Data Governance, Quality, Metadata and Lifecycle Management

Introduction

Modern organizations depend on data for operational decisions, regulatory reporting, artificial intelligence, customer service, risk management and strategic planning. Yet the value of data is not determined only by its volume or technical availability. Data must be understandable, accurate, protected, traceable and used for legitimate purposes. These requirements are the concern of data governance: the system of authority, accountability, policies, standards, processes and controls through which an organization manages data as an enterprise asset.

Data governance is strategic because failures in data management can produce financial loss, regulatory sanctions, discriminatory outcomes, security incidents and poor decisions. Conversely, well-governed data supports trustworthy analytics, interoperability, efficient reuse and organizational learning. Governance is therefore broader than database administration. Database administration focuses primarily on storage, performance, availability and technical operation, whereas governance determines who may define, use, modify, retain and dispose of data and under what conditions.

This chapter examines governance structures, data quality, metadata, lineage, data catalogs, master and reference data, lifecycle management, privacy, compliance and emerging technology. It also evaluates the limitations of governance programs and presents an applied case.

Learning Objectives

By the end of this chapter, students should be able to:

1. Explain the purpose, scope and strategic importance of data governance.

2. Distinguish governance, management, stewardship, ownership and custodianship.

3. Design governance roles, policies, decision rights and escalation mechanisms.

4. Assess data quality using appropriate dimensions and measures.

5. Explain metadata, lineage, catalogs, master data and reference data.

6. Develop lifecycle controls for retention, archival, legal hold and deletion.

7. Relate governance practices to privacy, security, regulation, ethics and trustworthy analytics.

8. Critically evaluate governance frameworks and apply them to an organizational case.

1. Foundations of Data Governance

1.1 Data as an organizational asset

Data has distinctive economic and operational characteristics. It can be reused without being consumed, combined with other data to create new value, and replicated at low marginal cost. At the same time, its value is context-dependent. A customer identifier, for example, is useful only when its meaning, accuracy, security classification and relationship to other records are known.

Data is also a source of organizational risk. A duplicated customer may cause repeated marketing communication; an incorrect address may disrupt service delivery; an incomplete medical history may endanger a patient; and an undocumented model feature may produce an unfair automated decision. Governance addresses these risks by making data-related decisions explicit and accountable.

1.2 Governance, management and administration

These terms are related but not interchangeable:

• Data governance establishes decision rights, policies, accountability and oversight.
• Data management executes practices for collecting, storing, integrating, securing, transforming and using data.
• Data stewardship performs operational coordination and quality oversight for particular data domains.
• Data ownership represents business accountability for the meaning, use and risk of a data domain.
• Data custodianship represents technical responsibility for implementation, availability, protection and operational control.

A data owner may decide that a field is mandatory and define its business meaning, while a custodian implements validation rules and access controls. A steward may monitor exceptions and coordinate correction among departments. Separating these responsibilities prevents the common error of assuming that the IT department alone owns enterprise data.

1.3 Governance principles

A mature governance program normally reflects the following principles:

1. Accountability: Every important data domain has an accountable decision maker.

2. Transparency: Definitions, sources, transformations and permitted uses are documented.

3. Fitness for purpose: Quality is judged against intended use rather than an abstract ideal.

4. Proportionality: Controls reflect sensitivity, risk, criticality and cost.

5. Security and privacy by design: Protection is incorporated at the beginning of data processes.

6. Interoperability: Shared standards enable systems and departments to exchange data consistently.

7. Lifecycle responsibility: Data is governed from creation through deletion.

8. Ethical use: Data use should respect fairness, human dignity, legitimate purpose and applicable rights.

2. Governance Operating Models and Roles

2.1 Centralized, federated and distributed models

In a centralized model, a central data office defines most standards and controls. This supports consistency but may be perceived as distant from business needs. In a distributed model, individual departments govern their own data. This improves local responsiveness but can create contradictory definitions and duplicated controls. A federated model combines enterprise standards with domain-level authority. A central body defines principles, common policies and shared services, while domain councils and stewards manage local implementation.

Federation is often suitable for large organizations because data has both enterprise-wide and domain-specific characteristics. However, federation requires clear decision rights. Without escalation rules, disputes may remain unresolved between departments.

2.2 Typical governance structure

A practical governance structure may include:

• Executive data council: Sets strategic priorities, resolves cross-functional conflicts and sponsors investment.
• Chief Data Officer or equivalent: Leads the governance portfolio and coordinates business and technical capabilities.
• Data governance office: Maintains the operating model, policies, standards, issue registers and performance reporting.
• Domain data owners: Define business meaning, acceptable use, criticality, quality expectations and access conditions.
• Data stewards: Maintain definitions, monitor quality, investigate issues and coordinate remediation.
• Data custodians: Operate platforms, implement controls, manage backups and maintain technical metadata.
• Privacy, legal, risk and security officers: Interpret obligations and assess threats, rights and compliance.
• Analytics and model-risk committees: Review data suitability, model use, explainability and monitoring.

A RACI matrix can clarify whether a participant is Responsible for performing work, Accountable for the result, Consulted before a decision or Informed after it. A useful governance design avoids assigning several parties as accountable for the same decision unless the decision mechanism is explicit.

2.3 Policies and standards

Governance policies should be concise, enforceable and connected to procedures. Common policies address:

• data classification and handling;
• access approval and periodic review;
• data quality and issue management;
• metadata and business glossary requirements;
• master and reference data;
• privacy, consent and secondary use;
• retention, archival and deletion;
• third-party data exchange;
• incident response and breach reporting;
• AI and analytical model governance.

A policy states what must be achieved and who is accountable. A standard defines a common rule, such as an approved date format or identifier pattern. A procedure explains how staff perform a task. A control provides evidence that a requirement is being followed.

3. Data Quality as Fitness for Use

3.1 Dimensions of quality

Data quality is multidimensional. Important dimensions include:

• Accuracy: The value correctly represents the real-world object or event.
• Completeness: Required values or records are present.
• Consistency: Values do not conflict across systems or records.
• Timeliness: Data is available and current when needed.
• Validity: Values conform to permitted formats, domains or business rules.
• Uniqueness: An entity or event is not represented redundantly inappropriately.
• Integrity: Relationships and constraints among data elements remain valid.
• Accessibility: Authorized users can obtain data in usable form.
• Traceability: The origin and transformation of data can be established.

These dimensions can conflict. A highly complete dataset may contain old or inaccurate values. A timely estimate may be less accurate than a later verified value. Consequently, quality requirements should be defined by business purpose, risk and service-level expectations.

3.2 Quality measurement

A quality metric should identify the population, rule, time period and treatment of exceptions. For example, a completeness rate can be expressed as:

Completeness rate = (number of records satisfying the required-value rule / total records assessed) × 100

This metric assumes that the assessed records are appropriately selected and that the required-value rule has been defined. If 9,700 of 10,000 customer records contain a required telephone number, the completeness rate is 97%. The result does not prove that the numbers are correct or reachable; those are separate quality dimensions.

A validity rate may similarly be calculated as the proportion of values conforming to a formally specified rule. A duplicate rate can be calculated as the number of records identified as inappropriate duplicates divided by the total records assessed. Organizations should document whether the denominator includes null records, rejected transactions or only accepted records.

3.3 Quality management process

A disciplined quality process includes:

1. Identify critical data elements and intended uses.

2. Define business rules and thresholds with data owners.

3. Profile data to discover patterns, missing values, outliers and duplicates.

4. Measure quality and prioritize defects by business impact.

5. Analyze root causes rather than repeatedly correcting symptoms.

6. Remediate data, processes, interfaces or source-system controls.

7. Validate the correction and monitor trends.

8. Record evidence, ownership and unresolved residual risk.

Root causes may include poorly designed forms, incompatible code sets, manual re-entry, ambiguous definitions, weak integration, inadequate training or deliberate manipulation. A governance program that only cleans downstream copies may allow defects to recur at their source.

3.4 Data quality rules and controls

Rules can be syntactic, semantic or relational. A syntactic rule may require an email address to follow an approved pattern. A semantic rule may require an account to be classified according to a defined business taxonomy. A relational rule may require every invoice to reference an existing customer. Automated controls are valuable, but exceptions should be routed to accountable staff rather than silently discarded.

Quality thresholds should be risk-based. A minor descriptive field may tolerate occasional missing values, while a regulatory reporting field may require near-complete coverage and documented reconciliation. Excessively strict controls can delay operations; excessively weak controls can make analytics unreliable.

4. Metadata, Lineage and Data Catalogs

4.1 Metadata categories

Metadata is data about data. It enables discovery, interpretation, control and reuse. Major categories include:

• Business metadata: Definitions, owners, classifications, permitted uses and criticality.
• Technical metadata: Schemas, data types, tables, columns, interfaces, APIs and storage locations.
• Operational metadata: Job schedules, processing status, volumes, failures and service levels.
• Process metadata: Transformation rules, workflow stages and business processes.
• Security metadata: Sensitivity labels, access permissions, encryption status and retention category.
• Quality metadata: Rules, scores, exception counts and certification status.
• Lineage metadata: Origins, transformations, dependencies and destinations.

Metadata is not merely documentation. It is an operational control that supports impact analysis, regulatory response, incident investigation and responsible analytics.

4.2 Data lineage

Data lineage describes how data moves and changes from an origin to a destination. Technical lineage may show tables, pipelines and transformations. Business lineage explains how a business measure, such as revenue, is derived and used. End-to-end lineage connects source systems, integration layers, warehouses, models, reports and decisions.

Lineage can be captured automatically from platforms, inferred from code or documented manually. Automatic capture improves scale but may not understand business meaning or dynamically generated logic. Manual documentation provides context but is expensive and can become obsolete. Effective programs combine technical discovery with steward validation.

4.3 Data catalogs and business glossaries

A data catalog provides searchable information about data assets. Typical catalog capabilities include asset discovery, definitions, ownership, tags, sensitivity classification, quality indicators, lineage, usage statistics and certification. A business glossary provides agreed definitions for terms such as “active customer,” “net revenue” or “high-risk transaction.”

Catalog adoption depends on trust and usefulness. A catalog containing thousands of unverified technical objects may overwhelm users. Prioritizing critical data products, assigning owners and marking certified assets improves practical value. Definitions should include the scope, calculation method, exclusions, time basis and responsible owner where relevant.

5. Master Data and Reference Data

5.1 Master data

Master data describes important, relatively stable business entities shared across processes, such as customers, products, suppliers, employees, locations and legal entities. A master data management program seeks to create consistent representations of these entities across systems.

Key activities include identity resolution, matching and merging, survivorship rules, hierarchy management, golden-record creation and synchronization. A golden record is an authoritative or best-available representation assembled from one or more sources. It should not be treated as automatically true; its source priorities, confidence, review process and update history must be understood.

5.2 Reference data

Reference data consists of controlled value sets used to classify or interpret other data, such as country codes, currencies, product categories, status codes and regulatory classifications. Reference-data governance defines allowed values, descriptions, ownership, versioning and mappings between incompatible code sets.

Master data and reference data are related but distinct. “Customer ABC” is a master-data entity; “customer status = active” uses reference data. Poor governance of either can compromise integration and reporting.

6. Data Lifecycle Management

6.1 Lifecycle stages

A data lifecycle commonly includes planning, creation or acquisition, classification, storage, use, sharing, transformation, archival and disposal. The stages may overlap, and different data types may follow different paths. Lifecycle management establishes controls appropriate to each stage.

At creation or acquisition, organizations should identify purpose, provenance, consent or legal basis, sensitivity and expected retention. During use, they should apply least-privilege access, monitor sharing and preserve relevant lineage. During archival, they should maintain retrievability, integrity and appropriate restricted access. At disposal, deletion must be authorized, demonstrable and technically effective.

6.2 Retention, archival and deletion

Retention schedules specify how long categories of data should be kept and why. They must balance legal obligations, operational needs, historical value, storage cost, privacy principles and litigation risk. Retaining data indefinitely is not automatically prudent: obsolete data increases attack surface and may create unjustified privacy risk.

A legal hold suspends ordinary deletion when litigation, investigation or regulatory action is reasonably anticipated. Holds must identify relevant data, custodians, systems and release conditions. Deletion after a hold is released should follow the approved schedule.

Deletion may involve database records, backups, replicas, caches, exports, logs and copies held by processors. Some environments use cryptographic erasure, secure overwriting or controlled destruction of media. Organizations should distinguish logical deletion from effective disposal and retain evidence of the action without unnecessarily retaining the deleted content.

6.3 Backup and lifecycle tension

Backups complicate deletion. Restoring an old backup may reintroduce data that was deleted from production. Therefore, backup schedules, restoration procedures and retention policies should be designed together. Where immediate physical deletion from immutable backups is infeasible, access controls, expiry dates and restoration-time suppression mechanisms may reduce risk, subject to legal and regulatory requirements.

7. Privacy, Security, Compliance and Ethics

Governance connects data management with privacy and security but does not replace either discipline. Privacy concerns appropriate collection, purpose limitation, transparency, individual rights and lawful processing. Security concerns confidentiality, integrity, availability, authentication, authorization and resilience.

Important controls include data minimization, pseudonymization, anonymization where genuinely effective, encryption, segregation of duties, access reviews, audit logging and incident response. Pseudonymization replaces direct identifiers but may remain reversible or linkable; it is therefore not equivalent to anonymization.

Compliance obligations vary by jurisdiction and sector. Governance teams should map obligations to data categories, processing activities, systems, vendors and controls rather than treating compliance as a one-time checklist. Cross-border transfers, children’s data, health information, financial records and biometric data often require heightened controls.

Ethical governance goes beyond legal compliance. A use can be lawful yet unfair, manipulative or socially harmful. Organizations should assess proportionality, representativeness, disparate impact, explainability and avenues for human review. Data used for machine learning may encode historical discrimination or omit affected populations. Governance should therefore include dataset documentation, model-risk review, monitoring for drift and procedures for challenging automated decisions.

8. Frameworks and Maturity Assessment

Organizations may draw on frameworks such as the DAMA Data Management Body of Knowledge, COBIT, ISO management-system standards, the NIST Privacy Framework, NIST Cybersecurity Framework and sector-specific controls. These frameworks differ in purpose: some organize data-management capabilities, some address governance and control, and others focus on privacy or cybersecurity. They should be adapted rather than adopted mechanically.

A maturity assessment can examine dimensions such as leadership, policy, roles, metadata, quality, architecture, privacy, security, lifecycle and measurement. A low-maturity organization may have informal ownership and inconsistent definitions. A developing organization may establish councils, policies and catalogs. A mature organization integrates governance into product development, procurement, architecture, analytics and operational monitoring.

Maturity labels should not become a substitute for outcomes. A large policy library does not demonstrate trustworthy data. More meaningful indicators include reduced critical defects, faster impact analysis, improved reporting reliability, timely access reviews, successful deletion tests and measurable business value.

9. Governance for Cloud, Data Products and AI

Cloud environments distribute data across managed services, regions, accounts and vendors. Governance must address shared responsibility, configuration drift, identity federation, data residency, portability, service-provider access and exit strategies. Infrastructure automation can embed classification, encryption and retention controls, but automation must itself be tested and governed.

The data-product approach assigns a team responsibility for a discoverable, documented and usable data product with defined consumers and service expectations. It can improve accountability and reduce dependence on a central bottleneck. However, data products require interoperability standards, shared identity resolution and enterprise-wide policies to avoid recreating departmental silos.

AI intensifies the need for provenance, quality and lineage. Teams should document training-data sources, licensing, consent conditions, transformations, known limitations, evaluation populations and model versions. Governance should also address prompt and retrieval data in generative AI systems, confidential-data leakage, hallucination risk, human oversight and monitoring after deployment. Not every AI risk can be solved through metadata; organizational accountability and domain expertise remain essential.

10. Illustrative Case: Federated Governance in a Health Insurance Organization

Background

The fictional “NorthStar Health Insurance” organization operates claims, member-service, provider-network and analytics systems. Executives discovered that reports on active members differed across departments. Analysts also spent substantial time reconciling provider identifiers, and a regulator requested evidence of how a risk indicator was calculated.

Problem

The organization had no agreed definition of “active member,” multiple provider-code mappings, inconsistent retention practices and undocumented transformations in a cloud data warehouse. The IT department was assumed to own data, but business units disputed corrections. Some dashboards displayed outdated quality information, and deletion requests were difficult to execute across analytical copies.

Analysis

A discovery exercise identified three root causes. First, business definitions were not assigned to accountable owners. Second, source systems used different identifiers and code sets. Third, lineage and retention controls had been designed independently by platform teams. The organization also measured data volume and pipeline availability but not critical data quality or deletion performance.

Approach and solution

NorthStar established a federated model. An executive data council set priorities, while member, provider and claims owners governed their domains. Stewards created a business glossary and approved definitions for active membership, paid claim and participating provider. A catalog linked these definitions to technical assets and lineage.

The organization introduced identity resolution for providers, documented survivorship rules and assigned confidence levels to matches. Critical data elements received validation rules and monthly quality reporting. The privacy office created a retention schedule, a legal-hold procedure and a deletion workflow covering production, warehouse and controlled downstream copies. Access reviews were integrated with identity management.

For the regulatory request, the analytics team produced lineage from source claims fields through transformations to the risk indicator. Model documentation identified data limitations and review responsibilities. The council approved a small set of outcome measures: critical-field completeness, unresolved high-severity issues, lineage coverage for regulatory reports, access-review completion and deletion requests completed within the required period.

Outcome

After two reporting cycles, departments used a common definition of active member and reconciliation effort decreased. Provider matching became more transparent because uncertain matches were routed for review rather than silently merged. The organization could explain the risk indicator and identify its source data. Deletion execution improved, although immutable backup handling remained an explicitly documented residual risk.

Learning points

The case demonstrates that governance is an operating model, not merely a catalog implementation. Business ownership, technical controls, quality measurement, lifecycle processes and evidence for regulators must work together. It also shows the importance of prioritization: governing every field equally would have delayed improvements to high-risk data.

11. Challenges and Limitations

Governance programs face several recurring difficulties. Ownership may be resisted because accountability appears to create liability without authority or resources. Definitions can become politically contested when metrics affect budgets or performance evaluation. Automated discovery may misclassify sensitive data, while manual documentation can become stale. Data-quality scores can create misleading confidence if rules measure easy-to-count defects rather than business fitness.

There are also economic trade-offs. Strong controls impose costs, latency and administrative work. Excessive centralization can inhibit innovation, while excessive decentralization can undermine consistency. Privacy-preserving transformations may reduce analytical usefulness. Deletion may conflict with auditability, historical research or model reproducibility. These conflicts require documented risk decisions rather than simplistic claims that one principle always dominates.

Governance can fail through symbolic compliance: committees meet, policies exist and tools are purchased, but staff do not change behavior. Effective programs connect controls to workflows, incentives, procurement, architecture reviews and leadership decisions. They also revisit governance as organizational structures, technologies, laws and public expectations change.

Best Practices

1. Begin with high-value, high-risk data domains rather than attempting universal control immediately.

2. Assign one accountable owner for each critical domain and document escalation paths.

3. Define business terms before building complex catalog or quality technology.

4. Measure quality against intended use and business consequences.

5. Fix recurring defects at their source whenever feasible.

6. Combine automated metadata capture with human validation.

7. Link classification, access, lineage, retention and quality metadata.

8. Test deletion and restoration procedures rather than relying on written policies.

9. Treat vendors, cloud services and analytical copies as part of the lifecycle.

10. Include privacy, security, ethics and accessibility in data-product design.

11. Report outcomes such as reduced defects and improved decision reliability, not only governance activity.

12. Review AI datasets and models throughout their operational lifecycle.

Chapter Summary

Data governance establishes the authority, accountability, policies and controls required to manage data as an organizational asset. Its scope includes ownership, stewardship, quality, metadata, lineage, master data, reference data, privacy, security, retention and deletion. Governance may be centralized, distributed or federated, but effective arrangements require clear decision rights and accountable domain owners.

Data quality is fitness for purpose and includes accuracy, completeness, consistency, timeliness, validity, uniqueness, integrity, accessibility and traceability. Measurement must define rules and populations, while remediation should address root causes. Metadata and catalogs make data discoverable and interpretable; lineage supports impact analysis, regulatory explanation and trustworthy analytics. Master-data management creates consistent entity representations, while reference-data governance controls shared code sets.

Lifecycle management governs data from acquisition through disposal. Retention schedules, legal holds, archival controls, backup design and deletion evidence must operate together. Privacy, security, compliance and ethics require proportional controls and should be integrated into architecture and operating processes. Frameworks provide useful structures, but maturity must be judged by outcomes rather than documentation volume. Cloud, data products and AI increase the importance of provenance, accountability and continuous monitoring.

Key Terms

Data governance: The system of authority, accountability, policies and controls for managing data.

Data stewardship: Operational coordination and oversight of data quality and meaning.

Data owner: The person or function accountable for a data domain’s meaning, use and risk.

Data custodian: The technical party responsible for operating and protecting data systems.

Data quality: The degree to which data is fit for an intended purpose.

Completeness: The presence of required data values or records.

Validity: Conformance with defined formats, domains or business rules.

Metadata: Data that describes data, its context, structure, use or control status.

Data lineage: The documented origin, movement and transformation of data.

Data catalog: A searchable inventory containing information about data assets.

Business glossary: An approved collection of business terms and definitions.

Master data: Shared data describing important business entities.

Reference data: Controlled values used to classify or interpret other data.

Golden record: A best-available or authoritative representation of an entity.

Retention schedule: A rule specifying how long a data category is kept and why.

Legal hold: A suspension of ordinary deletion due to anticipated or ongoing legal action.

Pseudonymization: Replacement of identifiers while preserving a possibility of linkage under controlled conditions.

Data product: A governed, discoverable data asset with defined ownership and consumer expectations.

Data lifecycle: The stages through which data is created, used, retained, archived and disposed.

Review Questions

Short Answer Questions

1. Distinguish data governance from data management.

2. What are the responsibilities of a data steward?

3. Name four dimensions of data quality.

4. Why is data lineage important for regulatory reporting?

5. Explain the difference between master data and reference data.

Long Answer Questions

1. Compare centralized, distributed and federated governance models. Under what organizational conditions might each be appropriate?

2. Explain how an organization should design and operate a data-quality management process.

3. Discuss the relationship among metadata, data catalogs, business glossaries and lineage.

4. Analyze the main requirements of retention, archival, legal hold and deletion management.

5. Evaluate how privacy, security and ethical considerations should influence data governance.

Analytical / Application Questions

1. A bank has three incompatible definitions of “active customer.” Design a governance intervention identifying roles, metadata, quality controls and escalation mechanisms.

2. A machine-learning model produces different approval rates across demographic groups. Propose a governance investigation covering lineage, data quality, ethics, monitoring and remediation.

3. An organization deletes records from its production database but retains them in warehouses, exports and backups. Develop a lifecycle-control plan and identify residual risks.

Multiple Choice Questions with Answers

Question 1

Which role is primarily accountable for the business meaning and permitted use of a data domain?

A. Data owner

B. Database operator

C. Network engineer

D. End user

Correct Answer: A. Data owner

Question 2

A completeness rate of 97% means that:

A. 97% of values are necessarily accurate

B. 97% of assessed records satisfy the required-value rule

C. 3% of records are duplicate

D. All records were created within 97 days

Correct Answer: B. 97% of assessed records satisfy the required-value rule

Question 3

Which metadata category describes tables, columns, schemas and data types?

A. Business metadata

B. Technical metadata

C. Ethical metadata

D. Financial metadata

Correct Answer: B. Technical metadata

Question 4

What is the principal purpose of a business glossary?

A. To increase network bandwidth

B. To define and standardize business terms

C. To encrypt database backups

D. To replace all source systems

Correct Answer: B. To define and standardize business terms

Question 5

Which statement best distinguishes master data from reference data?

A. Master data describes shared entities, while reference data contains controlled value sets

B. Reference data describes customers, while master data contains passwords

C. Master data is always unstructured, while reference data is always multimedia

D. There is no meaningful distinction

Correct Answer: A. Master data describes shared entities, while reference data contains controlled value sets

Question 6

What is the effect of a legal hold on ordinary deletion?

A. It accelerates deletion

B. It suspends deletion for relevant data

C. It anonymizes all data automatically

D. It transfers ownership to a vendor

Correct Answer: B. It suspends deletion for relevant data

Question 7

Which practice most directly supports understanding how a regulatory metric was produced?

A. Increasing storage capacity

B. Data lineage documentation

C. Changing the user interface

D. Reducing backup frequency

Correct Answer: B. Data lineage documentation

Question 8

Why should data-quality thresholds be risk-based?

A. Every data element has identical business importance

B. Controls should reflect intended use, impact and cost

C. Risk-based thresholds eliminate the need for owners

D. They guarantee that data is accurate

Correct Answer: B. Controls should reflect intended use, impact and cost

Question 9

Which statement about pseudonymization is correct?

A. It always makes data impossible to re-identify

B. It replaces identifiers but may preserve controlled linkability

C. It removes the need for access controls

D. It is identical to deleting data

Correct Answer: B. It replaces identifiers but may preserve controlled linkability

Question 10

Which governance model combines enterprise standards with domain-level authority?

A. Federated model

B. Uncontrolled model

C. Single-user model

D. Anonymous model

Correct Answer: A. Federated model