Data Governance

Data governance is the framework of ownership, standards, policies, and processes determining how an organization's data is defined, managed, protected, and used. It covers who is accountable for each dataset, how quality is maintained, who may access what, how definitions are agreed, how long data is retained, and how regulatory obligations are met.

Its reputation as bureaucratic overhead is largely earned by programmes that begin with policy documents rather than with problems. A governance initiative that produces a comprehensive framework, a committee structure, and a set of policies before addressing anything anyone was actually struggling with will be complied with minimally and ignored where possible. Programmes that begin with a specific pain, such as conflicting revenue figures or an access request nobody could fulfil, build credibility that supports the broader work.

Ownership is the element that determines whether anything else functions. Most data problems persist because responsibility is diffuse: the system that produces the data belongs to one team, the pipeline to another, the reporting to a third, and the quality problem to nobody. Naming an accountable owner for each significant dataset, responsible for its definition, quality, and access decisions, converts recurring complaints into assignable work.

Classification is the practical foundation for both security and compliance. Knowing which data is personal, which is sensitive, which is commercially confidential, and which is public determines what controls apply, and organizations that have never classified their data cannot answer basic questions about where personal information resides. This becomes acute when a subject access or deletion request arrives and the organization discovers it does not know every location the data occupies.

Access control needs to balance protection against usability, and both failure modes are common. Excessively restrictive access produces the shadow analytics problem, in which people extract data into spreadsheets to do their work, creating uncontrolled copies that defeat the controls entirely. Excessively permissive access creates regulatory and commercial exposure. Role-based access with a straightforward request process, granting the minimum necessary while making legitimate access easy to obtain, is what avoids both.

Retention policy is frequently absent, and the default of keeping everything indefinitely is both a compliance risk and a cost. Data protection regimes generally require that personal data is not kept longer than necessary for the purpose it was collected for, which requires a stated purpose and a defined period. Beyond compliance, retained data must be secured, migrated, and searched during any incident, so indefinite retention carries ongoing cost and risk.

Cataloguing what exists is a prerequisite that organizations frequently skip. A data catalogue recording which datasets exist, where they live, what they contain, who owns them, and how they may be used converts an implicit map held in individual memories into a shared asset. Without it, new analysts spend weeks discovering sources, existing datasets are rebuilt because nobody knew they existed, and impact assessment before a system change is guesswork.

Regulatory obligations have made governance unavoidable rather than optional for most organizations. Data protection regimes require documented lawful bases, records of processing, the ability to fulfil individual rights, and demonstrable accountability, and sector-specific requirements add further obligations. Organizations without governance cannot evidence compliance even where their practice is adequate.

Because governance spans legal, technical, and operational decisions and requires authority to enforce, it fails when delegated entirely to a technical team. In practice the framework and accountability structure are established through strategic planning and consulting, the definitions and quality measurement sit with data analytics, the access controls and retention mechanisms are implemented by the IT department, and the obligations are most stringent for organizations handling sensitive information such as health providers.