This article explores the non-straightforward role of data about attacks on health in creating policy and normative change to safeguard access to healthcare and protect healthcare providers in conflict. Acknowledging the importance of data as a key component in the quest to reduce instances of attacks, we take this one step further, asking: what is the relationship between data, action, and change processes? While scholars have examined the efficacy of transnational advocacy, rarely has the specific role of data been the focus of analysis. Here we consider two pathways for creating change: operational change designed to prevent or mitigate the impact of attacks on health at the level of those affected by attacks, and normative change that leads to a reduction in the frequency of attacks, at the level of those perpetrating attacks. Drawing on research investigating the influence of data in humanitarian decision-making and security management and research on transnational advocacy, we discuss the lessons for responding to the problem of attacks on healthcare. We end by broadening the scope of our conclusions to highlight the non-straightforward role of data in operational and normative change processes more generally.