Abstract: Digitalization has become an essential option for enterprises in their production and operations today, while data security constrains the digitalization process. Enterprise digitalization can be divided into two stages: the application of digital technologies and the integration of digital technologies with business processes. The digitalization pathways include three models: internal development, partial outsourcing, and full outsourcing. Moreover, data breaches are difficult for third parties to observe, rendering data security inherently unenforceable. Based on the above characteristics and the theoretical framework of incomplete contracts, it is derived that when data security costs are low, the optimal digitalization path is full outsourcing; when specialized advantages are low, the optimal digitalization path is internal development; and when cross-organizational adaptation costs are low, the optimal digitalization path is partial outsourcing. It is evident that the path with the highest digitalization level is not necessarily the optimal digitalization path for enterprises. Further analysis reveals that financing constraints may alter the optimal digitalization path, where full outsourcing becomes the optimal choice under severe financing constraints. The risk of digitalization failure does not undermine the main conclusions. Therefore, enterprises should prioritize data security governance during the digitalization process to avoid potential data security issues, while governments should improve relevant laws and regulations to promote the integration of digital technology and business processes in enterprises.

Key words: data security, enterprise digitalization, incomplete contracts