Data governance
« Back to Glossary Index
Data governance is the system of ownership, definitions, standards and controls that determines how data is managed and used across an organization. It establishes who is accountable for each dataset, what terms mean, what quality is required, and who may access what.
It is widely understood as a restriction on what people can do with data. The more accurate framing is the opposite: governance is what makes it safe to give more people access, because it removes the ambiguity and risk that would otherwise justify keeping data locked down.
What Is Data Governance?
Data governance answers a set of questions that otherwise get answered inconsistently by whoever is in the room. Who owns this dataset? What does this measure mean, precisely? How current must it be? Who is allowed to see it? What happens when it is wrong?
Without governance, each of these is resolved locally. Two teams define active customer differently, both correctly for their purpose, and the organization has two customer counts with no way to reconcile them. Access is granted case by case with no consistent basis. Nobody is accountable when a dataset goes stale.
Governance is therefore less about control than about agreement — deciding these things once, writing them down, and assigning someone to maintain them. The control mechanisms follow from the agreements rather than the other way around.
What Governance Actually Covers
Ownership and stewardship. A named owner for each significant dataset who is accountable for its accuracy and fitness, and a steward who does the day-to-day work.
Business glossary and definitions. Agreed meanings for core terms, ideally implemented in a semantic layer so definitions are enforced rather than documented and ignored.
Data quality standards. What good looks like for each critical dataset, how it is measured, and what happens when it falls short. Closely tied to data quality practice.
Access and classification. Which data is sensitive, who may see it, and how access is requested, approved and reviewed.
Lineage and cataloging. Where data came from, what transformed it, and how anyone finds it. Without a catalog, governance policies apply to data nobody can locate.
Lifecycle and retention. How long data is kept, when it is archived, and when it must be deleted — increasingly a regulatory obligation rather than a housekeeping preference.
Roles and Ownership
Data owners are senior business people accountable for a data domain — customer, product, finance. They decide definitions and approve access, and the role fails when it is assigned to IT, because IT cannot adjudicate what a business term should mean.
Data stewards handle the operational work: maintaining definitions, monitoring quality, resolving issues. This is usually where governance succeeds or quietly stops, because stewardship is real work and frequently assigned on top of a full-time role with no time allocated.
Data custodians are the technical teams managing the platforms and implementing controls.
A governance council resolves disputes between domains — which matters, because cross-domain definition conflicts cannot be settled by either side alone.
Centralized, Federated and Data Mesh Models
Centralized governance puts a single team in charge of standards and definitions. It produces consistency and becomes a bottleneck at scale, because one team cannot understand every domain in depth.
Federated governance sets global standards centrally while domains own their own data within them. This is where most large organizations land, and it works when the central standards are genuinely minimal — extensive central rules recreate the bottleneck.
Data mesh pushes ownership fully to domains, which treat their data as a product with defined quality and interfaces, under federated computational governance where policies are enforced automatically by the platform rather than by review.
The choice should follow organizational structure rather than fashion. A centrally run business does not benefit from mesh; a federated group with autonomous business units will not sustain central governance regardless of how it is mandated. Setting this deliberately is the substance of a data governance strategy.
Why Governance Programs Fail
Policy without enforcement. Standards are documented and nothing checks compliance. The document exists; behavior is unchanged.
Boiling the ocean. Attempting to govern every dataset at once produces a multi-year exercise with no visible benefit, and loses sponsorship before reaching anything that matters.
Stewardship with no time. Roles assigned to people whose actual objectives are elsewhere. The work does not happen, and the failure is blamed on the individuals rather than the design.
Treated as a compliance project. Positioned purely as risk reduction, governance competes for funding against initiatives with visible upside and loses.
No connection to daily work. If governance lives in a separate tool nobody opens, it has no effect on what people actually do.
What works instead is starting with the datasets that feed decisions people already argue about — fixing those demonstrates value quickly and creates demand for the rest. Our data governance engagements are sequenced this way.
Governance for AI
AI has raised the stakes on governance rather than changing its fundamentals. Models trained on ungoverned data inherit every quality and consistency problem, and produce confident output regardless.
Three requirements have become sharper. Provenance — knowing exactly which data trained a model matters for reproducing results and for answering regulatory questions. Consent and permitted use — whether data may lawfully be used for model training is a different question from whether it may be used for reporting. Definition enforcement — natural-language and AI interfaces resolve ambiguous terms silently, so the semantic layer becomes the mechanism preventing confidently wrong answers.
The practical implication is that organizations deploying AI on ungoverned data are not moving faster; they are accumulating a liability that surfaces the first time someone asks how a decision was reached.
Frequently Asked Questions
Data governance is the system of ownership, definitions, standards and controls determining how data is managed and used — establishing who is accountable for each dataset, what terms mean, what quality is required, and who may access what.
Ownership and stewardship, a business glossary of agreed definitions, data quality standards, access control and classification, lineage and cataloging, and lifecycle and retention rules.
A data owner is a senior business person accountable for a domain who decides definitions and approves access. A data steward does the operational work of maintaining definitions, monitoring quality and resolving issues.
Data management is the practical work of storing, moving, securing and maintaining data. Data governance sets the rules that work follows — who owns it, what it means, what quality is required and who may see it.
Federated governance sets global standards centrally while individual domains own their own data within them. It is where most large organizations land, and it works only when the central standards are genuinely minimal.
Data mesh pushes ownership fully to business domains, which treat data as a product with defined quality and interfaces, under federated computational governance where policies are enforced automatically by the platform rather than through manual review.
Because policies are written without enforcement, every dataset is tackled at once with no early benefit, stewardship is assigned to people with no time allocated, governance is positioned purely as compliance, or it lives in a tool disconnected from daily work.
Models trained on ungoverned data inherit its quality and consistency problems while producing confident output. AI sharpens three requirements in particular: provenance of training data, whether its use for training is permitted, and enforced definitions so natural-language interfaces do not resolve ambiguity silently.
