Data governance
Every privacy duty assumes someone answers for the data. Governance decides who.
Privacy laws rarely use the word governance. They simply expect you to know why you hold each piece of personal data, keep it correct, protect it, and delete it on time. None of that happens without named people, agreed rules and a way to check them. This page starts from those legal questions and works back to the governance you need.
Back to GDPR services01 · The legal questions
Six questions a regulator can ask about any dataset
Each one needs a governance answer, not just a policy.
| Question | Where the law asks it | Governance capability that answers it |
|---|---|---|
| Who is accountable for this data? | GDPR accountability (Articles 5(2), 24); DPDP Act Section 8(1) | Named data owners per domain |
| Why do we hold it? | GDPR purpose limitation; DPDP notice and consent tied to purposes | A purpose register linked to the data catalogue |
| Is it correct? | GDPR accuracy principle; DPDP Act Section 8(3) | Data quality rules on fields used for decisions |
| Who can see or change it? | GDPR Article 32; DPDP reasonable security safeguards | Classification and access rules owned by the business |
| When must it go? | GDPR storage limitation; DPDP Act Section 8(7) | A retention schedule with erasure evidence |
| Where does it travel? | GDPR Article 30 records and Chapter V; DPDP Act Section 16 | Lineage and metadata showing systems, vendors and countries |
02 · Roles
The people who supply the answers
Titles vary by company. The split of responsibility should not.
- Data owner
- A senior business person who decides who may use a dataset and for what. Accountable when it goes wrong.
- Data steward
- Keeps definitions, quality rules and retention settings current day to day.
- Data custodian
- Usually IT or engineering. Runs the storage, backups and access controls the owner approves.
- Governance council
- A small cross-functional group that settles disputes and approves standards.
- Privacy lead or DPO
- Checks that the rules match the law and advises the owners. Does not own the data.
These are common practice titles, not terms the GDPR or the DPDP Act defines. The DPO is the exception: the GDPR sets out when one is required and what the role does.
03 · DAMA and DCAM
Two reference models, built for different jobs
One maps the territory. The other scores how far you have travelled.
DAMA-DMBOK
A map of the discipline
- Published by DAMA International as the Data Management Body of Knowledge
- Puts governance at the hub of a wheel of knowledge areas
- Use it to check that no area of data management is left without an owner
DCAM
A capability scorecard
- The Data Management Capability Assessment Model from the EDM Council
- Rates capabilities on a maturity scale through structured assessment
- Common in banking and financial services, where regulators ask for measurable progress
Neither one is a law or a certification scheme. Privacy law tells you what outcome is required; these models help you organise the work.
- Data architecture
- Data modelling and design
- Data storage and operations
- Data security
- Data integration and interoperability
- Documents and content
- Reference and master data
- Data warehousing and BI
- Metadata
- Data quality
04 · Build order
A sensible order for a privacy-driven programme
Start where the law bites hardest, not where tools are easiest.
- Inventory the personal data: systems, fields, purposes, vendors, countries.
- Assign an owner to each dataset and get them to accept it in writing.
- Classify the data so that sensitive and children's data stand out.
- Agree a retention period per purpose and switch on deletion.
- Write quality rules for the fields that drive decisions about people.
- Record lineage for anything that leaves the main systems or the country.
- Measure: overdue deletions, ownerless datasets, failed quality checks.
Step one is the same work as a GDPR Article 30 record or a DPDP processing inventory. Build it once with enough detail for both, and the later steps attach to it.
05 · Evidence
What a reviewer will ask to see
Governance only counts when it leaves a trail.
- An owner list. Every dataset with personal data has a named, current owner.
- Minutes or decisions. The council or owners have actually approved standards and exceptions.
- Deletion logs. Proof that retention rules ran, not just that they were written.
- Quality results. Recent checks on key fields, with fixes for failures.
- Access reviews. Owners signed off who can reach their data, on a regular cycle.
Sources: Regulation (EU) 2016/679 (GDPR), Articles 5, 24, 30, 32, 37 to 39 and Chapter V; The Digital Personal Data Protection Act, 2023, Sections 8 and 16; DAMA International, DAMA-DMBOK (2nd edition), public description; EDM Council, DCAM, public description.
Questions about governance and privacy
Is a data catalogue tool required?
No. The law asks for the answers, not a product.
A small company can hold its inventory, owners and retention rules in a well-kept spreadsheet. A catalogue tool helps once systems and people multiply, but it only records decisions people have made.
Who should own personal data: IT or the business?
The business owns it; IT looks after it.
The person who decides why the data is used should be its owner. Engineering acts as custodian. When IT owns everything, purpose and retention decisions tend to go unmade.
Should we start with DAMA-DMBOK or DCAM?
Neither first. Start with the inventory.
Use DAMA-DMBOK as a checklist of areas once the inventory exists. Bring in DCAM when leadership or a regulator wants a maturity score to track progress over time.
How does this relate to ISO 27001?
ISO 27001 governs security; data governance covers more.
An ISMS handles classification, access and protection well. Purpose, accuracy and retention for personal data sit outside its core, which is why privacy programmes add governance on top.
Start with a map of your data.
A GDPR gap assessment begins with data mapping and Article 30 records.