Data Governance Principles and Frameworks

Introduction and Context

Data has become a strategic resource for organisations. It supports operational decisions, customer relationships, regulatory reporting, artificial intelligence, risk management and performance measurement. Yet data does not create value merely because it exists. Its value depends on whether it is accurate, accessible to authorised users, protected from misuse, understandable, available when required and retained for an appropriate period.

Data governance is the organisational system through which authority, accountability, principles, policies and decision rights for data are established and exercised. It connects business objectives with information practices. Governance determines who may make decisions about data, what standards must be followed, how conflicts are resolved and how compliance and performance are monitored.

A useful distinction is essential. Data governance establishes direction, accountability and decision rights. Data management performs the operational and technical activities needed to collect, store, integrate, protect, use and dispose of data. IT governance oversees the broader governance of information technology, including technology investments, architecture, cybersecurity, service delivery and IT risk. These domains overlap, but they are not interchangeable.

This chapter examines major governance principles and frameworks, including DAMA-DMBOK, COBIT, ISO-related standards and FAIR. It also considers how organisations combine frameworks rather than adopting one framework as a complete solution.

Learning Objectives

By the end of this chapter, you should be able to:

1. Define data governance and distinguish it from data management and IT governance.
2. Explain the major principles underlying effective data governance.
3. Describe the scope and application of DAMA-DMBOK, COBIT, ISO standards and FAIR.
4. Compare frameworks according to purpose, scope, authority and implementation use.
5. Design a practical governance operating model involving roles, policies, controls and metrics.
6. Analyse governance problems involving privacy, ethics, quality, access and accountability.

1. The Meaning and Scope of Data Governance

Data governance is a system of decision-making and accountability for data-related capabilities. It includes formal policies, standards, roles, committees, processes, controls and measurement mechanisms. Governance is concerned not only with technical quality but also with organisational legitimacy and responsible use.

The scope of governance commonly includes:

• data ownership and stewardship;
• definitions, business glossaries and metadata;
• data quality standards;
• access, security and privacy;
• retention and disposal;
• data architecture and integration;
• records and regulatory compliance;
• ethical use and responsible analytics;
• sharing with suppliers, partners and public authorities; and
• monitoring, audit and remediation.

Governance may be enterprise-wide, domain-specific or product-specific. For example, a bank may operate an enterprise policy for customer data, a specialised governance council for credit-risk data and additional controls for an individual machine-learning data product.

Governance, management and administration

Governance answers questions such as:

• What outcomes and principles should guide data use?
• Who is accountable for a critical data element?
• Which data uses are acceptable?
• What level of quality is required for regulatory reporting?
• Who can approve an exception?

Data management answers questions such as:

• How will data be profiled, cleansed and integrated?
• How will metadata be captured?
• How will a database be backed up?
• How will a data pipeline be monitored?

Administration is narrower still. It may involve configuring permissions, maintaining database indexes or executing a retention job. Good administration supports management; good management operates within governance; governance provides the authority and accountability structure.

IT governance has a wider technology focus. Frameworks such as COBIT address whether IT supports organisational objectives, creates value, controls risk and uses resources responsibly. Data governance may be implemented within IT, but its stakeholders include legal, compliance, risk, marketing, operations, finance, human resources and senior leadership.

2. Foundational Principles

Accountability and decision rights

Every important data domain should have an identifiable accountable owner. Ownership does not necessarily mean legal ownership of information; it means responsibility for decisions, risk acceptance, quality expectations and access rules. A data steward usually performs day-to-day coordination, definition management and issue resolution on behalf of the owner.

A practical responsibility model distinguishes accountable, responsible, consulted and informed participants. Ambiguous responsibility is a common cause of unresolved data-quality problems.

Transparency and traceability

People should be able to understand where important data came from, how it was transformed and for what purposes it may be used. Lineage is especially important for financial reports, regulatory submissions and analytical models. Transparency also supports explanation when automated decisions affect individuals.

Purpose limitation and proportionality

Data should be collected and used for specified, legitimate purposes. The amount and detail of data should be proportionate to the business or public objective. A desire to retain all possible data indefinitely is not a governance strategy; it increases security, privacy and cost exposure.

Quality and fitness for purpose

Data quality is multidimensional. Common dimensions include accuracy, completeness, consistency, timeliness, uniqueness, validity and integrity. Quality requirements should be tied to use. A minor formatting defect may be tolerable in exploratory analysis but unacceptable in a tax report or patient-identification process.

A simple quality-rate measure can be used when a rule produces a pass/fail result:

The measure assumes that the tested records and rule are clearly defined. It does not prove that the rule itself is adequate, nor does it capture all dimensions of quality. For example, a complete but inaccurate address may pass a completeness test.

Security, privacy and ethical use

Governance should apply least privilege, separation of duties, secure handling and appropriate monitoring. Privacy requires attention to lawful basis, notice, individual rights, minimisation, retention and safeguards. Ethics extends beyond legal compliance. A use can be lawful yet unfair, discriminatory, manipulative or inconsistent with reasonable expectations.

Accessibility and controlled sharing

Data should be available to authorised users when needed, in usable formats and with sufficient documentation. Accessibility must be balanced with confidentiality, integrity and privacy. Open access is not the same as uncontrolled access.

Lifecycle responsibility

Data governance covers the full lifecycle: planning, collection, creation, storage, use, sharing, archival and disposal. Disposal is a positive governance activity. It reduces unnecessary exposure and helps organisations comply with retention requirements.

3. DAMA-DMBOK as a Data Management Reference Model

The DAMA International Data Management Body of Knowledge (DAMA-DMBOK) is a reference framework for organising the data management discipline. It is not a step-by-step implementation method and does not by itself allocate legal accountability. Its value lies in providing a common vocabulary and a map of related capabilities.

DAMA-DMBOK commonly presents data management knowledge areas such as:

• data governance;
• data architecture;
• data modelling and design;
• data storage and operations;
• data security;
• data integration and interoperability;
• document and content management;
• reference and master data;
• data warehousing and business intelligence;
• metadata management; and
• data quality management.

Data governance is positioned as a coordinating function across these areas. For example, governance may establish a critical-data-element policy, while data architecture defines structures, data quality teams monitor errors, security teams control access and metadata teams document lineage.

DAMA-DMBOK is particularly useful when an organisation needs to:

1. assess the maturity of its data capabilities;
2. identify gaps in roles and processes;
3. create a data-management strategy;
4. structure professional responsibilities; or
5. explain data management to non-specialists.

Its limitation is that it is a broad body of knowledge rather than a detailed control catalogue. An organisation normally supplements it with laws, sector requirements, security standards and implementation methods.

4. COBIT and the Governance of Enterprise IT

COBIT, developed by ISACA, is a framework for the governance and management of enterprise information and technology. It emphasises the alignment of technology activities with stakeholder needs, value creation, risk optimisation and resource optimisation.

COBIT distinguishes governance from management. Governance involves evaluating stakeholder needs, setting direction through prioritisation and monitoring performance and compliance. Management involves planning, building, running and monitoring activities in accordance with that direction.

COBIT is useful for data governance when data risks are embedded in broader technology processes. Relevant applications include:

• assigning control objectives for access and change management;
• monitoring data-related risk;
• assessing the effectiveness of technology processes;
• connecting governance objectives to enterprise goals; and
• providing evidence for internal audit.

COBIT does not replace a data-management model. It may indicate that access controls, incident management or information quality must be governed, but a data governance programme still needs detailed definitions, ownership, stewardship and quality rules.

5. ISO Standards and Management-System Thinking

ISO standards provide internationally recognised principles, requirements or guidance. Their exact role depends on the standard. Some are requirements suitable for conformity assessment; others provide guidance or vocabulary. Organisations should therefore avoid treating every ISO publication as a certification standard.

Important families relevant to data governance include:

• ISO/IEC 27001, which specifies requirements for an information security management system;
• ISO/IEC 27002, which provides information-security control guidance;
• ISO/IEC 27701, which extends privacy information management practices in relation to an information security management system;
• ISO 8000, associated with data quality and master-data concepts; and
• ISO 15489, associated with records management principles.

ISO management-system thinking emphasises context, leadership, planning, documented processes, risk treatment, competence, performance evaluation and continual improvement. This is valuable because governance is not a one-time policy-writing exercise. It requires repeatable processes, evidence and corrective action.

A privacy or security management system should be proportionate to organisational risk. Controls should be selected through risk assessment rather than copied mechanically. Certification, where available and appropriate, can provide assurance, but it does not guarantee that every decision is ethical or that all data is high quality.

6. FAIR Principles for Responsible Data Reuse

FAIR stands for Findable, Accessible, Interoperable and Reusable. The principles were developed to improve the usefulness of data, especially in research and data-intensive environments.

• Findable: data and metadata should have persistent identifiers and be discoverable through searchable resources.
• Accessible: users should know how data can be retrieved, including authentication or authorisation conditions. Accessibility does not mean that all data must be open.
• Interoperable: data should use shared vocabularies, formats and qualified relationships so that systems and communities can exchange and interpret it.
• Reusable: data should have sufficient documentation, provenance, licensing and quality information for an intended reuse.

FAIR is a stewardship and reuse principle set, not a complete enterprise governance framework. FAIR data may still contain personal information and require restrictions. Conversely, data can be secure but difficult to find or reuse. Governance must therefore combine FAIR with privacy, security, legal and ethical controls.

7. Comparing and Combining Frameworks

Framework selection should begin with the problem rather than with brand preference. DAMA-DMBOK helps describe data-management capabilities; COBIT connects technology governance with enterprise objectives; ISO standards support systematic control and assurance; FAIR improves discoverability and reuse.

A realistic operating model may use DAMA-DMBOK to define capabilities, COBIT to connect them to IT risk and assurance, ISO controls to establish security and privacy processes, and FAIR principles to guide data products intended for reuse.

8. A Practical Governance Operating Model

A governance programme normally includes the following elements.

Authority structure

A senior executive sponsor provides legitimacy and resolves cross-functional conflicts. A data governance council sets enterprise policy and priorities. Domain owners make decisions for areas such as customer, supplier, finance or workforce data. Stewards coordinate definitions, quality issues and controls. Custodians operate technical platforms but do not automatically decide business meaning or acceptable use.

Policies and standards

Policies state mandatory organisational requirements. Standards make them operational. For example, a policy may require protection of personal data, while standards specify classification levels, encryption expectations, access reviews and retention procedures.

Metadata and business glossary

A glossary defines terms such as “active customer,” “net revenue” or “employee.” Definitions should include ownership, valid values, calculation logic, source systems and permitted uses. Without shared meaning, two departments may produce different figures while each believes its report is correct.

Issue management

Data issues should be logged, prioritised according to impact and assigned to an accountable owner. Root-cause analysis is preferable to repeatedly correcting downstream extracts. A useful issue record contains the affected data, detection method, business impact, cause, corrective action, owner, due date and evidence of closure.

Metrics and assurance

Useful measures may include the percentage of critical data elements with owners, unresolved high-risk issues, control-test results, access-review completion, lineage coverage, policy exceptions and data-retention compliance. Metrics should support decisions, not encourage superficial target chasing.

9. Applied Case: Northstar Retail Bank

The following is an illustrative case.

Background

Northstar Retail Bank uses customer, account, transaction and income data for operations, regulatory reporting and credit analytics. Different business units maintain separate customer identifiers and definitions of “active account.” A machine-learning team has also acquired external marketing data without a consistent record of consent or retention requirements.

Problem

The bank experiences duplicate customers, inconsistent regulatory figures and unexplained differences between marketing and risk reports. A data scientist cannot establish the provenance of several training variables. Compliance staff are concerned that personal data is being reused beyond the expectations communicated to customers.

Analysis

The problem is not simply a database defect. It involves unclear ownership, weak master-data management, inadequate metadata, incomplete lineage, inconsistent quality rules and insufficient privacy governance. IT operations are functioning, but governance decisions are fragmented.

Approach

Northstar establishes a data governance council chaired by a senior executive. The customer domain receives a named owner and stewards from retail banking, risk, compliance and technology. Using DAMA-DMBOK, the bank maps gaps in master data, metadata, quality and security. COBIT is used to connect access, change, incident and monitoring controls to enterprise risk. ISO/IEC 27001 and ISO/IEC 27701 practices inform security and privacy controls. FAIR principles guide the documentation of approved analytical datasets.

The bank defines “active customer” and “active account,” creates a golden customer identifier, records lineage for regulatory metrics and introduces a data-use approval process for secondary analytics. It classifies marketing data, documents consent and purpose restrictions, and establishes retention and deletion schedules. Quality rules are monitored monthly, but thresholds are differentiated: regulatory data has stricter requirements than exploratory marketing analysis.

Outcome

The bank reduces duplicate customer records, improves reconciliation of regulatory reports and can explain the source and transformation of key model variables. It also rejects several proposed data uses because the purpose and privacy basis are inadequate. This is an important outcome: effective governance does not merely make data easier to use; it sometimes prevents inappropriate use.

Learning points

1. Data governance is cross-functional and cannot be delegated entirely to IT.
2. Frameworks are complementary rather than interchangeable.
3. Definitions, ownership and lineage are as important as technical controls.
4. Privacy and ethics must be considered before data is repurposed.
5. Metrics should distinguish fitness for purpose from abstract perfection.

10. Challenges, Limitations and Contemporary Issues

Framework overload

Organisations may adopt several frameworks and create duplicated committees, controls and documentation. A framework map and integrated control register can reduce duplication. Each requirement should have a clear owner, evidence source and review frequency.

Centralisation versus domain autonomy

Central control can improve consistency, while domain autonomy can preserve business responsiveness. A federated model often works well: enterprise principles and minimum controls are centralised, while domain stewards apply them to local contexts.

Legacy systems and technical debt

Older systems may lack identifiers, lineage or modern access controls. Governance should prioritise critical data and high-risk processes rather than wait for complete system replacement.

Automated decision-making and AI

AI increases the importance of provenance, representativeness, documentation, access control and monitoring. Governance should address training-data rights, data drift, explainability, human oversight and post-deployment impact. FAIR documentation can improve reuse, but it cannot by itself establish fairness or lawful processing. A well-documented biased dataset remains a governance problem.

Metrics can be misleading

High completion rates for metadata or training do not demonstrate responsible governance. Measures should combine activity, outcome and risk indicators. For example, the number of access reviews completed is less informative than whether inappropriate access was detected and removed.

Legal change and jurisdiction

Privacy and records requirements differ across jurisdictions and sectors. Governance policies should identify applicable law, cross-border transfers, contractual obligations and retention duties. General frameworks require legal interpretation; they are not substitutes for professional legal advice.

Best-Practice Implementation Sequence

A practical implementation sequence is:

1. obtain executive sponsorship and define the business case;
2. identify critical data domains, processes and risks;
3. assign owners, stewards and decision rights;
4. establish principles, policies and minimum standards;
5. create a glossary, metadata inventory and lineage priorities;
6. define quality rules and issue-management procedures;
7. integrate privacy, security, records and ethical review;
8. select framework components appropriate to the risks;
9. implement controls in a limited high-value domain;
10. measure outcomes, audit evidence and improve continuously.

The sequence is iterative. Organisations should avoid attempting to govern every data element at once. A risk-based pilot involving a critical regulatory report, customer domain or high-impact analytical model often creates visible value and practical learning.

Chapter Summary

Data governance establishes authority, accountability, principles and decision rights for data. It differs from data management, which performs operational data activities, and from IT governance, which directs and controls enterprise technology more broadly. Effective governance addresses ownership, transparency, purpose limitation, quality, security, privacy, accessibility, lifecycle responsibility and ethical use.

DAMA-DMBOK provides a broad map of data-management knowledge areas. COBIT links technology governance and management to enterprise objectives, risk and assurance. ISO standards support systematic security, privacy, records and quality practices. FAIR promotes findability, accessibility, interoperability and reuse, but does not replace legal, privacy or security controls. Organisations gain the greatest value by combining selected elements of these frameworks within a clear operating model.

Successful governance is practical and evidence-based. It assigns decision rights, defines business terms, monitors quality, documents lineage, manages access and resolves issues. It also recognises that responsible governance may restrict or reject data uses. In an environment of advanced analytics and AI, trustworthy data requires not only technical capability but also accountability, proportionality, transparency and respect for affected people.

Key Terms

Data governance: The system of authority, accountability, principles, policies and controls for data-related decisions.

Data management: The operational and technical practices used to collect, store, integrate, protect and use data.

IT governance: Direction and oversight of information technology, including value, risk, resources and performance.

Data owner: The person or role accountable for decisions concerning a data domain.

Data steward: A person who coordinates definitions, quality, access and issue resolution for a data domain.

Data custodian: A role responsible for operating and protecting technical data environments.

Metadata: Data describing the meaning, structure, origin, use or management of other data.

Data lineage: A record of data origins, transformations, movements and destinations.

Master data: Consistent core entities such as customers, products or suppliers.

Data quality: The fitness of data for an intended purpose across dimensions such as accuracy and completeness.

Purpose limitation: Restricting collection and use to specified legitimate purposes.

Least privilege: Providing only the access necessary for an authorised task.

DAMA-DMBOK: A reference body of knowledge for organising data-management capabilities.

COBIT: A framework for governance and management of enterprise information and technology.

ISO/IEC 27001: A standard specifying requirements for an information-security management system.

ISO/IEC 27701: A standard supporting privacy information management in relation to information security.

FAIR: Principles requiring data to be Findable, Accessible, Interoperable and Reusable.

Data domain: A business-oriented area of data, such as customer, finance or workforce data.

Data product: A governed, documented and usable data asset designed for a defined consumer or purpose.

Review Questions

Short Answer Questions

1. What is the main purpose of data governance?
2. How does a data steward differ from a data owner?
3. Name the four FAIR principles.
4. Why is data lineage important for regulatory reporting?
5. State one limitation of using quality rate as a governance measure.

Long Answer Questions

1. Explain the differences among data governance, data management and IT governance.
2. Describe the major principles that should guide an enterprise data governance programme.
3. Compare DAMA-DMBOK, COBIT, ISO standards and FAIR in terms of purpose and scope.
4. Explain how privacy and ethical considerations should influence data lifecycle governance.
5. Design a governance operating model for a medium-sized organisation with customer and financial data.

Analytical / Application Questions

1. A company has accurate data but no shared definitions, ownership or lineage. Analyse the governance risks and recommend priorities.
2. An organisation wants to publish a dataset externally because it is FAIR. Identify the additional privacy, security, legal and ethical checks required before publication.
3. Using the Northstar Retail Bank case, propose three governance metrics and explain what managerial decisions each metric would support.

Multiple Choice Questions with Answers

Question 1

Which statement best distinguishes data governance from data management?

A. Governance establishes authority and decision rights, while management performs operational data activities.

B. Governance is limited to database administration, while management is limited to privacy law.

C. Governance concerns only IT investments, while management concerns only financial reporting.

D. Governance and management are identical terms used by different departments.

Correct Answer: A. Governance establishes authority and decision rights, while management performs operational data activities.

Question 2

Which DAMA-DMBOK knowledge area is most directly concerned with definitions, origins and descriptions of data assets?

A. Metadata management

B. Network engineering

C. Payroll administration

D. Physical facilities management

Correct Answer: A. Metadata management

Question 3

What is the primary focus of COBIT?

A. Improving only the discoverability of research datasets

B. Governing and managing enterprise information and technology

C. Replacing all privacy legislation with one global rule

D. Defining only database table structures

Correct Answer: B. Governing and managing enterprise information and technology

Question 4

Which statement about FAIR data is correct?

A. Accessible always means publicly available without restrictions.

B. FAIR requires data to be Findable, Accessible, Interoperable and Reusable.

C. FAIR automatically guarantees that data is unbiased and lawful.

D. FAIR applies only to encrypted data.

Correct Answer: B. FAIR requires data to be Findable, Accessible, Interoperable and Reusable.

Question 5

A data owner is primarily accountable for which activity?

A. Replacing every server in the organisation

B. Making decisions about data quality expectations, access and acceptable use

C. Writing all application code personally

D. Approving employee holidays

Correct Answer: B. Making decisions about data quality expectations, access and acceptable use

Question 6

Why is purpose limitation important in data governance?

A. It encourages indefinite collection for every possible future use.

B. It restricts data use to specified legitimate purposes and reduces misuse risk.

C. It eliminates the need for access controls.

D. It means data can never be reused under any circumstances.

Correct Answer: B. It restricts data use to specified legitimate purposes and reduces misuse risk.

Question 7

A dataset contains 800 records, of which 760 pass a defined validity rule. Using the chapter’s quality-rate measure, what is the quality rate?

A. 5%

B. 40%

C. 95%

D. 105%

Correct Answer: C. 95%

Question 8

Which framework or standard is most directly associated with an information-security management system?

A. ISO/IEC 27001

B. FAIR

C. DAMA-DMBOK

D. A business glossary

Correct Answer: A. ISO/IEC 27001

Question 9

Why might a bank combine DAMA-DMBOK, COBIT and ISO standards?

A. Because each addresses complementary capability, technology-governance and control needs.

B. Because using multiple frameworks eliminates the need for accountable owners.

C. Because the frameworks have exactly the same purpose and content.

D. Because standards remove the need for legal interpretation.

Correct Answer: A. Because each addresses complementary capability, technology-governance and control needs.

Question 10

Which outcome best demonstrates effective data governance?

A. Every dataset is made publicly accessible.

B. All data is retained permanently.

C. Critical data has clear ownership, documented meaning, appropriate controls and monitored quality.

D. The organisation creates the largest possible number of governance committees.

Correct Answer: C. Critical data has clear ownership, documented meaning, appropriate controls and monitored quality.