diff --git a/crates/cli/src/util.rs b/crates/cli/src/util.rs
index e92589d7..001624a7 100644
--- a/crates/cli/src/util.rs
+++ b/crates/cli/src/util.rs
@@ -114,13 +114,9 @@ pub async fn policy_factory_from_config(
         password: config.password_entrypoint.clone(),
     };
 
-    PolicyFactory::load(
-        policy_file,
-        config.data.clone().unwrap_or_default(),
-        entrypoints,
-    )
-    .await
-    .context("failed to load the policy")
+    PolicyFactory::load(policy_file, config.data.clone(), entrypoints)
+        .await
+        .context("failed to load the policy")
 }
 
 pub async fn templates_from_config(
diff --git a/crates/config/src/sections/policy.rs b/crates/config/src/sections/policy.rs
index b10c12b3..a99eb0d2 100644
--- a/crates/config/src/sections/policy.rs
+++ b/crates/config/src/sections/policy.rs
@@ -56,6 +56,10 @@ fn default_email_endpoint() -> String {
     "email/violation".to_owned()
 }
 
+fn default_data() -> serde_json::Value {
+    serde_json::json!({})
+}
+
 /// Application secrets
 #[serde_as]
 #[derive(Debug, Clone, Serialize, Deserialize, JsonSchema)]
@@ -86,8 +90,8 @@ pub struct PolicyConfig {
     pub email_entrypoint: String,
 
     /// Arbitrary data to pass to the policy
-    #[serde(default)]
-    pub data: Option<serde_json::Value>,
+    #[serde(default = "default_data")]
+    pub data: serde_json::Value,
 }
 
 impl Default for PolicyConfig {
@@ -99,7 +103,7 @@ impl Default for PolicyConfig {
             authorization_grant_entrypoint: default_authorization_grant_endpoint(),
             password_entrypoint: default_password_endpoint(),
             email_entrypoint: default_email_endpoint(),
-            data: None,
+            data: default_data(),
         }
     }
 }
diff --git a/docs/config.schema.json b/docs/config.schema.json
index 4ce59eb7..412edb98 100644
--- a/docs/config.schema.json
+++ b/docs/config.schema.json
@@ -188,7 +188,7 @@
         "authorization_grant_entrypoint": "authorization_grant/violation",
         "password_entrypoint": "password/violation",
         "email_entrypoint": "email/violation",
-        "data": null
+        "data": {}
       },
       "allOf": [
         {
@@ -1647,7 +1647,7 @@
         },
         "data": {
           "description": "Arbitrary data to pass to the policy",
-          "default": null
+          "default": {}
         }
       }
     },