Governance, Security, Privacy and Ethics

Introduction and context

Business intelligence (BI) converts data into information, insight and action. Dashboards, predictive models and automated decisions can improve efficiency, customer service and risk management. However, data-driven decisions also create exposure. Inaccurate data may lead to unfair outcomes; excessive access may cause breaches; opaque algorithms may make accountability difficult; and legally collected data may still be used in ways people reasonably consider intrusive.

Governance, security, privacy and ethics are therefore not separate technical concerns. They form an integrated system for ensuring that data and analytics are trustworthy, lawful, secure, explainable and aligned with organisational purpose. Governance establishes decision rights and accountability. Security protects information and systems. Privacy protects individuals and their legitimate interests. Ethics addresses whether a use is responsible, even when it is technically possible and legally permissible.

Learning objectives

By the end of this chapter, you should be able to:

• explain data and analytics governance, ownership and stewardship;
• distinguish confidentiality, integrity and availability in cybersecurity;
• apply access-control and information-classification principles;
• explain privacy principles, consent, retention and data-subject rights;
• identify major regulatory and compliance responsibilities;
• analyse bias, surveillance, manipulation and accountability risks;
• evaluate an automated decision using a responsible-use framework; and
• recommend practical controls for a BI or decision-support environment.

1. Data and analytics governance

Data governance is the organisational system of policies, roles, standards, processes and controls used to manage data throughout its life cycle. It answers questions such as: Who may define a customer? Which source is authoritative? How long should records be retained? Who approves access? How are quality problems corrected? How can an individual challenge an automated decision?

Analytics governance extends these concerns to models, reports, algorithms and decisions. It covers model purpose, input data, assumptions, validation, version control, monitoring, documentation, human oversight and retirement. A technically accurate model can still be poorly governed if it is used outside its intended population or if nobody is responsible for its consequences.

Governance principles

Effective governance normally reflects the following principles:

1. Accountability: a named person or group is answerable for each important data asset, model and decision.
2. Purpose limitation: data is collected and used for specified, legitimate purposes rather than undefined future use.
3. Data quality: data is sufficiently accurate, complete, timely, consistent and fit for its intended use.
4. Transparency: users and affected people can understand relevant processes, limitations and responsibilities.
5. Proportionality: collection, access and analytical intervention are proportionate to the legitimate objective.
6. Traceability: important changes, accesses, model versions and decisions can be reconstructed.
7. Continuous improvement: incidents, complaints, audits and monitoring results lead to corrective action.

Governance is often organised through a data-governance council, data owners, data stewards, information-security specialists, privacy officers, legal advisers, business users and internal audit. A governance council sets enterprise priorities and resolves conflicts. It should not replace operational responsibility; instead, it creates consistent rules and escalation routes.

Ownership, stewardship and custodianship

A data owner is accountable for a data domain or asset and decides its classification, permissible uses, access rules and retention requirements. Ownership is usually a business responsibility, such as a head of finance owning financial reporting data.

A data steward manages data quality and meaning in daily operations. Stewards define terms, investigate anomalies, maintain metadata and coordinate correction. They may not own the business risk, but they make governance operational.

A data custodian administers storage, platforms, backups and technical controls on behalf of the owner. A cloud provider may be a custodian or processor, but outsourcing infrastructure does not outsource accountability.

A data subject is an individual to whom personal data relates. Customers, employees, patients and citizens may all be data subjects. The organisation must distinguish these roles because technical administrators should not automatically decide business purposes, and business owners should not automatically receive unrestricted technical access.

Data life cycle and metadata

A useful life-cycle view is: collect or create, classify, store, use, share, archive and securely dispose. Controls should apply at each stage. Metadata—such as source, owner, definition, sensitivity, refresh frequency, lineage and retention period—makes data assets discoverable and interpretable.

A business glossary prevents semantic conflict. For example, “active customer” might mean a customer with any transaction in 12 months, while marketing defines it as a customer who opened an email in 90 days. Both definitions may be reasonable, but a dashboard must state which one it uses.

2. Information security for BI systems

Information security protects information and services against unauthorised disclosure, alteration and disruption. The classic CIA triad consists of:

• Confidentiality: only authorised people or systems can access information.
• Integrity: information remains accurate, complete and protected from unauthorised modification.
• Availability: authorised users can access systems and data when needed.

A sales dashboard may require confidentiality because it contains customer details, integrity because altered figures could mislead executives, and availability because managers need it during a critical planning period. Security priorities depend on context; not every dataset requires identical controls.

Threats and controls

Common threats include phishing, credential theft, malware, ransomware, insecure application programming interfaces, excessive privileges, insider misuse, unpatched systems, accidental disclosure and supply-chain compromise. Controls should be layered rather than relying on a single defence.

Least privilege gives a user only the access needed for an authorised task, for only as long as necessary. Separation of duties prevents one person from initiating, approving and concealing a sensitive action. Zero-trust security treats every access request as requiring verification, regardless of network location; it is a security approach, not a claim that trust is literally impossible.

Incident response normally includes preparation, detection and analysis, containment, eradication, recovery and lessons learned. Notification obligations may apply when personal data or regulated information is compromised. An incident plan should identify decision-makers, evidence-preservation procedures, communication channels and legal escalation.

3. Access control and accountability

Access control has three distinct stages:

1. Identification: a user claims an identity.
2. Authentication: the system verifies that identity.
3. Authorisation: the system determines what the authenticated user may do.

Role-based access control (RBAC) assigns permissions to job roles rather than individually managing every permission. Attribute-based access control (ABAC) evaluates attributes such as department, location, data sensitivity, device status and time. Row-level security can ensure that a regional manager sees only records for the manager’s region. These controls must be tested, reviewed and removed when roles change.

A useful access-governance process includes formal requests, owner approval, automated provisioning, periodic recertification, immediate removal after departure and logging of privileged activity. Shared accounts weaken accountability and should be avoided. Logs should capture who accessed what, when, from where and what action was performed, subject to appropriate privacy limits.

4. Privacy and personal data

Privacy concerns how information about people is collected, used, disclosed, retained and deleted. Personal data generally includes information relating to an identifiable person. Direct identifiers include names and identification numbers; indirect identifiers may include combinations such as postcode, age and occupation. Sensitive categories—depending on the applicable law—may include health, biometric, financial, children’s and precise location data.

Pseudonymisation replaces direct identifiers with a code while retaining a possibility of re-identification through additional information. It reduces exposure but does not necessarily make data anonymous. Anonymisation aims to make identification infeasible using reasonably available means, but re-identification risk must be assessed in context, especially when datasets can be combined.

Privacy principles

Widely recognised privacy frameworks emphasise:

• lawfulness, fairness and transparency;
• specified and legitimate purposes;
• data minimisation;
• accuracy;
• storage limitation;
• security and confidentiality; and
• demonstrable accountability.

Consent is one possible legal basis for processing in some legal regimes, but it is not a universal solution. Consent should be informed, specific, freely given and capable of withdrawal where required. An organisation should not disguise unnecessary processing as an unavoidable condition of service. Other legal bases may exist, such as contract, legal obligation or legitimate interest, but their availability and conditions depend on jurisdiction.

Privacy by design incorporates privacy controls from the beginning rather than adding them after deployment. Examples include collecting an age band instead of exact birth date, aggregating small groups, separating identity data from analytical data, restricting retention and testing disclosure risks before publication.

A privacy impact assessment is a structured evaluation of how a proposed activity affects individuals, what risks arise, whether the activity is necessary and proportionate, and which safeguards are required. High-risk profiling, large-scale monitoring, biometric processing or sensitive-data analytics commonly justify enhanced assessment and consultation.

Retention should be based on operational, legal and evidential needs. “Keep everything indefinitely” increases breach exposure and may conflict with storage-limitation principles. Secure disposal must cover databases, backups, exported spreadsheets, paper records and device storage.

5. Regulation and compliance

Regulation varies by country, sector and organisational role. Examples include comprehensive privacy laws, health-information rules, financial-sector requirements, employment law, consumer-protection rules, records-management duties and cybersecurity obligations. A multinational organisation may need to comply with several regimes simultaneously.

Compliance is more than possessing a policy. It requires evidence that controls operate: processing records, access reviews, training records, impact assessments, supplier agreements, audit logs, incident reports, model documentation and remediation tracking. Organisations should map data flows across collection, storage, processing, sharing and deletion, then identify the law and accountable party at each stage.

Third-party contracts should address permitted processing, confidentiality, security standards, sub-processors, audit rights, incident notification, data location, deletion and return. A vendor’s certification may provide evidence, but it does not eliminate the customer’s need for due diligence and oversight.

6. Ethics and responsible analytics

Ethics asks what an organisation ought to do, not merely what it can do. A responsible analytics assessment should consider autonomy, fairness, dignity, beneficence, non-maleficence, transparency and accountability. Stakeholders include data subjects, employees, customers, communities, decision-makers and people indirectly affected by the system.

Bias and fairness

Bias can enter through historical inequality, under-representation, proxy variables, measurement error, labelling decisions, sampling, missing data and the choice of outcome. Removing a sensitive attribute does not necessarily remove bias: postcode, language, occupation or purchasing patterns may act as proxies.

Fairness has multiple meanings. Group fairness compares performance or outcomes between groups. Individual fairness asks whether similar individuals are treated similarly. Procedural fairness concerns notice, explanation, opportunity to respond and appeal. These goals can conflict, particularly when base rates and error costs differ. Therefore, “fairness” must be specified in relation to the decision, stakeholders and consequences rather than treated as one universal metric.

A practical bias assessment should:

1. define the decision and affected groups;
2. examine representation and data quality;
3. test error rates and outcomes across relevant groups;
4. investigate causal explanations rather than relying only on correlations;
5. consult affected stakeholders;
6. apply mitigation such as better sampling, revised labels, threshold review or human intervention; and
7. monitor results after deployment.

Surveillance and manipulation

Analytics can become surveillance when monitoring is continuous, excessive, unexpected or used to control behaviour. Workplace productivity scoring, location tracking and facial recognition require particular care because power differences may make refusal difficult. Legitimate security or safety purposes do not automatically justify unlimited collection.

Manipulation occurs when systems exploit vulnerabilities, conceal material information or steer people toward outcomes contrary to their informed interests. Personalised pricing, dark patterns, addictive engagement design and microtargeting can undermine autonomy. Ethical design should provide meaningful choice, understandable communication and a way to contest consequential outcomes.

Explainability and human oversight

Explainability is context-dependent. A consumer may need a clear reason for a rejected application; an engineer may need technical documentation; an auditor may need data lineage and testing evidence. A complex model is not ethically acceptable merely because its output is accurate. For high-impact decisions, organisations should document purpose, variables, training data, performance, limitations, known bias, decision thresholds, human review and appeal routes.

Human oversight must be substantive. A human who simply approves every automated recommendation without time, authority or understanding is a rubber stamp. Reviewers need training, sufficient information and the power to override or suspend a system.

7. Governance of automated decisions and AI

An automated decision system may range from a simple rules engine to a machine-learning model. Governance should cover the complete model life cycle: proposal, risk classification, design, data preparation, development, validation, approval, deployment, monitoring, change control and retirement.

A model inventory should record owner, purpose, population, inputs, outputs, version, dependencies, risks, validation results and review date. Validation should test accuracy, robustness, data drift, subgroup performance, security and unintended use. Monitoring should identify changes in input distributions, performance, error patterns and user behaviour.

A risk-based approach is appropriate. A recommendation for arranging inventory may have limited consequences; a system affecting employment, credit, housing, education, healthcare or public benefits demands stronger controls. Prohibited or restricted uses may also arise under applicable law. Organisations should never assume that a general-purpose AI tool is safe for confidential data: prompts and outputs may be retained, exposed or used in unexpected ways according to the service arrangement.

8. An integrated governance framework

A practical framework can be organised into five linked questions:

This framework supports a control cycle: identify assets and risks, assess impact, select controls, implement them, monitor effectiveness, report exceptions and improve. Governance should be risk-based and proportionate, but “proportionate” must not become an excuse to ignore vulnerable groups or high-impact consequences.

Applied case: illustrative retail credit-screening system

Background

A fictional retail bank introduces a model to prioritise credit applications for manual review. The model uses repayment history, income, existing debt, application information and selected behavioural indicators. It is intended to reduce processing time and identify applications requiring additional evidence.

Problem

After deployment, approval rates differ substantially between neighbourhoods. A review shows that neighbourhood is not explicitly included, but several variables correlate with it. Applicants receive only a generic message when delayed or rejected. Staff cannot easily override the model, and an outsourced cloud provider retains application logs for an uncertain period.

Analysis

The bank faces several risks. Historical lending decisions may encode discrimination. Proxy variables may reproduce unequal treatment. The purpose may have expanded from review prioritisation to automatic rejection without formal approval. Lack of explanation and appeal weakens procedural fairness. Excessive provider retention creates privacy and security exposure. The absence of clear ownership makes remediation slow.

The bank should compare error and outcome patterns across legally and ethically relevant groups, while protecting sensitive information. It should test whether each variable is necessary, document the intended use, validate the model independently and establish a human review process. It should also complete a privacy impact assessment, revise the provider contract, minimise logs and set deletion periods.

Approach and outcome

The bank assigns a business owner, model steward, privacy officer and security custodian. The model is restricted to triage rather than automatic rejection. Applicants receive an understandable explanation of relevant factors and a route to provide corrections or request review. Monitoring is scheduled monthly, with thresholds for investigation and suspension. A board-level risk committee receives a quarterly report containing performance, fairness indicators, complaints, overrides, incidents and remediation status.

The outcome is not that all bias disappears. Rather, the organisation makes the system’s purpose narrower, its controls stronger and its decisions more contestable. This illustrates a central principle: responsible analytics is an ongoing governance process, not a one-time technical certification.

Challenges and limitations

Governance can become bureaucratic if every low-risk dashboard receives the same approval burden. Conversely, lightweight processes can miss cumulative harms when many small systems interact. Fairness metrics may conflict, and protected-group data needed for auditing may itself require careful handling. Explainability can be limited by complex models, trade secrets or insufficient documentation. De-identification is not a guarantee against re-identification. Security controls may reduce convenience, but weak controls transfer costs to affected people and the organisation.

Data quality problems often reflect business-process failures rather than database defects. Training and policies alone cannot prevent misuse if incentives reward speed without accountability. Finally, compliance does not equal ethics: an activity may satisfy the law while remaining unfair, manipulative or socially harmful.

Best-practice checklist

Before approving a BI product or automated decision, ask:

• Is the purpose specific, necessary and documented?
• Is the data accurate, relevant, minimised and lawfully obtained?
• Are owner, steward, custodian and decision-maker roles assigned?
• Are classification, least privilege, encryption, logging and retention controls active?
• Has privacy and stakeholder impact been assessed?
• Have bias, subgroup performance and unintended consequences been tested?
• Can affected people obtain an explanation, correction and meaningful review?
• Is there monitoring, incident response, audit evidence and a retirement plan?
• Are suppliers and AI tools governed contractually and technically?

Chapter Summary

Data and analytics governance establishes accountability, decision rights, standards and life-cycle controls. Owners determine business responsibility; stewards manage meaning and quality; custodians operate technical environments. Security protects confidentiality, integrity and availability through layered controls, least privilege, authentication, monitoring and resilience. Privacy requires purposeful, proportionate and transparent processing, minimisation, retention control, secure handling and respect for applicable rights and laws. Ethical analytics additionally examines fairness, autonomy, surveillance, manipulation, explainability and the ability to challenge decisions. Automated systems require life-cycle governance, validation, human oversight and continuous monitoring. Responsible BI is therefore a socio-technical discipline: sound technology must be combined with accountable institutions and respect for affected people.

Key Terms

Data governance: Organisational policies, roles and controls for managing data.

Analytics governance: Oversight of models, reports, algorithms and analytical decisions.

Data owner: Person accountable for a data asset’s business use and risk.

Data steward: Person who manages data definitions, quality and metadata.

Data custodian: Technical party responsible for storing and operating data systems.

Data subject: Identifiable individual to whom personal data relates.

Metadata: Information describing data’s meaning, source, lineage, quality and controls.

Confidentiality: Protection against unauthorised disclosure.

Integrity: Protection against unauthorised or improper alteration.

Availability: Accessibility of systems and information to authorised users.

Least privilege: Granting only the access necessary for an authorised task.

Role-based access control: Assigning permissions through organisational roles.

Pseudonymisation: Replacing identifiers with codes while retaining possible re-identification.

Anonymisation: Processing intended to make identification infeasible using reasonable means.

Purpose limitation: Using data only for specified, legitimate purposes.

Privacy impact assessment: Structured evaluation of privacy risks and safeguards.

Model governance: Controls over an analytical model throughout its life cycle.

Proxy variable: Variable that indirectly represents a sensitive characteristic.

Explainability: Capacity to communicate how or why a result was produced.

Accountability: Duty to justify actions, accept responsibility and provide remedy.

Review Questions

Short Answer Questions

1. Distinguish a data owner, data steward and data custodian.
2. What are confidentiality, integrity and availability?
3. Why does pseudonymisation not necessarily make data anonymous?
4. Explain the principle of least privilege.
5. Why is legal compliance not always sufficient for ethical analytics?

Long Answer Questions

1. Explain how a data-governance programme supports trustworthy BI across the data life cycle.
2. Discuss the relationship between privacy by design, data minimisation and retention control.
3. Compare RBAC and ABAC and identify circumstances in which each may be useful.
4. Explain how bias can enter an automated decision system and describe a mitigation process.
5. Describe the governance requirements for deploying a high-impact analytical model.

Analytical / Application Questions

1. A retailer wants to combine loyalty-card, location and social-media data to personalise prices. Analyse the governance, privacy, security and ethical risks, and recommend controls.
2. An employee-performance dashboard ranks workers using productivity, attendance and email-activity data. Evaluate whether the system could become surveillance or produce unfair outcomes. Propose a responsible design.
3. A hospital uses an AI tool to prioritise patients for follow-up. Design an accountability and monitoring framework covering ownership, validation, human review, privacy, bias and appeal.

Multiple Choice Questions with Answers

Question 1

Which role is primarily accountable for the business use, classification and access rules of a data asset?

A. Data owner

B. Data custodian

C. Network technician

D. External auditor

Correct Answer: A. Data owner

Question 2

In the CIA triad, which property concerns protection against unauthorised alteration?

A. Confidentiality

B. Integrity

C. Availability

D. Authentication

Correct Answer: B. Integrity

Question 3

Which control best illustrates least privilege?

A. Giving all analysts administrator rights

B. Allowing an analyst access only to the regional data needed for the analyst’s role

C. Using one shared account for a team

D. Keeping access permanently after an employee changes jobs

Correct Answer: B. Allowing an analyst access only to the regional data needed for the analyst’s role

Question 4

Why is pseudonymised data not automatically anonymous?

A. It cannot be stored in a database

B. The replacement code may permit re-identification using additional information

C. It contains no personal information under any circumstances

D. It is always publicly available

Correct Answer: B. The replacement code may permit re-identification using additional information

Question 5

Which practice is most consistent with data minimisation?

A. Collecting every available attribute for possible future use

B. Retaining all records indefinitely

C. Collecting only the information necessary for the specified purpose

D. Copying personal data into every department

Correct Answer: C. Collecting only the information necessary for the specified purpose

Question 6

What is a central purpose of a privacy impact assessment?

A. To increase advertising conversion automatically

B. To evaluate privacy risks, necessity and safeguards before or during a project

C. To replace all cybersecurity controls

D. To guarantee that a model is accurate

Correct Answer: B. To evaluate privacy risks, necessity and safeguards before or during a project

Question 7

Which statement about removing a sensitive attribute from a model is correct?

A. It always eliminates discrimination

B. It may not eliminate bias because other variables can act as proxies

C. It makes the model legally compliant everywhere

D. It prevents historical bias in the training data

Correct Answer: B. It may not eliminate bias because other variables can act as proxies

Question 8

Which condition makes human oversight meaningful rather than a rubber stamp?

A. The reviewer can only approve the system’s output

B. The reviewer has training, relevant information and authority to override the result

C. The reviewer never sees the model’s limitations

D. The reviewer is accountable but has no time to investigate

Correct Answer: B. The reviewer has training, relevant information and authority to override the result

Question 9

Which activity belongs to model life-cycle governance?

A. Ignoring the model after deployment

B. Recording versions, validating performance and monitoring drift

C. Allowing unapproved changes to production models

D. Deleting all documentation after launch

Correct Answer: B. Recording versions, validating performance and monitoring drift

Question 10

Why should organisations not assume that a general-purpose AI service is safe for confidential data?

A. AI services cannot process text

B. Prompts or outputs may be retained, exposed or handled according to unexpected service arrangements

C. Confidential data is never useful for business

D. Encryption is impossible in cloud systems

Correct Answer: B. Prompts or outputs may be retained, exposed or handled according to unexpected service arrangements