DE Data Governance

As organizations accumulate more data across more systems, questions multiply: Who owns this dataset? Who is allowed to see it? What does this column actually mean? How long do we keep this data? Data governance provides the policies, processes, and organizational structures that answer these questions consistently across the entire organization.

What Is Data Governance

Data governance is the framework of rules, roles, and responsibilities that manages data as a strategic organizational asset. It determines who makes decisions about data, how data is defined and documented, who can access which data, how long data is retained, and how compliance requirements are met. Good governance makes data trustworthy, accessible to those who need it, and protected from those who should not have it.

The Building Code Analogy

Building codes dictate how structures are constructed — safety standards, material requirements, inspection checkpoints. They do not design specific buildings. They ensure that any building built meets minimum safety and quality standards, regardless of who builds it. Data governance works the same way: it sets the rules and standards that all data systems and data users must follow, without dictating exactly how any individual project uses data.

Key Components of Data Governance

Data Ownership

Every dataset has an owner — a person or team accountable for its accuracy, availability, and proper use. The data owner for a customer table is typically the CRM team. The owner for revenue data is the finance team. Ownership creates accountability: when data quality degrades or definitions change, there is a clear responsible party.

Data Stewardship

Data stewards are the practitioners who maintain data quality and documentation day to day. While a data owner is accountable at a business level, a data steward — often a data engineer or analyst — handles the technical work of keeping the data clean, documented, and properly classified.

Data Definitions and Business Glossary

One of the most common governance failures is when different teams define the same metric differently. The marketing team defines "active customer" as anyone who logged in within 90 days. The sales team defines it as anyone who made a purchase within 30 days. Both teams report "active customers" in monthly reviews, producing different numbers, and leadership does not know which to trust.

A business glossary documents agreed-upon definitions for every key business term. Once defined, every team uses the same definition and every pipeline implements it consistently.

Data Access Control

Not everyone should see everything. Patient health records should be accessible only to authorized medical staff. Employee salary data should be visible only to HR. Data governance defines access policies, and data engineers implement them through role-based access control in databases, data warehouses, and cloud storage.

Access Control Example:

Dataset: employee_salaries
  Role: HR_Admin     --> Full read/write access
  Role: HR_Analyst   --> Read access (no salary details column)
  Role: Manager      --> Read access for their own department only
  Role: Employee     --> No access

Dataset: customer_orders
  Role: Finance      --> Full read access
  Role: Marketing    --> Read access (no payment details)
  Role: Customer_Srv --> Read access for assigned customers only

Data Classification

Data governance classifies data by sensitivity level. Classification determines what protections apply and who can access each class of data.

Classification Level | Examples                       | Controls
---------------------|--------------------------------|---------------------------
Public               | Product catalog, press releases| No restrictions
Internal             | Sales targets, org charts      | Employees only
Confidential         | Customer PII, contracts        | Need-to-know basis
Restricted           | Health data, payment cards     | Strict access + encryption

Data Retention Policies

Governance defines how long each category of data is kept. Retaining data indefinitely wastes storage and increases legal risk — an organization cannot be compelled to produce data it no longer holds. Deleting data too quickly violates regulations. Retention policies specify: keep transaction records for 7 years, delete inactive user data after 3 years of inactivity, archive logs for 90 days then purge.

Regulatory Compliance

Multiple regulations govern how organizations collect, store, and use data. Data governance provides the framework for achieving compliance.

Regulation    | Region       | Key Requirements
--------------|--------------|------------------------------------------
GDPR          | Europe       | User consent; right to deletion; data minimization
CCPA          | California   | Right to opt out of data sale; disclosure
HIPAA         | USA          | Protect health records; access controls; audit logs
PCI DSS       | Global       | Protect payment card data; encryption; access logs
SOC 2         | USA/Global   | Security and availability controls; annual audit

The Data Governance Council

Effective governance requires coordination across departments. Many organizations form a data governance council — a cross-functional group including representatives from IT, finance, legal, marketing, and operations. The council sets policies, resolves definitional disputes, prioritizes governance initiatives, and ensures compliance with regulations.

Data Engineers and Governance

Data engineers implement governance policies technically. When governance defines an access control policy, data engineers create the database roles and grant the correct permissions. When governance defines a retention policy, engineers build the automated deletion or archival jobs. When governance classifies PII columns, engineers mask or encrypt those columns in datasets available to non-authorized teams.

PII Masking Example:

Raw data (Restricted -- HR access only):
+----------+---------------+-------------------+--------+
| cust_id  | name          | email             | salary |
+----------+---------------+-------------------+--------+
| C001     | Sara Patel    | sara@example.com  | 85000  |
+----------+---------------+-------------------+--------+

Masked data (Internal -- Marketing access):
+----------+---------------+-------------------+--------+
| cust_id  | name          | email             | salary |
+----------+---------------+-------------------+--------+
| C001     | S*** P***     | s***@***.com      | NULL   |
+----------+---------------+-------------------+--------+

Summary

Data governance establishes the rules, roles, and policies that make data trustworthy, accessible, and compliant. It covers data ownership, access control, business definitions, classification, retention, and regulatory compliance. Data engineers translate governance policies into technical implementations — access controls, masking, encryption, and automated retention jobs. Organizations that invest in governance build data assets that teams trust and regulators accept.