But isn’t there much more to data protection, e.g. inner workings of a company?

Absolutely, to be objective and empirical though we can only use publicly available data from the internet. Otherwise the results would not be comparable. We agree that Data protection also requires many internal technical measures, employee training programs and regular privacy risk management to name a few. But when we matched some extensive internal audit reports with a company’s Ubiscore scoring we often found correlations. For example a company hosting on secure servers in the EU that writes an easy to understand privacy policy, is taking first steps to valuing their customers data.