What is data governance?
Data governance answers four questions about every dataset that matters: who is accountable for it, what good quality means, where it comes from and who is allowed to use it for what. When those answers are written down and maintained, figures become defensible in front of a board, a regulator or a customer. When they are not, every report carries a hidden doubt.
Governance is often confused with documentation projects that produce policies nobody reads. Effective governance is operational. Owners review quality indicators on a schedule, changes to definitions follow a known path, and access rules are enforced by the platform rather than by memory. The aim is fewer arguments about numbers and faster, safer use of data.
The scope ranges from a single critical domain, such as customer or financial data, to a framework covering every business unit. We almost always start narrow, on the data that carries the most risk or value, and extend once the routines work. Our data consulting practice connects governance to the strategy and analytics it is meant to support.
Signs you need data governance
Governance gaps tend to show up as daily friction long before they show up as an incident or an audit finding. These are the signals we see most often in organizations that ask us for help with their data.
An auditor asks where a figure comes from
Tracing a reported number back to its source takes days of manual work, and the answer depends on who you ask.
Personal data sits in systems nobody fully lists
GDPR access or deletion requests are slow because no one knows every place a customer’s data is stored or copied.
Fixes to bad data never stick
Errors are corrected in reports downstream, but the source keeps producing them because nobody owns the upstream system.
Access is granted by habit, not by rule
Former employees, contractors or whole departments keep access to sensitive data because rights are never reviewed.
A merger, migration or new platform is coming
Combining or moving data without agreed definitions and owners multiplies inconsistencies that are expensive to untangle later.
Any one of these is a reason to act on the affected domain. Several at once suggest the organization needs a light framework that applies the same rules everywhere, with a small group that keeps those rules consistent across business units.
What our governance engagement covers
We build governance in layers, starting with what protects the business most. The deliverables below make up a typical engagement, scaled to the number of domains in scope and to the regulatory obligations attached to your data.
Critical data inventory
The datasets that drive revenue, reporting and compliance, with their systems, consumers and the risks attached to each.
Ownership and stewardship model
Data owners in the business, stewards who maintain quality day to day, and a clear escalation path when they disagree.
Business glossary and definitions
One agreed definition for each key term and metric, with the person who can change it and the process to do so.
Quality rules and monitoring
Measurable rules for completeness, validity, timeliness and consistency, checked automatically and reported to the owner.
Lineage and access controls
Documented flows from source to report, and access rights based on role and purpose, aligned with GDPR and your sector rules.
Everything is designed to be run by your people. Policies are short, roles fit existing job descriptions where possible, and the controls live in the tools your teams already use, so governance does not depend on a separate team that disappears at the next reorganization.
Which data needs an owner first?
A governance assessment typically takes 2 to 4 weeks and ends with a critical data inventory, an ownership proposal and a prioritized plan.
How we implement governance: four phases
Governance rolled out everywhere at once rarely survives. We prove the model on one domain, adjust it, then extend it. Each phase ends with a review by the sponsor and the first data owners, who decide whether to continue.
PHASE 01
Map
Critical data, systems, flows, regulatory exposure and current owners.
PHASE 02
Define
Roles, glossary, quality rules and access policies for one domain.
PHASE 03
Embed
Monitoring, lineage and controls built into existing tools and routines.
PHASE 04
Extend
Framework rolled out domain by domain, with regular council reviews.
The first domain is chosen for impact, not convenience: usually the data behind financial reporting, customer records or a regulated process. Working on real data with real owners exposes practical issues early, from conflicting definitions to systems that cannot enforce a rule. Senior consultants facilitate the decisions, but the owners make them, which is what makes the result last.
Central, federated or hybrid governance?
The right operating model depends on how your organization is structured and how much autonomy business units have. We compare the options with you and choose deliberately, rather than copying a template from another company.
| Model | How it works | Fits when | Watch out for |
|---|---|---|---|
| Centralized | One team sets rules and manages quality for all data | Small organization, one main system, strong central IT | Becomes a bottleneck as demand grows |
| Federated | Each domain owns its data under shared minimum standards | Autonomous business units with their own systems | Standards drift without a strong coordinating role |
| Hybrid | Central standards and tooling, domain owners and stewards | Most mid-size and large organizations | Needs clear rules on who decides what |
| Minimal | Owners and quality rules for critical data only | Early stage, limited budget, one urgent risk | Must be extended before scope grows |
Many organizations end up with a hybrid model, but the starting point matters. A minimal model on two or three critical domains can go live quickly and grow into a hybrid one later. What matters most is that every critical dataset has an owner with the authority and the time to act on quality issues.
Risks that stall data governance
Governance programs lose momentum for reasons that are well known. We plan for each of them from the first week and review them with the sponsor at every phase, because a stalled program is far harder to restart than to protect.
Governance seen as bureaucracy
If owners experience it as extra forms, they disengage. We tie every routine to a problem they already feel, like a disputed figure or a failed audit.
Owners without time or authority
A name in a spreadsheet is not ownership. We agree time allocation and decision rights with each owner’s manager before the role starts.
Policies the platform cannot enforce
Rules that depend on people remembering them erode. We check that each control can be automated or monitored in your current tools.
Scope too wide too early
Starting with every domain spreads effort thin and delays results. We begin with the data that carries the most risk or value.
Compliance treated as a one-off project
GDPR and sector obligations change, and so do systems. Reviews, access recertification and lineage updates are scheduled, not left to the next audit.
The clearest signal that governance works is when disputes about numbers become rare and audit questions are answered in hours rather than weeks. Once data is trusted, it is far easier to build dependable advanced analytics on top of it, and to plan the next investments with a data strategy grounded in reality.
Data governance pricing
Every engagement starts with a diagnosis and ends with a fixed quote. Durations are typical, not promised, and depend on the number of domains in scope and the regulatory obligations that apply to your data.
| Format | Duration | Price |
|---|---|---|
| Governance assessment | 2 to 4 weeks | Fixed quote after diagnosis |
| Governance program | 4 to 6 months | Fixed quote after the assessment |
| Governance council support | Monthly | Monthly fee quoted at handover |
What changes the price: number of data domains, number of source systems, regulatory scope such as GDPR or sector rules, and how much tooling must be configured.
The quote covers senior consultants only, a defined scope and the deliverables of each phase. Catalog, lineage or quality monitoring tools, if you choose to buy them, are licensed separately. We help you decide whether your existing platform is enough before recommending any purchase.
Data governance FAQ
Do we need a data catalog tool to start?
No. Ownership, definitions and quality rules can start in tools you already have. A dedicated catalog becomes useful once several domains are governed, and we help you choose one only when the need is clear.
Does data governance make us GDPR compliant?
It provides much of what compliance requires: a record of where personal data lives, who can access it and how long it is kept. Legal interpretation stays with your counsel or data protection officer; we build the operational side.
Who should own the data: IT or the business?
The business, in almost every case. IT runs the systems, but the people who use the data to decide are best placed to define it and judge its quality. IT often provides the stewards and the tooling.
How do we keep governance from slowing teams down?
By governing critical data first and automating controls. Most datasets need light rules or none. Clear owners actually speed work up, because questions about meaning or access have a known person to answer them.
How long before we see results?
Early results come from the first governed domain: fewer disputed figures and faster answers to audit or customer questions. A wider rollout typically takes 4 to 6 months, depending on the number of domains.
Can you work with our data protection officer?
Yes. We work alongside your DPO, legal and security teams. They set the obligations; we translate them into roles, rules and controls the data teams can operate, and document the evidence auditors ask for.