Resources
Data governance in a company
Governing your data means knowing at all times who owns what, where it resides, how long it is kept and how it can be retrieved. Four written answers are enough to turn an information system into a controlled asset.
Four written answers, kept current
Every dataset has a named business owner, who decides its use and arbitrates access. It resides somewhere, and that location commits the applicable jurisdiction. It is kept for a determined period, after which it is archived or deleted under a written rule. Finally it can be retrieved in an open format, which guarantees reversibility with respect to a supplier. Those four points fit in a one-page table, and that table is the governance.
- A named business owner for every dataset
- A known hosting location, with its jurisdiction
- A written retention period, and the action that follows it
- An open export format, tested at least once a year
- An access matrix reviewed at every staffing change
The governance table, column by column
Five columns are enough to govern a mid-sized information system. The table is kept current at quarterly reviews, and it serves directly as the basis for a compliance file.
| Column | What it holds | What it lets you decide |
|---|---|---|
| Dataset | The business name, not the technical one | Who joins the conversation |
| Owner | A named person, in a department | Who grants access and on what grounds |
| Location | The service and hosting region | The applicable jurisdiction and the recovery plan |
| Retention | A duration and the action at term | Archiving, deletion, anonymisation |
| Export | The format and last test date | Reversibility and the cost of changing supplier |
Where governance is taught
- hours in the data programme
- 120
- hours in the transformation certificate
- 40
- hours in the security programme
- 100
Life cycle, anonymisation, hosting, reversibility.
The same subject, from the executive's point of view.
Policy, risk analysis, frameworks, continuity.
Questions from management
Where do I start in a small organisation?
With the inventory: listing the datasets actually in use and assigning each an owner takes half a day and already covers most of the risk. The other columns are filled in afterwards, dataset by dataset.
What does reversibility cover?
The ability to retrieve your data in a usable format and put it back into service elsewhere. It is tested, like a backup: an annual export that has actually been reloaded is worth every contractual clause.
Who should maintain the governance table?
One identified person, reporting to management, who updates it at quarterly reviews with the business owners. The table stays short precisely so that one person can keep it current.
Explore next
- Personal dataPurpose, legal basis, minimisation, retention, security and individual rights: the processing register in practice.
- Industrial site safetyHSE management system, work permits, co-activity, internal audit, leading indicators and safety culture: a site's complete arrangement.
- Assessing a riskHazard, exposure, criticality, risk register and the hierarchy of prevention measures: risk assessment applied to a real workstation.
- Incident investigationFact gathering, causal tree, root causes, action plan and lessons learned: conducting an investigation after an incident or a near miss.
- Cybersecurity reflexesIdentities and permissions, updates, tested backups, network segmentation and awareness: the measures that protect most for the least effort.
- Responding to an incidentDetection, containment, eradication, restoration, evidence collection and the post-incident report: the response procedure and what it requires you to prepare.