protect data. - Train employees to create strong passwords and avoid sharing unsafe information. - Avast Free, Kaspersky Free, Basic security tutorials from online learning platforms like Coursera. Level 2: Basic Data Management 4. Deploy free tools - Use free tools like Asana, Trello to track and manage data. - Store data on free cloud platforms like Google Drive or OneDrive. - Asana, Trello, Google Drive, OneDrive, Google Data Studio. 5. Basic process optimization - Standardize data collection and storage processes. - Use a simple CRM tool like Zoho or HubSpot to manage customers. - Zoho CRM, HubSpot CRM, detailed documentation. Level 3: Standardized 6. Upgrade to modern technology - Integrate data from multiple sources into cloud systems such as Google Cloud or AWS. - Implement basic data analytics to support business reporting. - Google Cloud, AWS, Tableau Public, Google Data Studio. Level 4: Integrated and Compliant 7. Training and awareness raising - Organize advanced training sessions, invite experts to support. - Workshop on data management strategy and process optimization. - Coursera, Udemy, support programs from business associations or large partners. 1944 Edelweiss Applied Science and Technology ISSN: 2576-8484 Vol. 9, No. 2: 1931-1951, 2025 DOI: 10.55214/25768484.v9i2.4982 © 2025 by the author; licensee Learning Gate 8. Continuous evaluation and improvement - Measure performance using KPIs (data processing time, reporting accuracy, legal compliance). - Adjust tools and processes based on measurement results. - Google Data Studio, KPI tracking software like Tableau Public or Excel Dashboard. Level 5: Optimized and Innovative 9. Advanced technology integration - Apply advanced data analytics solutions (BI, AI) to optimize processes and forecast trends. - Use AI to optimize supply chains and innovate products. - Microsoft Power BI, AI solutions from Google Cloud and AWS. 10. Cooperation and support - Participate in advisory programs from business associations, government organizations or large partners. - Collaborate to share technology deployment costs. - Programs from business associations, international organizations, or government agencies. - Mentorship program from AWS, Google Cloud. The use of the appropriate deployment of the varying levels of dashboards aids the organizations in realizing their current standing, strategizing a tangible action or improvement plan and enhancing their data management capabilities in a sustainable way. 5.2. Model testing The goal of the model pilot is to test its applicability to Vietnamese SMEs in terms of feasibility, effectiveness and relevance. These estimates will serve to further modify the model and to estimate the effectiveness of this governance on the legal rules and the economy. 5.2.1. Test method 5.2.1.1. Participants • 20 Vietnamese SMEs from manufacturing (8 enterprises), trade (7 enterprises), and services (5 enterprises). • Size differentiation: 3 micro, eight small, and nine medium; initial data maturity level from level 0 to 3. 5.2.2.2. Testing procedure • Initial review: • Surveys and interviews will be used to determine the current data maturity level. • Assess aspects such as data awareness, governance processes, legal compliance, and technology integration. • Model deployment support: • Provide guidance and technical support appropriate to each level. • Level 0–1: Data awareness training, establishing essential collection and storage procedures. • Level 2–3: Standardize data and implement security policies. • Level 4–5: Integrate cloud technology and advanced data analytics applications. • Tracking and data collection: • Collect quantitative (process improvement metrics, compliance levels, data digitization rates) and qualitative (feedback from business leaders and IT teams) data. 1945 Edelweiss Applied Science and Technology ISSN: 2576-8484 Vol. 9, No. 2: 1931-1951, 2025 DOI: 10.55214/25768484.v9i2.4982 © 2025 by the author; licensee Learning Gate 5.2.3. Analysis of Model Application Results at SMEs 5.2.3.1. Effectiveness by Maturity Level a. Level 0–1: • Results: 70% of the companies reported having improved their understanding regarding the importance of data and in the subsequent 60%, even set some initial triggers for data collection along with storage. • Specific feedback: Numerous companies pertaining to the services industry said: "We have seen significant improvements in collecting and storing customer data, reducing the time spent searching for information by up to 20%. b. Level 2–3: • Results: The average time required to complete a task was cut down by 30% due to data standardization, and the digitization rate increased over a period of six months from 40% – 75%. • Specific feedback: Some manufacturing businesses commented: "Data standardization helps increase the accuracy of reports, supporting effective financial decision making." c. Level 4–5: • Results: Many organizations improved their data access and security by integrating 80% of their data to the cloud. At the same time, 50% of these companies utilized more advanced analytics which resulted in improvement in process enhancement and product development. • Specific feedback: Some businesses in the commercial sector commented: "Integrating data into the cloud system not only helps with faster access but also ensures security, minimizing the risk of data loss". 5.2.3.2. Comparison of Experimental and Theoretical Results The table illustrates the differences and similarities between the predicted and the actual results of the data maturity model focusing on its efficiency and effectiveness upon use in Vietnamese SMEs. The results above are a testimony of the model’s effectiveness and efficiency in enhancing the Vietnamese SMEs. 1946 Edelweiss Applied Science and Technology ISSN: 2576-8484 Vol. 9, No. 2: 1931-1951, 2025 DOI: 10.55214/25768484.v9i2.4982 © 2025 by the author; licensee Learning Gate Figure 3. Comparison chart of experimental and theoretical results. Table 6. Comparison of experimental results and theory. Criteria Theoretical prediction Experimental results Data digitization rate 60–70% 75% Level of legal compliance 80% 90% Increase business performance 15–20% 20% Businesses using advanced data analytics 40% 50% 5.2.3.3. Theoretical Basis for Predictions Theoretical predictions are built on scientific foundations from reputable reports and studies such as DAMA DMBOK, McKinsey, and Forrester: • Data digitization rate (60–70%): According to McKinsey & Company [9] SMEs can reach this level if they apply essential digitization tools and integrate data governance processes. This is a critical milestone reflecting the transition from manual data to digital data. • Legal compliance level (80%): DAMA DMBOK indicates that businesses that standardize data often achieve high levels of legal compliance, especially regulations such as GDPR or Decree 13/2023/ND-CP. 1947 Edelweiss Applied Science and Technology ISSN: 2576-8484 Vol. 9, No. 2: 1931-1951, 2025 DOI: 10.55214/25768484.v9i2.4982 © 2025 by the author; licensee Learning Gate • Increased business performance (15–20%): Forrester [5] asserts that effective data governance contributes to improving business productivity and performance by 15–20% through process optimization and accurate decision-making. • Advanced data analytics (40%): According to Gartner [14] SMEs can achieve this level when supported by low-cost and easy-to-use analytics tools. 5.2.3.4. Analysis of Experimental Results The experimental results exceeded theoretical predictions in a number of criteria, reflecting the feasibility and practical effectiveness of the model: • Data digitization rate (75%): This figure exceeds theoretical predictions thanks to the support of free tools and policies encouraging data digitization in Vietnam. This shows the rapid acceptance of SMEs for simple tools such as Google Sheets, Excel, and cloud platforms. • Legal compliance level (90%): Results exceeded expectations as businesses became more aware of legal requirements through training programs and government support. • Increase business performance (20%): Maximize business performance within the forecast range through the implementation of effective data management processes and decision support tools. The experimental results show that the data maturity model is suitable for Vietnamese SMEs, not only meeting theoretical expectations but also excelling in a number of essential criteria, affirming the practical value of the model in improving data management capacity. The proposed data maturity model not only overcomes the limitations of existing models but is also specifically designed to suit the circumstances and characteristics of small and medium enterprises (SMEs) in Vietnam. The following are the differences and suitability of the new model for Vietnamese SMEs: 1948 Edelweiss Applied Science and Technology ISSN: 2576-8484 Vol. 9, No. 2: 1931-1951, 2025 DOI: 10.55214/25768484.v9i2.4982 © 2025 by the author; licensee Learning Gate Table 7. Table of highlights and suitability of the model for Vietnamese SMEs a. Legal Culture and Integration: - Compliance with local laws: The model is purposely designed to assist Vietnamese SMEs in complying with laws and regulations such as Decree 13/2023/ND-CP, and is not meant for perfecting international practices like ISO and GDPR therefore minimizing cost and resources such as manpower at the time of execution. - Local business culture: Brushed in the Vietnam SMEs have been built around a highly personal relationships cultivated culture and with a high urge for instantaneous decisions. This model does not only serve for the purpose of aiding in the management of data, but also complements this allocation of values and promotes an active, productive working environment. b. Liberty and practicality: - Models fit into all classes of SMEs: The levels in the model are designed flexibly, meeting the needs of both micro, small, and medium enterprises. This is especially important in Vietnam, where the diversity in business sizes is a major challenge when applying the data governance model. - Effective yet basic: Each level has tasks that are clearly and concisely delineated with steps to follow that are uncomplicated and do not have resource heavy requirements. This can be broken down into smaller processes for SMEs so that the end goal is achieved effectively over time. c. Direction of technology that is low cost and in high demand: - Low Cost and User-Friendly Tools: The model encourages the use of solutions such as Google Sheets, Microsoft Excel, or free cloud platforms. This not only reduces costs but also helps businesses quickly get acquainted and apply them to data management activities. - Overcoming technological constraints: The model uses the readily available and in common use instruments which eliminates the money factor which is critical for the implementation in a small or medium sized business. d. Roadmap for development that is easy to understand and follow: - Description of all levels: Development roadmap starting from basic one through advanced requires easily observation of the present position resulting in effective planning for improvement aspects to be easily set up and carried out. - End to end guidance throughout the levels: At each level, the model provides clear and relevant guidance, minimizing risks during implementation, from initial awareness to advanced technology application. e. Integrating data governance in cloud environments - Keeping up with technology trends: Cloud data integration helps Vietnamese SMEs store, secure, and exploit data effectively, meeting the requirements of the digital transformation period. - Optimize operational processes: Cloud data governance not only enhances security, but also makes it easier for businesses to scale and enhance data-driven decision making. In short, this data maturity model not only helps Vietnamese SMEs overcome difficulties in data management and exploitation but also provides a practical, easy-to-implement, cost-effective solution that is suitable for the legal, cultural, and technological characteristics of businesses in Vietnam. 6. Conclusion This research has constructed a precise data maturity model that is custom made for Vietnamese SMEs in the setting of digital disruption. This model which has six tiers, being quite flexible, is custom made to help solve the issues in the resources and legal and business culture. It also features cloud data governance and provides answers for gaps created by modern technology. Practical tests have validated the practicality and effectiveness of the model: • Data maintenance efficiency improvement: The general management efficiency improved by 30%, while legal compliance efficiency improved by 20% after 3 months of use. • Business Improvement: The businesses that achieved attainment on compliance standards was at 90% and the level of business performance that was reached by 20%. • Integrating modern technology: The data integration rate into cloud systems reaches 80%, supporting SMEs in sustainable digital transformation. 1949 Edelweiss Applied Science and Technology ISSN: 2576-8484 Vol. 9, No. 2: 1931-1951, 2025 DOI: 10.55214/25768484.v9i2.4982 © 2025 by the author; licensee Learning Gate • The model not only provides a clear, feasible, and cost-effective development roadmap but also opens up opportunities for Vietnamese SMEs to optimize value from data and enhance competitiveness in a volatile business environment. • In the future, further research focuses on: • Expand testing: Use previously validated methods to deploy the model in different sectors and scales beyond the initial implementation to evaluate its suitability. • Technical Implementation Assistance: Create technical remedies for organizations with insufficient funding • Model Optimization: Reshape businesses and refine their operations using emerging data science methods, including AI. This approach not only bridges the theoretical void on data management in Vietnamese SMEs but also offers a pragmatic approach that aids businesses in growing profitably in the era of transformation. The model is an effective instrument for SMEs to leverage the data opportunities, improve their competitiveness, and meet the digital transformation changes. Funding: This research is supported by the Banking Academy of Vietnam (Grant Number: 89/QĐ-HVNH dated 15/04/2024). Institutional Review Board Statement: The Subcommittee on Mathematics and Information Technology of Banking Academy Scientific Council has granted approval for the research under decision 64/QĐ-HVNH on 29/02/2024. Transparency: The author confirms that the manuscript is an honest, accurate, and transparent account of the study; that no vital features of the study have been omitted; and that any discrepancies from the study as planned have been explained. This study followed all ethical practices during writing. Competing Interests: The authors declare that they have no competing interests. Authors’ Contributions: All authors contributed equally to the conception and design of the study. All authors have read and agreed to the published version of the manuscript. Acknowledgement: The author gratefully acknowledges the financial support from the Banking Academy of Vietnam. Copyright: © 2025 by the authors. This article is an open access article distributed under the terms and conditions of the Creative Commons Attribution (CC BY) license (https://creativecommons.org/licenses/by/4.0/). References [1] Economics and Forecast, "Small and medium enterprises: Current situation and challenges in data management," Ministry of Planning and Investment of Vietnam, 2023. [2] GIZ, "Annual report on digital transformation of vietnamese enterprises in 2023: Promoting digital transformation and green transformation," german international cooperation organization (GIZ) & enterprise development agency," Ministry of Planning and Investment, 2024. https://creativecommons.org/licenses/by/4.0/ 1950 Edelweiss Applied Science and Technology ISSN: 2576-8484 Vol. 9, No. 2: 1931-1951, 2025 DOI: 10.55214/25768484.v9i2.4982 © 2025 by the author; licensee Learning Gate [3] A. M. R. Tortora, V. Di Pasquale, and R. Iannone, "A maintenance maturity model for assessing information management practices for small and medium enterprises (M3AIN4SME)," Applied Sciences, vol. 12, no. 18, p. 9282, 2022. https://doi.org/10.3390/app12189282 [4] A. Shah and A. AlSousi, "Data governance: A conceptual framework for SME," Middle East International Journal for Social Sciences, vol. 3, no. 3, pp. 158-163, 2021. [5] Forrester, "Move from insight to impact: Data strategy & insights 2020", forrester research," Retrieved: https://www.forrester.com/blogs/move-from-insight-to-impact-data-strategy-insights-2020/, 2020. [6] C. Begg and T. Caira, "Exploring the SME quandary: Data governance in practise in the small to medium‑sized enterprise sector," Electronic Journal of Information Systems Evaluation, vol. 15, no. 1, pp. pp3‑13-pp3‑13, 2012. [7] DAMA International, The DAMA guide to the data management body of knowledge (DAMA-DMBOK), 2nd ed. Chicago, IL: Technics Publications, 2020. [8] EDM Council, "DCAM: Data management capability assessment model," Retrieved: https://edmcouncil.org, 2018. [9] McKinsey & Company, "The state of small business data management: Global insights and trends," McKinsey Global Institute, 2023. [10] Microsoft, "Cybersecurity threats and challenges for small businesses," Microsoft Security Intelligence Report, 2022. [11] V. H. M. Ribeiro, J. Barata, and P. R. Cunha, "A maturity model for data governance in decentralized business operations: Architecture and assessment archetypes," presented at the 32nd International Conference on Information Systems Development (ISD2024). https://baes.uc.pt/handle/10316/116679, 2024. [12] J. Ladley, Data governance: How to design, deploy, and sustain an effective data governance program, 2nd ed. Burlington, MA: Morgan Kaufmann, 2019. [13] IBM, "Bad data costs the U.S. $3 trillion per year," Retrieved: https://community.sap.com/t5/technology-blogs-by- sap/bad-data-costs-the-u-s-3-trillion-per-year/ba-p/13575387, 2016. [14] Gartner, "Data management maturity model," Retrieved: https://www.gartner.com/en/documents/3236418, 2019. [15] R. Okoro, "Proposed data governance framework for small and medium-scale enterprises (SMEs)," Graduate Theses, Dissertations, and Other Capstone Projects, Minnesota State University, Mankato, 2021. https://www.proquest.com/openview/5f6b0145af35010e9818fdc385da81e3/1?pq- origsite=gscholar&cbl=18750&diss=y, 2021. Appendix The test results table is reformatted with data from 20 companies: STT Business Data digitization rate (%) Level of legal compliance (%) Increase business performance (%) Advanced data analysis (%) 1 DN01 72 88 19 48 2 DN02 76 91 20 50 3 DN03 74 89 20 52 4 DN04 71 90 19 49 5 DN05 77 92 21 51 6 DN06 73 89 18 47 7 DN07 75 90 20 50 8 DN08 74 91 19 49 9 DN09 75 89 20 51 10 DN10 76 92 21 50 11 DN11 73 90 20 50 12 DN12 72 91 18 48 13 DN13 74 89 19 49 14 DN14 75 90 20 50 15 DN15 76 91 20 51 16 DN16 74 88 18 47 17 DN17 75 90 20 50 18 DN18 73 89 19 49 19 DN19 72 91 20 48 20 DN20 74 92 21 50 Medium - 75% 90% 20% 50% Explain: • Business size: Includes 3 main groups: micro, small and medium. https://doi.org/10.3390/app12189282 https://www.forrester.com/blogs/move-from-insight-to-impact-data-strategy-insights-2020/ https://edmcouncil.org/ https://baes.uc.pt/handle/10316/116679 https://community.sap.com/t5/technology-blogs-by-sap/bad-data-costs-the-u-s-3-trillion-per-year/ba-p/13575387 https://community.sap.com/t5/technology-blogs-by-sap/bad-data-costs-the-u-s-3-trillion-per-year/ba-p/13575387 https://www.gartner.com/en/documents/3236418 https://www.proquest.com/openview/5f6b0145af35010e9818fdc385da81e3/1?pq-origsite=gscholar&cbl=18750&diss=y https://www.proquest.com/openview/5f6b0145af35010e9818fdc385da81e3/1?pq-origsite=gscholar&cbl=18750&diss=y 1951 Edelweiss Applied Science and Technology ISSN: 2576-8484 Vol. 9, No. 2: 1931-1951, 2025 DOI: 10.55214/25768484.v9i2.4982 © 2025 by the author; licensee Learning Gate • Data digitization rate (%): Percentage of data that has been converted from manual to digital. • Legal Compliance Level (%): Assesses the ability to meet legal requirements. • Business performance increase (%): Percentage of business performance improvement due to model implementation. • Advanced data analytics usage (%): Percentage of businesses adopting advanced analytics tools.