5.9 Management information systems

Learning objectives

• Define management information system (MIS), data analytics, database, cybersecurity and cybercrime.

• Explain how critical infrastructures (artificial neural networks, data centres and cloud computing) support business decisions.

• Explain how businesses use virtual reality, the internet of things, artificial intelligence and big data.

• Evaluate the use of customer loyalty programmes.

• Evaluate the use of data to manage and monitor employees, including digital Taylorism.

• Evaluate the use of data mining to inform decision-making.

• Discuss the benefits, risks and ethical implications of MIS and technological innovation for decision-making and stakeholders.

Introduction

A management information system (MIS) is the set of people, technology and procedures a business uses to turn raw data into information that managers can act on. Every function depends on it: marketing uses it to understand customers, operations to control stock and quality, human resource management (HRM) to plan and monitor the workforce, and finance to track costs, revenue and cash.

Digital technology has made MIS far more powerful and far more contested. A supermarket can now record every item each loyalty card member buys; a warehouse can measure each worker's output second by second; software can predict which customers are about to leave. These capabilities are a response to change in technology and competition, they depend on creativity in how data is used, and they raise serious questions of ethics about privacy, fairness and control.

What a management information system does

Businesses collect enormous amounts of data: raw facts and figures such as the time of a sale, the product bought, the price paid, or the number of hours an employee worked. Data on its own does not help a manager decide anything. It becomes information when it is organised, processed and presented so that it has meaning for a decision, for example "sales of oat milk in northern stores rose 14% in the last quarter" or "labour costs per order are highest on Sunday evenings".

An MIS works as a cycle. Data flows in from many sources (tills, websites, loyalty cards, payroll, suppliers, sensors, market research). The system stores it, usually in databases, then processes and analyses it and reports the results as dashboards, regular reports, alerts and forecasts. Managers use this information to decide and act, and the results of those actions are recorded as new data, so the cycle starts again.

The diagram shows why an MIS is more than software. Someone has to decide which data to collect, check that it is accurate, choose how it is analysed and interpret the reports. A powerful system that is fed poor data or read by untrained managers produces poor decisions, a problem often summed up as "garbage in, garbage out".

Information for each level of management

Different managers need different information. Operational managers (a store manager, a shift supervisor) need detailed, frequent information, such as today's stock levels or which staff are on shift. Middle managers need summaries over weeks or months to control performance, such as sales by region against budget. Senior managers need broad information, often combined with external data, to make strategic decisions such as entering a new market or closing a factory.

A good MIS gives each level information that is accurate, timely, relevant, complete enough and easy to understand. Too little information leads to guesswork; too much leads to information overload, where managers cannot see what matters among hundreds of reports.

Databases

Almost every MIS stores its data in databases. A database organises data so that it can be searched, sorted, updated and combined quickly. Most business databases are relational: data is held in tables (customers, products, orders, employees), each row is one record and each column is one field, and the tables are linked by shared fields such as a customer number.

A linked structure means a business can answer questions that cross departments. A retailer can join its customer table to its orders table to find which customers bought a product in the last month, then join that to its products table to see the profit margin of what they bought. A hospital can link patient records, appointment schedules and staff rotas. Before databases, the same questions needed staff to search paper files by hand.

Large organisations often copy data from many operational databases into a data warehouse, a central store designed for analysis rather than day-to-day transactions. Analysts then work on the warehouse without slowing down the tills or the website.

Why databases matter for decisions

• Speed: information that once took days to compile is available in seconds, so decisions can be made closer to events.

• Accuracy and consistency: one shared record of each customer or product avoids different departments working from different figures.

• Personalisation: linking a customer's details to their purchase history allows targeted offers and service.

• Control: managers can monitor stock, costs and performance continuously and spot problems early.

Databases also concentrate risk. If one database holds millions of customers' personal details, a single breach exposes all of them, so databases must be protected by cybersecurity.

Data analytics

Data analytics is the process of examining data to find patterns, trends and relationships that help managers make decisions. It ranges from simple calculations in a spreadsheet to statistical models run on billions of records.

Analysts usually distinguish four types of data analytics, each answering a harder question than the one before.

1. Descriptive analytics summarises what happened: sales last month, average basket size, labour turnover this year.

2. Diagnostic analytics explains why it happened, for example by comparing stores that cut prices with stores that did not.

3. Predictive analytics uses past patterns to forecast what is likely to happen, such as demand next week or which customers may leave. It builds on sales forecasting methods but uses many more variables.

4. Prescriptive analytics recommends what to do, often by testing many options automatically: the best price for each product, the best delivery route, the best staff rota.

The staircase in the figure shows that value rises with each step, and so do cost and difficulty. Many small businesses use only descriptive analytics from their till or accounting software, and that alone can improve decisions. Prescriptive analytics needs large data sets, specialist staff and often artificial intelligence.

Data analytics is used in every function. Marketing teams analyse which promotions raise sales; operations teams analyse defect rates and machine downtime; HR teams analyse absence and labour turnover; finance teams analyse costs and cash flow. Its value depends on the quality of the data and on managers being willing to act on results that may contradict their own judgment.

Cybercrime and cybersecurity

As more business activity depends on data and networks, criminals target them. Cybercrime covers any crime committed using computers or networks, or aimed at them. For a business it can mean stolen customer data, stolen money, systems locked until a ransom is paid, or production stopped altogether.

Common forms of cybercrime

The cyberattack on Jaguar Land Rover (JLR) in September 2025 shows how serious the impact can be for a manufacturer. JLR shut down its IT systems on 2 September, which paused its production and retail operations; the pause was extended to 1 October, after which production restarted gradually. Its accounts put the cost of the attack at £196 million, before the losses of suppliers whose orders stopped.

Sources: Wikipedia, "Jaguar Land Rover" (2026), citing The Times (2 and 23 September 2025), BBC News (22 October 2025) and Sky News (November 2025).

How businesses protect themselves

• Technical measures: firewalls, encryption of stored and transmitted data, anti-malware software, regular software updates and secure backups kept separate from the main network.

• Access controls: strong passwords, multi-factor authentication and giving each employee access only to the data their job needs.

• People: training staff to recognise phishing, because many attacks begin with one employee clicking a link.

• Planning: testing systems, monitoring for unusual activity and having a response plan ready. This links cybersecurity to contingency planning and crisis management.

Cybersecurity is a cost with no visible output when it works, so businesses are tempted to under-spend on it. The cost of failure, however, includes lost production, ransom demands, fines under data protection law, legal claims and long-lasting damage to reputation. A business that holds customers' data also has an ethical duty to protect it.

Critical infrastructures

Critical infrastructure is the set of physical and digital systems that an economy and society depend on so heavily that their failure would cause serious harm: electricity grids, water supply, transport, telecommunications, payment systems and, increasingly, the computing systems on which every MIS runs. Three of these underpin modern business information systems: data centres, cloud computing and artificial neural networks.

Data centres

A data centre is a building, or a group of buildings, that houses thousands of servers, storage systems and network equipment, with the power supply, cooling and security needed to run them continuously. Every online purchase, cloud application and AI model runs on servers in a data centre somewhere.

Data centres allow businesses to store and process data at a scale no office server room could match. They also bring costs and risks. They use large amounts of electricity and, in many designs, water for cooling, and their concentration in a few locations means that a power cut, fire or fault can disrupt thousands of businesses at once.

Ireland hosts many of the European data centres of large technology companies. The chart shows their electricity use rising every year from 1,238 GWh in 2015 to 6,969 GWh in 2024, when data centres used 22% of all metered electricity in the country, more than all urban households combined (18%). Worldwide, data centres used about 415 TWh of electricity in 2024, around 1.5% of global consumption, and that figure is projected to more than double to about 945 TWh by 2030, largely because of AI.

Sources: CSO, Data Centres Metered Electricity Consumption 2024 (10 June 2025); International Energy Agency, Energy and AI (2025).

For managers, this raises questions of sustainability and of cost. Businesses that rely on data centres are increasingly asked by investors and customers to report the emissions of their computing, and governments in places with tight electricity supply have restricted new data centre connections.

Cloud computing

Cloud computing means using computing resources (storage, processing power, software) owned and managed by another company and delivered over the internet, paying for what is used. Instead of buying servers and running its own data centre, a business rents capacity from a cloud provider such as Amazon Web Services, Microsoft Azure, Google Cloud or Alibaba Cloud.

Cloud services are usually grouped into three models, according to how much the provider manages.

• Infrastructure as a service (IaaS): the business rents servers and storage and installs its own systems on them.

• Platform as a service (PaaS): the provider also runs the operating system and tools, so the business only builds and runs its applications.

• Software as a service (SaaS): the business uses complete applications through a browser or app, such as online accounting, email or customer relationship software, paying a subscription.

Benefits and limitations of cloud computing

The balance depends on scale. Small and new businesses gain most, because they get computing power that would otherwise be unaffordable. Very large users sometimes find it cheaper to own their equipment: the file-storage company Dropbox moved its users' files from Amazon's cloud to its own hardware between 2014 and 2016.

Sources: Wikipedia, "Dropbox" (2026).

Artificial neural networks

An artificial neural network (ANN) is a type of computer model, loosely inspired by the way neurons in the brain are connected, that learns to recognise patterns from examples rather than following rules written by a programmer. Neural networks are the technology behind most modern artificial intelligence, including image recognition, speech recognition, translation and chatbots.

In the diagram, a subscription business feeds a neural network four facts about each customer. During training the network is shown thousands of past customers whose outcome is known (they stayed or they left). Each time it predicts wrongly, the weights on the connections are adjusted slightly. After enough examples, the network can predict which current customers are likely to leave, so the business can contact them with an offer first.

Neural networks can find patterns too complex for people to see, and they improve as more data arrives. In 2016 DeepMind trained neural networks on data from thousands of sensors in a Google data centre (temperatures, power use, pump speeds) and used their predictions to cut the energy used for cooling by up to 40%.

Sources: DeepMind, "DeepMind AI reduces Google data centre cooling bill by 40%", 20 July 2016.

Their main limitation is that they are often a "black box": even their designers cannot easily explain why a particular prediction was made. They also learn whatever patterns are in the training data, including unfair ones, which is the source of algorithmic bias. They need large amounts of data and computing power, so they depend on the other two critical infrastructures.

YouTube

Artificial intelligence

Artificial intelligence (AI) is the ability of computer systems to perform tasks that normally need human intelligence: recognising speech and images, understanding and producing language, making predictions and decisions. Most current AI uses machine learning, in which systems learn from data instead of being programmed with every rule, and much of it uses neural networks. Generative AI creates new content, such as text, images or computer code, in response to a prompt.

How businesses use AI

The Swedish payments company Klarna gives a clear example of AI replacing routine work. In February 2024 it reported that its AI customer service assistant had handled 2.3 million conversations in its first month, two-thirds of all its customer service chats, doing the work of 700 full-time agents. The average time to resolve an enquiry fell from 11 minutes to under 2 minutes, and Klarna estimated the assistant would improve its profit by US$40 million in 2024. Its workforce later fell from 5,527 in 2022 to 2,907, mostly as staff who left were not replaced.

Sources: Klarna press release, 27 February 2024; Wikipedia, "Klarna" (2026), citing The Guardian, 18 November 2025.

Benefits and limitations of AI

AI can lower costs, work continuously, handle huge volumes and improve with experience, giving a business a competitive advantage in speed and personalisation. It can also free employees from repetitive tasks for work that needs judgment, empathy or creativity.

AI also brings problems. Generative AI can produce confident but false answers, so its output must be checked. Systems trained on past data can repeat past discrimination. Customers may dislike dealing with machines on complex or emotional problems, and employees whose jobs are automated face redundancy or retraining. The investment is large, and the skills to use AI well are scarce.

Big data

Big data refers to data sets so large, fast-moving and varied that traditional databases and spreadsheets cannot handle them. Every card payment, website click, app location ping, social media post and sensor reading adds to it. Big data is valuable because, analysed together, it can show patterns that small samples miss.

Big data is usually described by its "Vs":

• Volume: the quantity of data, often measured in terabytes or petabytes.

• Velocity: the speed at which new data arrives and must be processed, often in real time.

• Variety: the range of formats, from structured tables to unstructured text, images, video and sensor readings.

• Veracity: how accurate and trustworthy the data is.

• Value: whether the data can actually be turned into better decisions.

Big data improves decisions in several ways. It allows market segmentation down to the individual customer, real-time adjustment of prices and stock, earlier detection of problems (a fall in demand, a rise in faults), and more accurate forecasts. Compared with traditional market research, it records what customers actually do rather than what they say they do, and it covers whole populations rather than samples.

Its limitations matter as much. Big data shows correlations, not causes, so managers can draw false conclusions. Storing and analysing it needs costly infrastructure and specialist staff. Much of it is personal data, so it is regulated and raises privacy concerns. Having more data does not guarantee better decisions: veracity and value have to be checked.

YouTube

The internet of things

The internet of things (IoT) is the network of physical objects, such as machines, vehicles, meters, shelves and wearable devices, fitted with sensors and connections so that they can collect and exchange data automatically over the internet, without a person entering it.

The IoT is one of the main sources of big data, and it gives managers real-time information about operations that used to be checked by hand or not at all. Common business uses include:

• Predictive maintenance: sensors on engines, lifts or production machines report vibration and temperature, so faults are repaired before a breakdown stops production.

• Stock control and logistics: tags and sensors track goods, vehicles and containers through the supply chain, and smart shelves report when stock is low.

• Energy management: smart meters and building sensors cut waste by adjusting heating, lighting and machinery automatically.

• New services: products that report their own use allow businesses to sell outcomes (hours of operation, a warm home) instead of the product itself.

Smart energy meters are one of the largest IoT networks in many countries. At the end of June 2026 Great Britain had 40 million smart meters in homes and small businesses, 92% of them operating in smart mode, which means sending readings automatically to the energy supplier. Suppliers use the data for accurate bills without meter readers and to design tariffs that reward using electricity at off-peak times.

Sources: Department for Energy Security and Net Zero, Smart meters in Great Britain, quarterly update June 2026 (27 August 2026).

The IoT also widens the target for cybercrime, because every connected device is a possible way into a network, and many cheap devices have weak security. Continuous data from devices in homes, vehicles or on employees' bodies also raises privacy questions.

Virtual reality

Virtual reality (VR) uses a headset and computer-generated images and sound to place the user inside a simulated three-dimensional environment that responds to their movements. It differs from augmented reality (AR), which adds digital images to the real world seen through a phone or glasses, such as an app that shows how a sofa would look in a customer's living room.

Businesses use VR mainly in three areas:

• Training: staff practise dangerous, rare or expensive situations safely, such as a fire evacuation, a difficult customer or the operation of new equipment.

• Design and product development: engineers and architects walk through a car, building or store layout before it is built, which saves the cost of physical prototypes and supports research and development.

• Marketing and sales: virtual tours of hotels, homes or showrooms, and immersive product experiences.

In 2018 Walmart announced it would place about 17,000 VR headsets in its US stores, four in each Supercenter and two in each smaller Neighborhood Market, to train employees with 360-degree video lessons. Walmart said staff who had practised with new online-order pickup towers in VR set them up more quickly once the real machines arrived.

Sources: TechCrunch, "Walmart is putting 17,000 Oculus Go headsets in its stores to help train employees in VR", 20 September 2018.

VR training can cut travel and training costs and let every employee practise the same scenario. The headsets and the content are expensive to produce, some users feel motion sickness, and a simulation can never reproduce every real situation, so VR usually complements rather than replaces on-the-job training.

Comparing the technologies

The technologies in an MIS work together rather than alone. IoT devices and customer transactions generate big data; the data is stored in databases in data centres, often through cloud computing; neural networks and other AI analyse it; and VR is one way the results can be used. Cybersecurity protects every stage.

Customer loyalty programmes

A customer loyalty programme rewards customers for buying repeatedly from the same business. The rewards may be points converted into vouchers, member-only prices, free items after a number of purchases, or status tiers with extra benefits. Supermarkets, airlines, hotels, coffee chains, cosmetics retailers and petrol stations all run them.

Types of loyalty programme

How a loyalty programme turns purchases into data

The reward is only half of the exchange. Each time a member scans a card or app, the business records who bought what, where, when and at what price. Over months this builds a detailed picture of each customer's habits, which the business analyses to decide on promotions, product ranges, store layouts and prices. The customer receives rewards; the business receives data.

The figure explains why businesses often value the data more than the extra sales. A supermarket can see that a family has started buying baby products and send relevant offers, notice that a regular customer has stopped buying fresh fish and test whether a discount brings them back, or find that customers who buy a certain bread also buy a certain cheese and place them nearby.

Evaluation: benefits of loyalty programmes

• Customer retention: keeping an existing customer is usually cheaper than attracting a new one, and loyal customers tend to spend more over time. Rewards create a cost of switching to a rival.

• Data for decisions: detailed purchase data supports targeted marketing, more accurate sales forecasting, better stock control and less waste.

• Personalisation: offers matched to each customer are more likely to be used than general promotions, so the marketing budget is spent more efficiently.

• New revenue: some retailers sell insights from their data, or targeted advertising space, to the brands they stock.

• Competitive advantage: a large, well-used programme is difficult for a new competitor to copy quickly.

Evaluation: limitations and risks

• Cost: rewards, technology, staff and data analysis are expensive. Rewards also reduce the effective price, cutting the profit margin on every sale.

• Loyalty may not be real: many customers belong to several competing programmes, so a scheme may reward people who would have shopped there anyway rather than changing behaviour. When every rival has a programme, none gains an advantage.

• Fairness of member pricing: when lower prices are available only to members, customers who cannot or will not join (some older people, people without smartphones, people who object to tracking) pay more.

• Misleading discounts: if the "regular" price is raised or set briefly before a member price is introduced, the saving shown may not be genuine, which can break consumer protection law.

• Privacy and data protection: collecting and analysing personal data brings legal duties and the risk of a damaging breach.

Whether a loyalty programme is worthwhile depends on the market and the business. It suits markets with frequent, repeat purchases and many close substitutes, such as groceries, coffee and fuel, where small rewards can change where people shop. It also depends on the business's ability to analyse the data: a programme that collects data nobody uses is simply an expensive discount. Finally, its long-term value depends on trust, because customers who feel misled or watched may leave the scheme or the business.

Using data to manage and monitor employees

The same technology that tracks customers can track employees. Employee monitoring is the collection and analysis of data about how employees work, to manage performance, safety and security. It ranges from clocking-in systems and sales figures to software that records keystrokes, screenshots, emails, location and the speed of every task.

Methods of monitoring

Managers use these data to set targets, allocate work, identify training needs, reward high performers, check that rules are followed and protect staff (for example, alerting a supervisor if a lone worker stops moving). In gig economy platforms, software allocates jobs, sets pay and can deactivate workers with little human involvement, a practice called algorithmic management.

Digital Taylorism

Frederick Winslow Taylor's scientific management, published in 1911, broke work into small, simple tasks, timed each one with a stopwatch and set a single "best way" and a target for every worker, with pay linked to output (Taylor's theory of motivation). Workers had little control over how they worked; managers did the thinking and workers carried out instructions.

Digital Taylorism applies the same ideas with digital technology. Software sets the method and pace of each task, measures every action continuously and compares each worker with the target and with colleagues. Scanners, apps and software take the place of the stopwatch and measure every employee throughout the working day.

Digital Taylorism is no longer limited to factories and warehouses. Call-centre software can script each conversation and time each call; delivery apps set routes and delivery windows; office software can score employees on their "active" time. It can also reach professional work, when tasks such as processing claims or reviewing documents are broken into standard steps measured by software.

In January 2024 France's data protection authority, the CNIL, announced that it had fined Amazon France Logistique €32 million for excessive monitoring of warehouse staff. Workers' scanners flagged an error if an item was scanned less than 1.25 seconds after the previous one, and recorded every interruption of one to ten minutes and every period of inactivity of ten minutes or more. The CNIL found that this forced employees to be ready to justify every break, that keeping all the data for 31 days was excessive, and that staff had not been properly informed. Amazon said it disagreed with the findings.

Sources: Lewis Silkin, "Amazon fined for excessive and illegal employee monitoring", 29 February 2024 (CNIL decision of 27 December 2023, announced 23 January 2024).

Evaluation: benefits of monitoring and digital Taylorism

• Higher productivity and efficiency: clear standards, targets and instant feedback can raise productivity and reduce waste, as Taylor's methods did.

• Objective performance data: decisions on pay, promotion and training can be based on measured output rather than a manager's impression, which can be fairer.

• Better planning: accurate data on task times allows better staffing, scheduling and forecasting.

• Safety and security: monitoring can detect dangerous behaviour, fatigue, theft and data leaks.

• Easier training: standardised tasks can be learned quickly, which suits businesses with high labour turnover or seasonal staff.

Evaluation: costs and risks

• Demotivation: constant surveillance signals distrust. Under Herzberg's and Maslow's ideas of motivation, it removes autonomy, recognition and the chance to use judgment, so it can lower morale and raise absence and labour turnover.

• Stress and health: a pace set by an algorithm, with no allowance for fatigue, can cause stress and injuries.

• Gaming the measures: employees focus on what is measured (speed, active time) and neglect what is not (quality, helping colleagues, creativity).

• Privacy and legal risk: monitoring must be lawful, necessary and proportionate under data protection law; excessive monitoring brings fines and legal claims.

• Industrial relations and reputation: intense monitoring can lead to conflict with trade unions and damage the employer's reputation with job applicants and customers.

The judgment depends on the type of work, the purpose and the way monitoring is introduced. Measuring the output of simple, repetitive tasks to plan staffing is easier to justify than recording the screens of professional staff. Monitoring that is transparent, explained, limited to what is necessary and used to support employees (training, safety, fair workloads) is more acceptable to staff and to regulators than secret, continuous surveillance used only to discipline. Businesses that rely on creativity, problem-solving and customer service usually gain more from trust and autonomy than from digital Taylorism.

Data mining to inform decision-making

Data mining is the process of searching large data sets automatically for patterns, relationships and anomalies that are not obvious, and turning them into information for decisions. Data analytics is the broad activity of examining data; data mining is the part of it that uses statistical and machine-learning techniques to discover patterns nobody was looking for.

Data mining techniques

• Association (market basket analysis): finding items that are often bought together, used for store layouts, bundles and recommendations.

• Clustering: grouping customers with similar behaviour into segments that were not defined in advance, used for targeted marketing.

• Classification and prediction: placing new cases into groups learned from past ones, such as "likely to leave", "likely to default" or "likely to respond to an offer".

• Anomaly detection: finding unusual cases, such as a fraudulent card payment or a machine behaving unusually.

Data mining of customer ratings can also improve products directly. From 2006 to 2009 Netflix offered a US$1 million prize to anyone who could improve the accuracy of its film recommendation system by 10%, releasing about 100 million ratings from roughly 480,000 customers. A team won in 2009, but Netflix cancelled a second competition in 2010 after a privacy lawsuit and concerns from the US Federal Trade Commission that "anonymous" ratings could be linked back to real people.

Sources: Wikipedia, "Netflix Prize" (2026).

Evaluation: data mining

The value of data mining depends on three conditions. The data must be accurate and lawfully collected; managers must test patterns before acting on them and combine them with judgment and qualitative information; and the use of the results must be one customers would accept if they knew about it. When these conditions hold, data mining gives a real advantage in markets with many customers and frequent transactions; without them, it can lead managers to act confidently on misleading patterns and expose the business to legal and reputational risk.

Benefits, risks and ethics of MIS and technological innovation

Management information systems and the technologies behind them affect every stakeholder. Judging them means weighing better decisions and lower costs against new risks and ethical problems.

Benefits for decision-making

• Faster decisions: real-time information lets managers react to changes in demand, supply or costs within hours.

• Better-informed decisions: evidence replaces guesswork, and scientific decision-making becomes possible at every level.

• Lower costs and less waste: accurate forecasts reduce stock and waste; automation reduces labour costs; predictive maintenance reduces breakdowns.

• Better customer experience: personalisation, faster service and more relevant products.

• Innovation: data shows unmet needs and makes new products and business models possible, linking MIS to innovation.

Risks

• Cybersecurity risk: more data and more connected devices mean more targets; a successful attack can stop operations entirely.

• Over-reliance: managers may trust outputs without questioning the data or assumptions, and lose the skills to decide without the system.

• Poor data quality: inaccurate, outdated or incomplete data leads to wrong decisions made with confidence.

• Cost: systems, data storage, security and specialist staff are expensive, and many technology projects run over budget.

• Dependence on suppliers and infrastructure: an outage at a cloud provider or data centre can stop thousands of businesses at once.

Ethical implications

Ethics concerns what is right, which may differ from what is legal or profitable. MIS raise five main ethical issues.

Privacy

Businesses can now know a great deal about individuals: where they go, what they buy, what they search for and, by inference, their health, finances and relationships. Even when customers agree to terms and conditions, few read or understand them, so consent may not be genuinely informed. The question for managers is whether a use of data is one the customer would reasonably expect.

Data protection law

Governments regulate the use of personal data. The best-known law is the European Union's General Data Protection Regulation (GDPR), in force since May 2018, which also applies to businesses outside the EU that offer goods or services to people in it. The United Kingdom kept the same rules after leaving the EU as the "UK GDPR", and many other countries have passed similar laws.

Under the GDPR, personal data must be processed lawfully, fairly and transparently; collected for specified purposes; limited to what is necessary (data minimisation); kept accurate; stored no longer than needed; and kept secure.

Individuals have rights to see their data, to have it corrected or deleted, to object to direct marketing and, in many cases, not to be subject to decisions made solely by automated means. The most serious breaches can be fined up to €20 million or 4% of a company's total worldwide annual turnover, whichever is higher. In October 2026 the Dutch data protection authority fined Uber €824,990,000 for unlawful automated decision-making and for giving insufficient information about profiling.

Sources: GDPR, Article 83 (gdpr-info.eu); European Data Protection Board, national news, 8 October 2026.

Bias in algorithms

Algorithmic bias occurs when an automated system produces results that are systematically unfair to certain groups, usually because it learned from biased historical data or because its designers chose variables that act as proxies for characteristics such as ethnicity, sex or age. In the Netherlands, a risk-classification algorithm used by the tax authority from 2013 to detect childcare benefit fraud used nationality as a risk factor, giving non-Dutch nationals higher risk scores. Tens of thousands of parents were wrongly treated as fraudsters, many were pushed into debt, and the government resigned in January 2021 over the wider scandal.

Sources: Amnesty International, "Xenophobic machines: Dutch child benefit scandal", 25 October 2021; Wikipedia, "Dutch childcare benefits scandal" (2026).

Surveillance

Employee monitoring and customer tracking can become surveillance: continuous observation that changes how people behave and shifts power towards the organisation watching. The ethical questions are whether the monitoring is necessary, proportionate and transparent, and whether those watched have any say.

Job losses

AI and automation replace routine tasks in customer service, administration, warehousing and increasingly in professional work. Businesses gain lower costs; employees face redundancy, retraining or lower-skilled work. New jobs are also created (data analysts, cybersecurity specialists, AI trainers), but rarely for the same people or in the same places. How a business manages this change, through retraining, redeployment and honest communication, is an ethical choice as well as an HR one.

Impact on stakeholders

Stakeholder interests often conflict. Shareholders may welcome the cost savings of AI customer service; employees whose jobs disappear will not; customers may enjoy faster answers to simple questions but dislike being unable to reach a person on a complex one. The stakeholders who matter most, and how strongly each is affected, differ from one business to another.

Evaluation: are MIS and technological innovation good for decision-making?

In the short run, new technologies often bring visible gains in speed and cost, while their risks (a breach, a fine, a loss of trust, demotivated staff) appear later. In the long run, businesses that use data responsibly tend to keep the trust of customers and employees, which protects the flow of data that makes their MIS valuable. Responsible use of data therefore contributes to the long-term sustainability of the business as well as meeting its legal duties.

The outcome depends on several factors: the quality and lawful collection of the data; the skills and judgment of the managers using it; the strength of cybersecurity; the organisational culture (trust or control); the size of the business and its ability to afford the technology; the regulatory environment in each country; and how far stakeholders are consulted. MIS improve decisions when they inform human judgment and are used transparently; they damage decisions and stakeholders when they replace judgment, hide how decisions are made or use data in ways people would not accept.

Case study: Tesco Clubcard and the value of customer data

Tesco is the largest supermarket in the United Kingdom, with a 28.5% share of the UK grocery market in 2025/26. Its Clubcard, launched in February 1995, was the first supermarket loyalty card in the UK and is one of the best-known examples of a business built around customer data. More than 23 million UK households use a Clubcard, and in 2025 it was used in 82% of Tesco's sales.

From the start the programme was designed as an information system as much as a reward scheme. Members earned points on each purchase, converted into vouchers several times a year. The data was analysed by dunnhumby, a customer data science firm founded in 1989 by Clive Humby and Edwina Dunn. Tesco bought 53% of dunnhumby in 2001, raised its stake to 84% in 2006 and later bought the rest. Dunnhumby used Clubcard data to segment customers by their habits and to send each household vouchers for the products it was most likely to buy, an early large-scale use of data mining for personalised marketing.

Sources: Tesco PLC, Annual Report and Financial Statements 2026; Retail Gazette, "Tesco marks 30 years of Clubcard", 17 February 2025; Wikipedia, "Clubcard" and "Dunnhumby" (2026).

From points to member prices and personalisation

Tesco later added Clubcard Prices: lower prices on thousands of products that only members can pay. This changed the exchange between customer and business. Customers who do not scan a card pay the higher shelf price, so almost every shopper has a strong reason to identify themselves at the till, which raises the share of sales Tesco can link to a household. The figures in the table are consistent with this, since more than four out of every five pounds spent at Tesco are now linked to a Clubcard.

Tesco has continued to deepen personalisation. In 2025/26 it launched a personalised version of Clubcard Prices, with offers tailored to each customer's shopping habits, expanded Clubcard Challenges (extra points for meeting personal spending goals) and invited 2.4 million customers to earn bonus points on fresh fruit and vegetables as part of a campaign to encourage healthier eating. In December 2025 it signed a three-year agreement with Mistral AI to develop generative AI tools. Dunnhumby and Tesco Media also earn revenue by selling insights and targeted advertising to the brands Tesco stocks.

As the glue that holds the whole Tesco ecosystem together, Clubcard and new AI tools can make every interaction more seamless and relevant by anticipating needs, offering timely nudges and making smarter recommendations.

— Tesco PLC, Annual Report and Financial Statements 2026

The quotation shows how Tesco now presents Clubcard as the link between its stores, app, pricing and AI tools, so the loyalty programme has become a central part of its management information system.

Scrutiny of loyalty pricing

Member pricing raised questions of fairness and accuracy. In September 2023 the consumer organisation Which? tracked 70 Clubcard Prices products at Tesco over six months and found that 24% had been at their "regular" price for less than half that time, so the saving shown could be misleading; in one case a product's regular price had been raised shortly before its Clubcard price appeared. Which? asked the Competition and Markets Authority (CMA) to investigate.

The CMA reviewed about 50,000 loyalty-priced products at five supermarkets and reported in November 2024 that 92% offered a genuine saving, typically 17–25%, with very little evidence of inflated regular prices. It also noted that loyalty prices are not always the cheapest option and that some people, such as those without smartphones, may find it hard to join and use the schemes.

Sources: Which?, "Supermarket loyalty card prices not as good as they seem", 15 September 2023; Grocery Gazette, "Supermarket loyalty scheme savings are 'genuine' despite customer doubts, says CMA", 27 November 2024.

What the case shows

Clubcard shows each part of an MIS working together: a database of purchases linked to households, data analytics and data mining by a specialist business, AI to personalise offers, and decisions on prices, promotions and ranges based on the results. It shows that a loyalty programme's main value can be the data, which supports competitive advantage and even new revenue streams, rather than the rewards themselves.

It also shows the limits. Member pricing improves Tesco's data, but it means non-members pay more, which raises ethical questions about fairness for customers who cannot or will not share data. The value of the scheme depends on customers trusting that discounts are genuine and that data is used in ways they accept; Which?'s findings showed how quickly that trust can be questioned. The figures in the table come from Tesco itself and from press reports, so they show the scale of the programme but not how much extra profit it generates compared with simply cutting prices for everyone; that is the evidence a full evaluation would need.

• Explain how Clubcard Prices changed the amount and quality of data Tesco collects.

• Analyse the benefits of Clubcard data for two of Tesco's functional areas.

• Discuss whether member-only pricing is ethical, with reference to two stakeholder groups.

Exam practice

Management information systems is an HL-only subtopic, so it appears in Paper 2 at HL and can provide the context for Paper 3, but not in Paper 1. The AO1 terms (data analytics, database, cybersecurity, cybercrime) are asked as "define", "describe" or "outline"; the AO2 technologies as "explain" or "analyse" applied to a case; and loyalty programmes, employee monitoring, data mining and the ethics of MIS can be asked as "discuss", "evaluate", "examine", "recommend" or "to what extent".

Definitions of the technologies earn full marks only when they include both what the technology is and how it works or what it is used for. A list of examples (a chatbot, a self-driving car) is not a definition of AI.

A "distinguish" question needs both terms and the difference between them made explicit; two separate definitions with no comparison earn only part of the marks. Extended responses then ask for judgment, as in the next question.

Summary

• An MIS turns data from many sources into information for decisions; a database stores the data and data analytics examines it.

• Cybercrime targets data and systems; cybersecurity protects them through technology, procedures and staff training.

• Data centres, cloud computing and artificial neural networks are critical infrastructures on which modern MIS depend.

• AI, big data, the internet of things and virtual reality improve speed, personalisation and efficiency, but bring costs, errors, security risks and job losses.

• Loyalty programmes exchange rewards for customer data; their value depends on purchase frequency, competition, cost and the ability to analyse the data.

• Employee monitoring and digital Taylorism can raise productivity but can also demotivate staff and breach privacy law if excessive.

• Data mining finds hidden patterns that inform decisions, but patterns are not causes and mining can intrude on privacy.

• The ethics of MIS (privacy, the GDPR, algorithmic bias, surveillance, job losses) shape whether data-driven decisions are sustainable.

Self-check

• To do:

  I can define MIS, data analytics, database, cybersecurity and cybercrime.

• To do:

  I can explain how data centres, cloud computing and artificial neural networks support business decisions.

• To do:

  I can explain a business use, a benefit and a limitation of AI, big data, the IoT and VR.

• To do:

  I can identify the four types of data analytics in a case.

• To do:

  I can evaluate a customer loyalty programme, including its costs and the value of its data.

• To do:

  I can evaluate employee monitoring and digital Taylorism, linking them to motivation.

• To do:

  I can evaluate data mining as a basis for decisions.

• To do:

  I can discuss the benefits, risks and ethical implications of MIS for different stakeholders, including privacy, the GDPR and algorithmic bias.