Data governance: what it is, roles, rules and controls for governing company data

Data governance, known in Italian as governance dei dati, is the set of roles, rules, processes and controls through which an organisation decides who is accountable for data, how it may be used, how reliable it must be and how it demonstrates that all this actually happens. It is not software, nor a project that comes to an end: it is a system of accountability that follows data throughout its entire life within the company.

The subject concerns those who lead the business as much as those who manage the systems. A report with different figures depending on the department, personal data kept without a reason, an artificial intelligence model fed with information whose origin nobody knows: these are governance problems before they are technology problems. That is why data governance is part of corporate governance as a whole.

Data governance: what it is and how it translates into Italian

Anyone searching for what data governance means finds a simple answer that conceals a far more complex concept. Governing data means deciding, explicitly, who can do what with which data, under which rules and with which checks. The literal Italian translation is “governance dei dati”, but in Italian business usage the English term data governance is almost always used, as with many terms in the field.

The term governance on its own refers to the system of rules, roles and controls by which an organisation is directed and kept under control. Readers looking for the general framework will find models and regulation in the guide to corporate governance. Data governance applies the same logic to a specific resource, data: it establishes the decision rights, responsibilities and control mechanisms that apply to it.

Three elements set it apart from a mere collection of good practices:

1. Explicit decisions. For every relevant data asset, it is written down who decides and who is accountable.
2. Shared rules. Definitions (what an “active customer” is, what “revenue” is) are the same across the whole company.
3. Evidence. The company must be able to show where a piece of data comes from, who has handled it and under what controls.

Data governance and data management: what is the difference?

The most common confusion is between data governance and data management. Data management covers the operational activities: collecting, storing, integrating, transforming and making data available. Governance, by contrast, sets the rules and responsibilities within which these activities take place. A useful formula: data management executes, data governance decides and verifies.

The two are never entirely separate. Without data management, rules remain on paper; without data governance, data activities each proceed on their own, with differing definitions and levels of quality.

Why data governance matters

The benefits of good data governance are concrete and are measured in decisions, risks and time.

• More reliable decisions. When definitions are shared and quality is controlled, management and functions work from the same numbers.
• Lower risk of non-compliance. Knowing which personal data are processed, where they are held and how long they are retained is the basis for meeting GDPR requirements and internal controls.
• Less reconciliation work. Part of analysts’ and controllers’ time is lost working out which version of a figure is the right one.
• Solid foundations for analytics and AI. Analytical models and artificial intelligence systems are only as reliable as the data that feeds them.
• Clear responsibilities. When something does not add up, everyone knows whom to ask and who must step in.

The cost of its absence is less visible but just as real: duplicated data, unjustified access, KPIs disputed in meetings, analytics projects that start over every time from data cleansing.

Principles of data governance

The principles of data governance are worded differently across frameworks, but converge on a few points. They can serve as a template for writing your own organisation’s principles.

1. Accountability. Every relevant data asset has a named owner.
2. Transparency. Definitions, rules and decisions are documented and accessible.
3. Quality. Data must be fit for use: accurate, complete, consistent and up to date.
4. Security and confidentiality. Access is proportionate to role, and the processing of personal data complies with the law.
5. Standardisation. Formats, naming conventions and definitions are consistent across functions and systems.
6. Traceability. The origin of a piece of data and the transformations it has undergone can be reconstructed.
7. Ethical use. Data is used for legitimate purposes consistent with the trust of customers, employees and partners.

The principle is a commitment, not a slogan: it has value only if it translates into a verifiable rule. “Quality data”, for example, becomes a completeness threshold measured every month on a dataset with a named owner.

Who is responsible for data governance: roles and responsibilities

The data governance lead is almost never a single person. It is a structure of roles, with decision rights distributed among them.

• Executive sponsor and governance committee. They approve policies and priorities and resolve conflicts between functions. In many companies the sponsor is the head of data (the chief data officer, where there is one), the general manager or a member of senior management.
• Data owner. The person responsible for a data domain: decides who may access it and for what purpose, and is accountable for its quality.
• Data steward. Looks after data day to day: definitions, quality rules, reporting and correcting anomalies.
• Data producer. The person who generates or enters the data within processes (a salesperson filling in a customer’s master record, a production operator). Quality starts here: if whoever produces the data does not know the rules, downstream controls are of little use.
• Data custodian. Manages the infrastructure on which the data resides (usually IT) and applies the security measures.
• Data Protection Officer (DPO). Where required by Article 37 of the GDPR, oversees compliance in the processing of personal data.

What does a data governance specialist do? They build and run this structure: they write the policies, define roles and metrics, coordinate owners and stewards, maintain the catalogue and glossary, and prepare the evidence for audits and controls. They are not solely responsible for the data: they help the functions take on that responsibility.

Data governance framework: where to start

A data governance framework is the structure that brings order to objectives, roles, rules, processes and tools. There is no single model: it must be adapted to the company’s size, sector, risks and maturity.

There are recognised references to draw on. The best known is the DAMA-DMBOK, the data management guide published by DAMA International, which describes the functions of data management (including governance) and is now in its second edition. A company framework uses it as a repertoire, not as a manual to be applied to the letter.

As for the operating model, there are three recurring choices:

Whatever the model, three requirements remain constant: decision rights are written down, the sponsor’s mandate is real, and the rules apply to working processes, not just to project documents.

The operational components of data governance

Policies work when they rest on concrete components. These are the main ones.

Metadata, catalogue and glossary

Metadata is data that describes data: name, meaning, format, owner, origin, confidentiality level. A data catalogue brings it together in a single point of reference; the business glossary sets the shared definitions of business terms. Without these two tools, the same word means different things in different functions, and every analysis starts again by working out what things mean.

Data lineage

Data lineage traces the path of a piece of data: where it originates, which systems and transformations it passes through, and where it is used. It helps assess the impact of a change, find the source of an error and prove where a figure in a report comes from.

Data classification

Data classification assigns each data set a level based on risk and value: for example public, internal, confidential, highly sensitive. Classification drives the other rules: who can access it, how it is protected, how long it is retained. Start with the most critical data, without trying to classify everything in a day, and assign each level a defined treatment.

Data quality

Data quality measures how fit data is for use. The most common dimensions are accuracy, completeness, consistency, timeliness, uniqueness and validity. Data quality management turns them into a process: critical data is selected, rules and thresholds are defined, measurement is continuous, and responsibility for correction is assigned to an owner. Measuring without assigning responsibility produces nothing but dashboards.

Master data management

Shared master records (customers, suppliers, products, sites) are used by many processes and systems: if different versions exist, problems multiply. Master data management defines a reference version for each master record, along with the rules for creating and maintaining it.

Data governance policies

The data governance policy brings together in an approved document the rules governing access, use, retention and deletion. An effective policy is brief, assigns precise responsibilities and refers to operating procedures; its strength depends on people knowing it and on controls verifying it.

Data governance, GDPR and the Data Governance Act

Data governance is not a legal requirement in itself, but several regulations demand capabilities that only sound data governance can guarantee.

GDPR. Regulation (EU) 2016/679 sets out the principles for processing personal data, including lawfulness and data minimisation, and the principle of accountability: whoever processes data must be able to demonstrate that they comply with the rules. It also provides for a record of processing activities (Article 30) and, where specified, a data protection officer (Article 37). Good data governance meets these requirements with a catalogue, roles and evidence already in place.

Data Governance Act. Regulation (EU) 2022/868 of 30 May 2022, also known as the Data Governance Act or the regulation on European data governance, is a pillar of the European data strategy: it aims to strengthen trust in data sharing and make data reuse easier. It provides mechanisms for reusing certain public-sector data, rules for data intermediation services and so-called data altruism. It has applied since September 2023. It should not be confused with corporate data governance: the regulation sets European rules for sharing, whereas corporate data governance organises internal roles and controls. The two meet when a company shares data with, or receives data from, other parties and needs to know on what terms.

Data governance and ESG

Sustainability data needs governing too. Answering which principle guides data governance in ESG calls for a simple criterion: ESG data must be handled with the same rigour as financial data. That means documented sources, an owner for every indicator, written calculation methods and traceability of the data all the way to the reporting document. Companies that already have a data governance system extend it to sustainability indicators; those starting from scratch gain, through ESG, a first use case for roles, definitions and lineage.

Data governance and artificial intelligence

AI data governance addresses two questions: which data can feed a system, and with what safeguards. AI systems use data to train, to respond and to decide. For them to do so as transparently as possible, they need clear data provenance, confidentiality levels, a legal basis for the use of personal data, quality and traceability, as well as control over who (people or automated agents) can access which information.

It is only one part of AI governance, not all of it: AI governance also covers investment choices, model risk, human oversight and accountability, which are dealt with in the AI governance guide. The point of contact is simple: without governed data there is no governable AI.

How to launch a data governance programme

A realistic programme moves in short steps, within a clearly defined scope.

The most common mistakes

• Treating it as an IT project. If roles are assigned to IT alone, business functions do not feel accountable and the rules are not applied.
• Starting with the tools. Buying a platform before deciding on roles and definitions only moves the problem.
• Trying to cover everything at once. A programme that extends to all data from the outset stalls; one focused on a single domain delivers results and buy-in.
• Appointing owners without a mandate. A data owner with neither the time nor the authority to make decisions is just a name on an organisation chart.
• Writing policies that nobody checks. A rule without periodic verification lapses within a few months.
• Forgetting the trust dimension. Data concerns people: customers, employees, partners. Digital trust and data ethics are the reason rules must be explained, not just imposed.

Data governance: what it is and how it translates into Italian

Anyone searching for what is meant by data governance or data governance meaning will find a simple answer: governing data means deciding, explicitly, who can do what with which data, under which rules and with which checks. The literal Italian translation is governance dei dati, but in Italian business usage the term is almost always data governance, as with many terms in the field.

The term governance on its own refers to the system of rules, roles and controls by which an organisation is directed and kept under control. Readers looking for the general framework will find models and regulation in the guide to corporate governance. Data governance applies the same logic to a specific resource, data: it establishes the decision rights, responsibilities and control mechanisms that apply to it.

Three elements set it apart from a mere collection of good practices:

1. Explicit decisions. For every relevant data asset, it is written down who decides and who is accountable.
2. Shared rules. Definitions (what an “active customer” is, what “revenue” is) are the same across the whole company.
3. Evidence. The company must be able to show where a piece of data comes from, who has handled it and under what controls.

Data governance and data management: what is the difference?

The most common confusion is between data governance and data management. Data management covers the operational activities: collecting, storing, integrating, transforming and making data available. Governance, by contrast, sets the rules and responsibilities within which these activities take place. A useful formula: data management executes, data governance decides and verifies.

The two are never entirely separate. Without data management, rules remain on paper; without data governance, data activities each proceed on their own, with differing definitions and levels of quality.

Why data governance matters

The benefits of good data governance are concrete and are measured in decisions, risks and time.

• More reliable decisions. When definitions are shared and quality is controlled, management and functions work from the same numbers.
• Lower risk of non-compliance. Knowing which personal data are processed, where they are held and how long they are retained is the basis for meeting GDPR requirements and internal controls.
• Less reconciliation work. Part of analysts’ and controllers’ time is lost working out which version of a figure is the right one.
• Solid foundations for analytics and AI. Analytical models and artificial intelligence systems are only as reliable as the data that feeds them.
• Clear responsibilities. When something does not add up, everyone knows whom to ask and who must step in.

The cost of its absence is less visible but just as real: duplicated data, unjustified access, KPIs disputed in meetings, analytics projects that start over every time from data cleansing.

Principles of data governance

The principles of data governance are worded differently across frameworks, but converge on a few points. They can serve as a template for writing your own organisation’s principles.

1. Accountability. Every relevant data asset has a named owner.
2. Transparency. Definitions, rules and decisions are documented and accessible.
3. Quality. Data must be fit for use: accurate, complete, consistent and up to date.
4. Security and confidentiality. Access is proportionate to role, and the processing of personal data complies with the law.
5. Standardisation. Formats, naming conventions and definitions are consistent across functions and systems.
6. Traceability. The origin of a piece of data and the transformations it has undergone can be reconstructed.
7. Ethical use. Data is used for legitimate purposes consistent with the trust of customers, employees and partners.

The principle is a commitment, not a slogan: it has value only if it translates into a verifiable rule. “Quality data”, for example, becomes a completeness threshold measured every month on a dataset with a named owner.

Who is responsible for data governance: roles and responsibilities

The data governance lead is almost never a single person. It is a structure of roles, with decision rights distributed among them.

• Executive sponsor and governance committee. They approve policies and priorities and resolve conflicts between functions. In many companies the sponsor is the head of data (the chief data officer, where there is one), the general manager or a member of senior management.
• Data owner. The person responsible for a data domain: decides who may access it and for what purpose, and is accountable for its quality. The topic is covered in depth in the guide to the data owner and data ownership.
• Data steward. Looks after data day to day: definitions, quality rules, flagging and correcting anomalies. The role and its link with the data owner are covered in the guide to the data steward.
• Data producer. The person who generates or enters the data within processes (a salesperson filling in a customer’s master record, a production operator). Quality starts here: if whoever produces the data does not know the rules, downstream controls are of little use.
• Data custodian. Manages the infrastructure on which the data resides (usually IT) and applies the security measures.
• Data Protection Officer (DPO). Where required by Article 37 of the GDPR, oversees compliance in the processing of personal data.

What does a data governance specialist do? They build and run this structure: they write the policies, define roles and metrics, coordinate owners and stewards, maintain the catalogue and glossary, and prepare the evidence for audits and controls. They are not solely responsible for the data: they help the functions take on that responsibility.

Data governance framework: where to start

A data governance framework is the structure that brings order to objectives, roles, rules, processes and tools. There is no single model: it must be tailored to the company’s size, sector, risks and maturity. The process of building one is covered in depth in the guide to the data governance framework.

There are recognised references to draw on. The best known is the DAMA-DMBOK, the data management guide published by DAMA International, which describes the functions of data management (including governance) and is now in its second edition. A company framework uses it as a repertoire, not as a manual to be applied to the letter.

As for the operating model, there are three recurring choices:

Whatever the model, three requirements remain constant: decision rights are written down, the sponsor’s mandate is real, and the rules apply to working processes, not just to project documents.

The operational components of data governance

Policies work when they rest on concrete components. These are the main ones.

Metadata, catalogue and glossary

Metadata is data that describes data: name, meaning, format, owner, origin, confidentiality level. A data catalogue brings it together in a single point of reference; the business glossary sets the shared definitions of business terms. Without these two tools, the same word means different things in different functions, and every analysis starts again by working out what things mean.

Data lineage

Data lineage traces the path of a piece of data: where it originates, which systems and transformations it passes through, and where it is used. It helps to understand the impact of a change, to find the source of an error and to prove where a figure in a report comes from. The guide to data lineage explains how to trace it and at what level of detail it is best to stop.

Data classification

Data classification assigns each data set a level based on risk and value: for example public, internal, confidential, highly sensitive. Classification drives the other rules: who can access it, how it is protected, how long it is retained. Start with the most critical data, without trying to classify everything in a day, and assign each level a defined treatment.

Data quality

Data quality measures how fit data is for use. The most common dimensions are accuracy, completeness, consistency, timeliness, uniqueness and validity. Data quality management turns them into a process: critical data is selected, rules and thresholds are defined, measurement is continuous, and responsibility for correction is assigned to an owner. Measuring without assigning responsibility produces nothing but dashboards.

Master data management

Shared master records (customers, suppliers, products, sites) are used by many processes and systems: if different versions exist, problems multiply. Master data management defines a reference version for each master record and the rules for creating and maintaining it. The details are in the guide to master data management.

Data governance policies

The data governance policy brings together in an approved document the rules governing access, use, retention and deletion. An effective policy is brief, assigns precise responsibilities and refers to operating procedures; its strength depends on people knowing it and on controls verifying it.

Data governance, GDPR and the Data Governance Act

Data governance is not a legal requirement in itself, but several regulations demand capabilities that only sound data governance can guarantee.

GDPR. Regulation (EU) 2016/679 sets out the principles for processing personal data, including lawfulness and data minimisation, and the principle of accountability: whoever processes data must be able to demonstrate that they comply with the rules. It also provides for a record of processing activities (Article 30) and, where specified, a data protection officer (Article 37). Good data governance meets these requirements with a catalogue, roles and evidence already in place.

Data Governance Act. Regulation (EU) 2022/868 of 30 May 2022, also known as the Data Governance Act or the regulation on European data governance, is a pillar of the European data strategy: it aims to strengthen trust in data sharing and make data reuse easier. It provides mechanisms for reusing certain public-sector data, rules for data intermediation services and so-called data altruism. It has applied since September 2023. It should not be confused with corporate data governance: the regulation sets European rules for sharing, whereas corporate data governance organises internal roles and controls. The two meet when a company shares data with, or receives data from, other parties and needs to know on what terms.

Data governance and ESG

Sustainability data needs governing too. Answering which principle guides data governance in ESG calls for a simple criterion: ESG data must be handled with the same rigour as financial data. That means documented sources, an owner for every indicator, written calculation methods and traceability of the data all the way to the reporting document. Companies that already have a data governance system extend it to sustainability indicators; those starting from scratch gain, through ESG, a first use case for roles, definitions and lineage.

Data governance and artificial intelligence

Artificial intelligence systems use data to train, to respond and to decide. AI data governance therefore addresses two questions: which data may feed a system, and with what safeguards. It requires data provenance, confidentiality levels, a legal basis for using personal data, quality and traceability, as well as control over who (people or automated agents) can access which information.

It is one part of AI governance, not all of it: AI governance also covers investment choices, model risk, human oversight and accountability, discussed in the guide to AI governance. The point of contact is simple: without governed data there is no governable AI.

How to launch a data governance programme

A realistic programme moves in short steps, within a clearly defined scope.

1. Define the mandate. Objectives, sponsor and scope: why governance is needed and what must change.
2. Choose a priority domain. Customers, suppliers, financial data or ESG data: an area where the problem is keenly felt and measurable.
3. Appoint the roles. For that domain, data owners and data stewards with real time and a real mandate.
4. Take a snapshot of the current state. Where the data sits, who uses it, which definitions are in circulation, which rules already exist.
5. Write the minimum rules. Definitions, classification, quality and access rules for critical data.
6. Build the tools. Glossary, catalogue, lineage, quality controls: with the complexity the domain requires, no more.
7. Measure and report. A handful of indicators (critical data with an assigned owner, classified data, quality issues resolved) presented to the committee at fixed intervals.
8. Extend. Move on to the next domain, taking forward what has been learnt.

The most common mistakes

• Treating it as an IT project. If roles are assigned to IT alone, business functions do not feel accountable and the rules are not applied.
• Starting with the tools. Buying a platform before deciding on roles and definitions only moves the problem.
• Trying to cover everything at once. A programme that extends to all data from the outset stalls; one focused on a single domain delivers results and buy-in.
• Appointing owners without a mandate. A data owner with neither the time nor the authority to make decisions is just a name on an organisation chart.
• Writing policies that nobody checks. A rule without periodic verification lapses within a few months.
• Forgetting the trust dimension. Data concerns people: customers, employees, partners. Digital trust and data ethics are the reason rules must be explained, not just imposed.