What is data governance?
Definition
Data governance is a set of processes that ensures an organization's data assets are formally managed, with clear authority and rules for who can make decisions about the data it produces or manages.
- Category
- Data
- Also called
- data governance meaning
- Last updated
The NIST glossary, quoting CNSSI 4009-2022, defines data governance as a set of processes that ensures that data assets are formally managed throughout the enterprise. A data governance model establishes authority, management and decision-making parameters for the data the organization produces or manages.
In plain terms, data governance is the rulebook a company follows for its data. It answers questions like: who owns this dataset, who is allowed to see it, how long do we keep it, and who signs off before it is shared or deleted.
What it looks like in practice
A company with real governance usually has named owners for each important dataset, written rules for access, a policy for how long records are kept, and a process for handling requests from people about their own data. Without those, data piles up in spreadsheets and old systems that nobody is responsible for.
Why it matters to you
You don't run a governance program, but you live with the results. When a company has weak governance, old customer records stay around long after they are needed, more staff can open them than should, and nobody knows where a copy of your data lives when you ask for it to be deleted. Those are the conditions in which data leaks happen and deletion requests get missed.
Data governance vs. related terms
- Data governance sets the rules and decides who is accountable.
- Data protection is the legal duty to handle personal data lawfully, for example under GDPR or the UK Data Protection Act. Governance is one way an organization meets it.
- Data security is the technical side: encryption, access controls and monitoring that enforce the rules.
Governance covers all of an organization's data, not only personal data.
How to protect yourself
- 1
Ask what a company keeps and why
Send a data access request to see what an organization holds about you. How clearly they answer tells you a lot about how well they manage their data.
- 2
Ask for deletion when you stop using a service
Close the account and request deletion in writing, rather than leaving old accounts to sit with your data in them.
- 3
Give less in the first place
Data that was never collected can't be mishandled. Skip optional fields when you sign up.
- 4
Watch for your details appearing elsewhere
Serus finds where your personal details are listed publicly and removes them where it can, and monitors the dark web and breach databases and alerts you if your data appears.
See where your personal data is exposed
Serus finds it on data brokers and people-search sites and removes it.
Frequently asked
What is the purpose of data governance?
To make sure an organization manages its data as a formal asset, with clear authority over who decides what happens to it.
Is data governance the same as data protection?
No. Data protection is the legal duty to handle personal data properly. Data governance is the wider management framework for all data, and it helps an organization meet that duty.
Who is responsible for data governance?
The NIST definition says a governance model establishes authority and decision-making parameters, so in practice it is assigned to named owners and managers rather than left to chance.
Sources
Something wrong or out of date? Tell us and we'll re-check it.