Ethics, Sustainability, Law and Governance

Introduction and Context

A business model is not merely a plan for generating revenue. It is a system that determines how an enterprise creates value, for whom value is created, how resources are used, and how risks and responsibilities are managed. Every business model therefore contains ethical, environmental, legal and governance choices. These choices influence reputation, access to finance, customer trust, employee commitment, regulatory approval and long-term survival.

For an entrepreneur, ethics and compliance should not be treated as administrative activities added after the business model has been designed. They should be integrated from the beginning. A platform that collects customer data, a food enterprise that makes health claims, a manufacturer that uses imported materials, and a social enterprise that employs vulnerable groups all face different responsibilities. Responsible business model planning asks not only “Can this be done?” and “Will customers pay?” but also “Should it be done?”, “Who may be affected?”, and “What safeguards are required?”

Law establishes minimum standards of acceptable conduct. Ethics often demands more than legal compliance. Sustainability considers whether value creation can continue without exhausting environmental, social or economic resources. Governance provides the structures through which decisions are directed, monitored and held accountable.

Learning Objectives

By the end of this chapter, the learner should be able to:

1. Explain the relationship between ethics, sustainability, law and governance in business model planning.
2. Identify and analyse the interests of key stakeholders.
3. Apply ethical frameworks to entrepreneurial decisions.
4. Assess social and environmental impacts using practical tools.
5. Recognise major issues involving intellectual property and consumer protection.
6. Design basic data-governance and regulatory-compliance controls.
7. Explain how responsible governance improves business resilience.
8. Recommend responsible actions in an applied business scenario.

1. Ethics as a Foundation of Business Models

Business ethics is the systematic study and practice of principles concerning right and wrong conduct in commercial activity. It concerns decisions involving honesty, fairness, rights, duties, harm, accountability and respect for persons.

An ethical business model aligns the enterprise’s methods of creating value with defensible principles. For example, a firm may create value by selling affordable financial services. If it conceals fees, exploits customers’ lack of financial knowledge or uses discriminatory algorithms, its revenue model may be profitable but ethically defective.

1.1 Stakeholder theory

Stakeholder theory holds that a business has responsibilities to groups that affect, or are affected by, its activities. Stakeholders may include:

• founders and investors;
• employees and contractors;
• customers and users;
• suppliers and distributors;
• government agencies and regulators;
• local communities;
• competitors;
• lenders and business partners; and
• the natural environment, represented through communities, regulators or advocacy groups.

This perspective differs from a narrow shareholder approach, which treats investor return as the dominant objective. It does not mean that every stakeholder demand can be satisfied equally. Rather, it requires the entrepreneur to identify material interests, assess conflicts and make decisions transparently.

A useful stakeholder analysis records four questions:

Stakeholder salience can be considered through power, legitimacy and urgency. A regulator may possess power and legitimacy; a local community may have strong legitimacy and urgent concerns even if it has limited formal power. Responsible planning avoids ignoring groups merely because they cannot immediately affect sales.

1.2 Ethical decision-making frameworks

Several frameworks help entrepreneurs structure difficult decisions.

Consequentialism evaluates likely outcomes. An action may be justified if it produces the greatest overall benefit or least total harm. Its weakness is that majority benefits can sometimes obscure harm to minorities.

Duty-based ethics asks whether an action respects duties, rights and rules. Deception, coercion and discrimination may be unacceptable even when they produce commercial benefits.

Virtue ethics focuses on the character of the decision-maker and the organisation. Honesty, courage, fairness, prudence and compassion are treated as enduring qualities rather than isolated acts.

Justice and fairness approaches examine how benefits, risks and opportunities are distributed. They are particularly relevant to pricing, access to services, employment and algorithmic decisions.

Care ethics emphasises relationships, vulnerability and responsiveness. It is useful when business decisions affect children, patients, elderly people, low-income households or dependent workers.

In practice, entrepreneurs should combine these approaches. A decision can be assessed by asking: What are the consequences? Are any rights violated? What would a trustworthy organisation do? Is the distribution fair? Who is vulnerable?

1.3 Common ethical risks

Early-stage ventures frequently experience ethical risks because of limited resources, informal processes and pressure to grow. Common risks include:

• overstating product performance or environmental benefits;
• hiding charges or using confusing terms;
• bribery, facilitation payments or conflicts of interest;
• unsafe working conditions;
• misuse of customer data;
• discriminatory recruitment or pricing;
• misleading investors about progress;
• copying a competitor’s protected work; and
• shifting pollution or waste to communities with limited political influence.

A code of ethics is useful only when supported by training, reporting channels, investigation procedures and consequences. Ethical culture is demonstrated by what managers reward, tolerate and measure.

2. Sustainability and Impact in Business Model Planning

Sustainability means meeting present needs while maintaining the conditions that allow future generations and other systems to meet their needs. For business, sustainability involves economic viability together with responsible management of environmental and social impacts.

The triple-bottom-line model considers:

• People: labour conditions, inclusion, health, safety, human rights and community welfare;
• Planet: energy, emissions, materials, water, biodiversity and waste; and
• Prosperity: financial viability, productive employment, innovation and long-term value.

The model is not a licence to trade one dimension against another without justification. A profitable enterprise that causes severe avoidable harm is not sustainable merely because it creates jobs.

2.1 From linear to circular thinking

A linear model typically follows the sequence “extract, produce, use and discard.” A circular model seeks to reduce material consumption and keep products and components in use through durability, repair, reuse, refurbishment, remanufacturing and recycling.

Entrepreneurs can examine each stage of a value chain:

1. sourcing of materials and labour;
2. production or service delivery;
3. packaging and distribution;
4. customer use; and
5. repair, return, recovery or disposal.

This analysis may identify opportunities for product-as-a-service models, refill systems, take-back schemes, shared assets and local repair networks.

2.2 Impact assessment

Impact assessment identifies intended and unintended effects. A practical process is:

1. define the activity and affected stakeholders;
2. establish a baseline;
3. identify positive and negative impacts;
4. estimate scale, duration, likelihood and reversibility;
5. prioritise material risks;
6. design prevention, mitigation or remedy; and
7. monitor results and revise the model.

Where data are available, an entrepreneur may use simple indicators such as energy consumed per unit, kilograms of waste per order, percentage of suppliers audited, employee injury frequency, customer complaint resolution time or percentage of sales reaching underserved customers. Indicators should be relevant, measurable and capable of verification.

A basic risk-priority approach can use:

Here, likelihood is a defined rating of how probable an event is, and impact is a defined rating of its consequences. The calculation is a prioritisation aid, not a precise prediction. Ratings must use a consistent scale, and high-impact risks should not be dismissed solely because they are unlikely.

2.3 Green claims and impact integrity

Environmental claims such as “eco-friendly,” “carbon neutral” or “sustainable” can mislead if they are vague, unsupported or based on a narrow part of the product’s life cycle. Good practice requires claims to be specific, evidence-based, understandable and proportionate. A claim that packaging contains recycled material should identify the relevant component and, where appropriate, the percentage and verification basis.

Social impact claims also require care. An enterprise should distinguish outputs, outcomes and impact. For example, “1,000 training places delivered” is an output; “800 participants obtained employment” is an outcome; “household income and economic security improved over time” is a broader impact claim.

3. Law as a Design Constraint and Strategic Resource

The precise legal obligations of a business depend on its jurisdiction, industry, legal form and activities. Entrepreneurs should obtain qualified local legal advice for specific decisions. Nevertheless, several legal categories are widely relevant to business model planning.

3.1 Business formation and contracts

The choice between a sole proprietorship, partnership, company, cooperative or social-enterprise structure affects liability, ownership, taxation, reporting and governance. Founders should document ownership contributions, decision rights, intellectual-property ownership, profit distribution, exit arrangements and dispute procedures.

Contracts clarify expectations concerning price, quality, delivery, confidentiality, ownership, warranties, liability, termination and dispute resolution. A contract should not be used to conceal unfair or unlawful terms. Entrepreneurs should pay particular attention to standard-form contracts imposed on consumers, workers or small suppliers.

3.2 Employment and occupational safety

Employment law commonly addresses wages, working time, leave, non-discrimination, dismissal, social protection and workplace safety. A venture that uses freelancers, platform workers or unpaid interns should not assume that labels determine legal status. The actual relationship, degree of control and applicable law are important.

A responsible business identifies hazards, provides appropriate training and equipment, reports incidents and maintains an environment free from harassment and discrimination. Safety is both a legal duty and a core operational risk issue.

3.3 Intellectual property

Intellectual property (IP) gives legal protection to certain creations and commercial identifiers. Main categories include:

Protection varies by country. Entrepreneurs should conduct a clearance search before adopting a brand, verify that employees and contractors assign or license relevant rights, retain evidence of creation, and maintain confidentiality before seeking patent protection where applicable.

Open-source software and creative-commons materials are valuable resources, but licences impose conditions. Some licences require attribution; others require derivative works to be distributed under the same or compatible terms. Ignoring licence obligations can create legal and operational problems.

3.4 Consumer protection

Consumer-protection law commonly addresses product safety, truthful marketing, fair terms, refunds, warranties, distance selling, privacy and complaint handling. A responsible enterprise should:

• provide accurate, understandable information;
• disclose the total price and material conditions;
• avoid dark patterns that manipulate consent or purchase decisions;
• ensure products meet safety standards;
• honour guarantees and return rights where applicable; and
• maintain accessible complaint and remedy processes.

Consumer trust is strengthened when the business treats complaints as information about system weaknesses rather than merely as threats to reputation.

4. Data Governance, Technology and Artificial Intelligence

Data governance is the system of policies, roles, controls and practices used to ensure that data are collected, accessed, used, stored, shared and deleted responsibly. It is relevant even to small enterprises using email lists, online payments, customer relationship software, location services or analytics.

Core principles commonly found in data-protection regimes include lawfulness, fairness, transparency, purpose limitation, data minimisation, accuracy, storage limitation, security and accountability. The exact rights and obligations depend on applicable law.

A small venture should establish:

1. what personal data it collects;
2. why each category is needed;
3. the legal basis or permission for processing;
4. who can access it;
5. how long it is retained;
6. how it is secured;
7. whether it is shared with vendors or transferred across borders; and
8. how individuals can exercise their rights.

Security controls may include strong authentication, least-privilege access, encryption where appropriate, backups, software updates, staff training, incident response and vendor due diligence. Security is not identical to privacy: a business may securely collect data for an unjustified purpose, or lawfully collect data but protect it poorly.

Artificial intelligence creates additional concerns involving biased training data, explainability, automated exclusion, inaccurate outputs, surveillance and unclear accountability. Before deploying an AI system, the entrepreneur should define its purpose, test performance across relevant groups, retain human review for high-impact decisions, protect confidential data and create a route for correction or appeal. AI-generated content should also be checked for accuracy, originality, confidentiality and compliance with applicable licences.

5. Governance, Accountability and Compliance

Governance is the system by which an organisation is directed, controlled and held accountable. In a small venture, governance need not involve a large board, but responsibilities should be clear and documented.

Important governance elements include:

• a defined mission and values;
• separation, where practical, between approval and payment functions;
• accurate financial and operational records;
• conflict-of-interest declarations;
• delegated authority limits;
• risk registers and review schedules;
• transparent reporting to owners and relevant stakeholders;
• whistleblowing or safe-reporting channels; and
• procedures for correcting misconduct.

Compliance means meeting applicable legal, regulatory, contractual and internal requirements. A compliance system commonly follows a cycle:

Identify → Assess → Control → Train → Monitor → Report → Improve.

The cycle is continuous. Laws, technologies, suppliers and business activities change. Compliance should therefore be connected to business-model review rather than treated as a one-time checklist.

A useful compliance register includes the requirement, responsible person, evidence of compliance, review date, risk if breached and corrective action. Examples include business registration, tax filings, licences, product standards, employment records, data notices, insurance and environmental permits.

6. Responsible Decision-Making in Practice

Entrepreneurs often face situations in which legal, ethical and commercial considerations conflict. A practical decision process is as follows:

1. Define the decision. State the proposed action and alternatives.
2. Identify stakeholders. Include less powerful and indirectly affected groups.
3. Gather facts. Separate verified information from assumptions.
4. Identify duties and constraints. Check law, contracts, policies, rights and safety requirements.
5. Test ethical implications. Examine consequences, rights, fairness, character and vulnerability.
6. Assess risk and materiality. Consider severity, likelihood, reversibility and public trust.
7. Consult appropriately. Seek technical, legal or community input where necessary.
8. Choose safeguards. Prevent harm first; then mitigate, monitor and provide remedy.
9. Document the rationale. Record evidence, alternatives and accountability.
10. Review outcomes. Measure whether the decision produced the intended result.

This process reduces “ethical fading,” in which commercial pressure causes people to perceive a moral issue merely as a financial or operational problem.

7. Applied Case: GreenBasket Local Delivery

The following is a fictional illustrative case.

Background

GreenBasket is a proposed digital platform connecting urban households with local farmers. Customers order produce through an application, while independent couriers deliver the orders. The founders plan to promote the service as “zero-waste and fair to farmers.” The application will collect names, addresses, payment details, dietary preferences and purchase histories.

Problem

During planning, the founders discover four concerns. First, some farmers use plastic packaging because reusable containers are not yet available. Second, the proposed commission may leave farmers with unstable income. Third, the marketing team wants to sell customer purchasing data to advertisers. Fourth, the founders have copied a competitor’s distinctive green logo and several interface elements.

Analysis

The stakeholder analysis identifies customers, farmers, couriers, employees, advertisers, the competitor, regulators and local residents. Farmers and couriers have limited bargaining power but are directly dependent on the platform. Customers may reasonably expect privacy and truthful environmental claims.

The environmental claim is too broad. GreenBasket may reduce transport distances and packaging, but it cannot claim “zero-waste” while sending plastic packaging to disposal and lacking a recovery system. The commission structure should be tested against farmers’ costs, seasonal variation and payment reliability.

Selling personal purchase histories raises data-governance questions. The founders must identify a lawful and transparent basis, provide meaningful information, limit use to a defined purpose and avoid assuming that general application acceptance constitutes informed permission for unrelated advertising. Aggregated, properly de-identified information may present lower risk, but de-identification must be assessed carefully because combinations of data can permit re-identification.

The copied logo and interface create trademark, copyright and passing-off risks, depending on the jurisdiction. Immediate clearance and redesign are necessary.

Approach and solution

The founders revise the model in five ways:

1. They replace “zero-waste” with specific, evidence-based claims about reusable-container trials and packaging reduction.
2. They introduce transparent commission terms, minimum payment information and a farmer advisory group.
3. They adopt privacy-by-design: collect only necessary data, separate service data from optional marketing consent, restrict access and establish retention periods.
4. They commission an original brand identity and conduct IP clearance.
5. They create a compliance register covering food safety, consumer law, privacy, courier classification, tax and advertising claims.

An independent review is scheduled after three months. Indicators include farmer payment time, complaint resolution, percentage of reusable deliveries, data incidents and courier injury reports.

Outcome and learning points

The revised model launches more slowly but gains trust among farmers and customers. Its claims are narrower but more credible. The case demonstrates that ethics, sustainability, law and governance can improve—not merely constrain—business design. Early identification of risks prevented potential litigation, reputational damage and costly redesign.

8. Challenges and Limitations

Responsible business planning has practical limitations. Small firms may lack legal expertise, data specialists and funds for certification. Regulations may be complex or inconsistent across markets. Impact measurement can be expensive, and some social outcomes are difficult to attribute to one enterprise. Sustainability claims may also involve trade-offs: reusable packaging can require additional washing, transport or water, while digital services can reduce travel but increase energy use and electronic waste.

Frameworks can become symbolic if they are not connected to decisions, budgets and accountability. A code of conduct will not prevent bribery if sales targets reward it. An environmental policy will not be credible if procurement ignores supplier practices. Entrepreneurs should therefore prioritise material risks, use proportionate controls and be honest about uncertainty.

9. Best Practices for Diploma-Level Entrepreneurs

A responsible business model should normally include:

• a written purpose and ethical commitments;
• stakeholder mapping and consultation;
• a basic social and environmental impact assessment;
• verified and specific marketing claims;
• documented ownership and licensing of IP;
• clear consumer terms, prices and complaint procedures;
• a data inventory, privacy notice and security controls;
• a legal and regulatory compliance register;
• conflict-of-interest and anti-bribery rules;
• health, safety and fair-work procedures;
• measurable indicators and periodic review; and
• an escalation process for serious concerns.

These practices are most effective when embedded in the business model canvas, financial assumptions, supplier selection, product design and performance reviews. Responsibility is not a separate department in a small venture; it is a design principle affecting every activity.

Chapter Summary

Ethics, sustainability, law and governance are strategic components of business model planning. Stakeholder theory broadens attention beyond investors to include customers, workers, suppliers, communities, regulators and the environment. Ethical frameworks—consequences, duties, virtues, justice and care—help entrepreneurs reason through difficult choices.

Sustainability requires attention to people, planet and prosperity, as well as impacts across the value chain. Circular models, specific environmental claims and measurable indicators support more credible value creation. Law provides requirements concerning business formation, contracts, employment, safety, intellectual property, consumer protection, privacy and sector regulation.

Data governance protects individuals and supports trustworthy technology, while AI requires attention to bias, transparency, human oversight and accountability. Governance converts values into responsibilities, controls, reporting and corrective action. A continuous compliance cycle—identify, assess, control, train, monitor, report and improve—helps ventures remain resilient. Responsible decisions are documented, evidence-based, stakeholder-aware and designed to prevent harm while creating sustainable value.

Key Terms

Ethics: Principles concerning right and wrong conduct in business decisions.

Stakeholder: A person or group that affects or is affected by an organisation.

Stakeholder theory: An approach that recognises responsibilities to multiple affected groups.

Sustainability: Creating present value without undermining future social, environmental or economic capacity.

Triple bottom line: Evaluation of business performance through people, planet and prosperity.

Circular economy: An economic approach that keeps products and materials in use and reduces waste.

Impact assessment: A structured evaluation of intended and unintended effects.

Greenwashing: Misleading presentation of environmental performance or benefits.

Compliance: Meeting applicable legal, regulatory, contractual and internal requirements.

Governance: Structures and processes for directing, controlling and holding an organisation accountable.

Intellectual property: Legal rights protecting creations, inventions, brands and confidential knowledge.

Copyright: Protection generally covering original expressive works such as text, images and software.

Trademark: A distinctive sign identifying the source of goods or services.

Trade secret: Confidential commercially valuable information protected through secrecy measures.

Consumer protection: Laws and practices intended to protect customers from unsafe, unfair or misleading conduct.

Data governance: Policies and controls governing the responsible management of data.

Privacy by design: Incorporating privacy safeguards into systems and processes from the start.

Conflict of interest: A situation in which personal interests may improperly influence official duties.

Ethical fading: The failure to recognise the moral dimension of a decision because attention shifts to commercial goals.

Risk register: A documented record of risks, controls, responsible persons and review actions.

Review Questions

5 Short Answer Questions

1. What is the difference between legal compliance and business ethics?
2. Identify four stakeholder groups relevant to a typical small enterprise.
3. What are the three dimensions of the triple-bottom-line model?
4. State four principles of responsible data governance.
5. Why should an entrepreneur conduct an intellectual-property clearance search?

5 Long Answer Questions

1. Explain how stakeholder theory can influence the design of a business model.
2. Compare consequentialism, duty-based ethics and virtue ethics in entrepreneurial decision-making.
3. Discuss how a small enterprise can move from a linear to a more circular business model.
4. Explain the relationship between consumer protection, truthful marketing and customer trust.
5. Describe the compliance cycle and explain why compliance must be continuously reviewed.

3 Analytical / Application Questions

1. A start-up wants to use customer location data to sell targeted advertising. Analyse the ethical, legal and governance issues and recommend safeguards.
2. A clothing venture discovers that its lowest-cost supplier has unsafe working conditions. Using stakeholder and sustainability reasoning, evaluate the available options.
3. Design a short ethics and compliance plan for a digital food-delivery enterprise. Include stakeholders, key risks, controls, indicators and review responsibilities.

Multiple Choice Questions with Answers

Question 1

Which statement best describes stakeholder theory?

A. A business is responsible only to its shareholders.

B. A business should consider groups that affect or are affected by its activities.

C. A business should avoid all decisions that involve risk.

D. A business should prioritise regulators over every other group.

Correct Answer: B. A business should consider groups that affect or are affected by its activities.

Question 2

Which of the following is part of the triple bottom line?

A. People

B. Patents

C. Promotions

D. Platforms

Correct Answer: A. People

Question 3

A business claims that its product is “eco-friendly” but provides no evidence or specific explanation. What is the main concern?

A. Price discrimination

B. Greenwashing

C. Copyright exhaustion

D. Corporate insolvency

Correct Answer: B. Greenwashing

Question 4

Which intellectual-property category most commonly protects a distinctive business logo?

A. Patent

B. Trade secret

C. Trademark

D. Copyright waiver

Correct Answer: C. Trademark

Question 5

What is the primary purpose of data minimisation?

A. To collect as much data as possible for future use

B. To collect only data necessary for a defined purpose

C. To prevent all data from being stored

D. To make data available to advertisers

Correct Answer: B. To collect only data necessary for a defined purpose

Question 6

Which sequence best represents the compliance cycle described in the chapter?

A. Advertise, sell, expand, borrow, merge

B. Identify, assess, control, train, monitor, report, improve

C. Recruit, dismiss, outsource, automate, close

D. Design, patent, export, franchise, liquidate

Correct Answer: B. Identify, assess, control, train, monitor, report, improve

Question 7

A founder evaluates a decision by asking whether it respects rights even if the decision reduces profit. Which ethical approach is being used?

A. Duty-based ethics

B. Pure consequentialism

C. Market signalling

D. Circular-economy analysis

Correct Answer: A. Duty-based ethics

Question 8

Which action is most consistent with privacy by design?

A. Collecting all available customer information before deciding why it is needed

B. Building privacy safeguards into the system from the beginning

C. Selling personal data unless customers complain

D. Allowing every employee unrestricted access to data

Correct Answer: B. Building privacy safeguards into the system from the beginning

Question 9

In the risk-priority approach, risk priority is represented as:

A. Likelihood ÷ impact

B. Impact − likelihood

C. Likelihood × impact

D. Likelihood + revenue

Correct Answer: C. Likelihood × impact

Question 10

Why should open-source software licences be reviewed before use in a commercial product?

A. Open-source software can never be used commercially.

B. Licences may impose conditions such as attribution or sharing derivative works.

C. Open-source software automatically transfers ownership of the entire business.

D. Licences apply only to physical machinery.

Correct Answer: B. Licences may impose conditions such as attribution or sharing derivative works.