1) Introduction

In this fourth installment of the series (Part 4), we continue to answer the question: where are tax administrations and where are they going in the realm of digitalization and digital transformation? After the general introduction presented in Part 1[i] and the analysis of digital identity and taxpayer touchpoints in Parts 2[ii] and 3[iii], respectively, this time we address pillar (3) Data Management and Standards of the “Tax Administration 3.0” framework.

As is known, data constitutes an essential resource for tax administrations, as it allows them to understand the economic reality of taxpayers and support their operational actions: identifying who should pay taxes, for what reason, how much they owe, and whether they have fulfilled their obligations.

However, having a larger volume of data does not, in itself, guarantee better tax management. For data to be useful, it must be reliable, up-to-date, correctly interpreted, and adequately protected. Likewise, its utilization must respect the rights and guarantees of taxpayers.

As the OECD highlights across various reports, the growing volume of information handled by tax administrations requires strengthening the mechanisms to manage it and protect its confidentiality. This need becomes increasingly critical as data analytics, automation, and digital taxpayer services expand.

In this context, the quality and security of information are fundamental for the proper functioning of processes, such as, pre-filled tax returns, automatic data exchange, and other automated workflows. Proper management reduces systemic errors and maintains public trust in interactions between the administration, taxpayers, and third parties involved in the tax system.

From the perspective of this series, the relationship between the pillars of Tax Administration 3.0 is direct: digital identity allows for the identification of those involved; contact points facilitate their interactions; and data management provides the information on which services and administrative decisions are based [iv].

Since pillar (3) “Data management and standards” of Tax Administration 3.0 comprises several dimensions, this installment focuses on data governance. The collection, exchange, interoperability, and analysis of information are part of that broader scope, but they are not exhaustively examined in this installment.

 2) Development

Data governance establishes clear responsibilities, criteria, and procedures to guide information management and utilization. Its importance lies in articulating the availability and quality of information with its protection and responsible use. Therefore, the following analysis considers both security mechanisms and the implementation of strategies, ethical frameworks, and specialized privacy functions.

2.1) Data Governance in the Global Landscape and in LAC

As has already been pointed out in previous installments, in the international landscape, the OECD report Tax Administration Digitalization and Digital Transformation Initiatives (2025), based on the 2024 Global Digitalization Survey, presents the results of the 54 member administrations of the Forum on Tax Administration (FTA). Your Table 4.1 lists nine governance practices related to strategy, quality, ethics, security, and data utilization. In order of source, 72.2% have a comprehensive data management strategy; 85.2% systematically assess the quality of reported data; 75.9% operate under an official ethical framework; 98.1% control user data access and security; 87.0% automatically detect unauthorized access; 85.2% have a Data Privacy Officer (DPO); 94.4% maintain a cybersecurity unit; 94.4% retain third party services to audit and test system security; and 16.7% use artificial intelligence (AI) as part of their data governance process [v].

These results demonstrate a greater declared presence of access controls, specialized cybersecurity units, and external testing compared to comprehensive strategies and ethical frameworks. While this variance helps identify areas for institutional strengthening, these percentages do not measure the operational effectiveness of these mechanisms.

Following the continuity criteria of previous installments, we examine the situation of the same thirteen Latin American and Caribbean (LAC) countries: Argentina, Brazil, Chile, Colombia, Costa Rica, Cuba, Ecuador, Guatemala, Honduras, Mexico, Paraguay, Peru, and Uruguay. [vi]

Regional evidence from Latin America and the Caribbean (LAC) shows differences in the implementation of the analyzed practices. Following the same order, 69.2% declare having a comprehensive data management strategy; 84.6% evaluate the quality of reported data; and 76.9% possess an ethical framework. 100% implement Access control and data security. 84.6% utilize automatic detection of unauthorized access.  61.5% have a designated  data privacy officer; 84.6% maintain a cybersecurity unit; 76.9% hire third parties for system security testing. Finally, 15.4% apply AI in their data governance process (see Table 1 below) [vii].

Table 1. Data Governance Practices Declared by Thirteen LAC Countries

Source: Own elaboration based on the Inventory of Tax Technology Initiatives (OECD Data Explorer), files extracted on October 23, 2026.

Note: percentages calculated on thirteen administrations, without weighting; the results indicate affirmative responses.

A country-by-country breakdown reveals distinct combinations of practices. Ecuador and Guatemala respond affirmatively to the nine indicators, while Brazil, Colombia, and Mexico do so to the first eight, omitting only the use of AI in this area. Honduras, Peru, and Uruguay register seven affirmative responses; Chile and Cuba reported six; Argentina recorded five; Costa Rica reported four; and Paraguay registered one, corresponding exclusively to data access and security control. These counts describe the coverage of the practices consulted and do not constitute a classification of digital maturity or institutional effectiveness.

Beyond the raw scores, the differences between components provide relevant information. Argentina and Peru declare they are evaluating data quality and operate under an ethical framework, although they do not have a comprehensive management strategy. Conversely, Uruguay reports the existence of a strategy and quality evaluation mechanisms but responds negatively regarding the ethical framework. This shows that the different dimensions of governance are not always implemented together.

Regarding security, while all analyzed administrations declare that they control data access, Chile and Paraguay do not report automatic detection of unauthorized access. Likewise, Cuba and Paraguay respond negatively regarding the existence of a cybersecurity unit, while Argentina, Honduras, and Paraguay do not declare hiring third parties to audit their systems. It is advisable, therefore, to distinguish between baseline access controls, automated detection, specialized organization, and external evaluation, rather than  interpreting a negative response as the total absence of alternative mechanism.

The role of the data privacy officer shows the lowest adoption rate among the first eight indicators: only eight of the thirteen administrations declare having one. Regarding AI applied to data governance, affirmative responses correspond exclusively to Ecuador and Guatemala. This result is limited to the specific scope of data governance and does not allow us to conclude that other administrations lack AI applications in other tax administration workflows [viii].

When comparing both sample groups, the greatest descriptive differences are observed in the data privacy officer (61.5% in the thirteen LAC countries versus 85.2% in the FTA), the hiring of third parties for security testing (76.9% versus 94.4%), and the implementation of cybersecurity units (84.6% versus 94.4%). In contrast, data quality assessment shows similar percentages (84.6% and 85.2%). This comparison helps to identify priorities for regional analysis and cooperation, but the composition of the samples and the different extraction dates from the Inventory must be considered. [ix]

Finally, It is crucial to remember that this data is self-reported. The responses show what practices administrations report having, but they do not to measure their operational scope, quality of application, or ultimate results. Therefore, these findings are restricted to the thirteen countries studied and should not be extrapolated to the entire LAC region.

3) Conclusions

From the foregoing analysis, it is clear that the tax administrations in LAC analyzed have an extended base of access and security controls, accompanied by data quality assessment practices and automatic detection of unauthorized access. Nevertheless, differences persist between countries and between the components of governance, especially in the existence of comprehensive strategies and specific privacy officers. The declared presence of these mechanisms constitutes a relevant starting point, although it does not, by itself, allow us to determine their effectiveness or consider the risks associated with the use of information to be resolved.

In my opinion, the immediate challenge lies in linking existing security controls with clear institutional responsibilities, quality criteria, and robust ethical frameworks to  guide the daily management of data operations. This need is directly related to the pillars examined in previous installments: digital identity and taxpayer touchpoints require reliable, up-to-date, and protected information to validate administrative actions and services.

Advancing towards Tax Administration 3.0 requires strengthening data governance as core component of institutional transformation. For the tax administrations in LAC, this means orienting information management towards simpler taxpayer services and better-informed decisions, while firmly preserving taxpayers’ trust and rights. In this process, regional cooperation and structured experience-sharing can greatly enhance capacities, addressing the specific needs and realities of each tax administration.

4) Next installment (Part 5)

In the next installment, we will develop the analysis of pillar (4), “Management and application of tax regulations”. We will examine how the LAC tax administrations incorporate digital tools and automation mechanisms into regulatory compliance, as well as their degree of alignment with the foundational principles of Tax Administration 3.0.

[i] https://www.ciat.org/inventario-global-2025-donde-estan-y-hacia-donde-van-las-administraciones-tributarias-en-el-ambito-de-la-digitalizacion-y-transformacion-digital-parte-1/ .  (Accessed October 24, 2026).

[ii] https://www.ciat.org/inventario-global-2025-donde-estan-y-hacia-donde-van-las-administraciones-tributarias-en-el-ambito-de-la-digitalizacion-y-transformacion-digital-parte-2/.  (Accessed October 24, 2026).

[iii] https://www.ciat.org/inventario-global-2025-donde-estan-y-hacia-donde-van-las-administraciones-tributarias-en-el-ambito-de-la-digitalizacion-y-transformacion-digital-parte-3/ (Accessed October 24, 2026).

[iv] OECD (2020), Tax Administration 3.0: The Digital Transformation of Tax Administration, OECD Publishing, Paris. Framework of the six pillars of digital transformation. https://doi.org/10.1787/ca274cc5-en.  (Accessed October 24, 2026).

[v] OECD (2025), Tax Administration Digitalization and Digital Transformation Initiatives, OECD Publishing, Paris, chapter 4, pp. 27–28. The analysis of this delivery is limited to data governance. https://doi.org/10.1787/c076d776-en. (Accessed October 24, 2026).

[vi] The group of thirteen countries defined in Part 2 and used in Part 3 is maintained to ensure continuity in the analysis. It is a selection of countries with information available in the OECD, Inventory of Tax Technology Initiatives, OECD Data Explorer as of October 23, 2026.

[vii] OECD, Inventory of Tax Technology Initiatives, OECD Data Explorer, DSD_QDD_ITTI@DF_QDD_ITTI dataset. Own elaboration with CSV and XLSX files extracted on October 23, 2026: 117 responses, corresponding to thirteen countries and nine variables (Q_AT_Q37-SQ001 to SQ009). Unweighted percentages, calculated as affirmative responses / 13 × 100. OECD Data Explorer. (Accessed October 24, 2026).

[viii] OECD, Global Survey on Digitalization 2024, “Data governance” block, question 37, p. 12. The indicator on AI refers to its use in data governance. The original designation of the privacy role is Data Privacy Officer; its legal equivalence with regulated positions in each country is not presumed. Survey questionnaire. (Accessed October 24, 2026).

[ix] The comparison is descriptive: the 2025 report and the regional extraction correspond to partially overlapping sets of administrations and different consultation dates.

9 total views, 9 views today