Why data governance should be corporate policy

Over the last eighteen months, we have been inundated by reports of businesses who have suffered from devastating data breaches. A majority of these incidents involved customer data that was entrusted to them. These incidences impacted the affected organizations in many ways from executive leadership stepping down to impending class-action lawsuits, or decreased revenue from the loss of customer trust.

It’s this picture of dismal customer privacy and the business world’s lack of security controls for this data that leads me to recall a question I have heard many of my peers ask after hearing about the latest breach: Why didn’t they have a data governance program?

Data governance is a methodical process an organization implements to manage their data and ensure it meets specific standards and business rules before entering it into a data management system. Data governance encompasses people, processes, and technology; each connected together as an essential program for different types of industries, especially those that must meet regulatory compliance guidelines such as finance, healthcare, or insurance. For companies in these industries to achieve compliance, they must demonstrate that they have a formal data management processes in place (using the above components) to govern their data throughout its lifecycle.

Implementing data governance from a process perspective involves four steps: data stewardship, data classification, data quality, and data management. These steps include information on how a company defines what the data types it owns; what data is considered critical to operations; how this data should be audited; and if the data should be monitored, stored, moved, changed, accessed and secured. It’s important to recognize that data governance is an ongoing process that needs to be aligned with business operations and evolve with the organization as it matures.

Here are the four main components of a successful data governance program:

The process of identifying and assigning roles and responsibilities. This step is where the business needs to identify who is creating its data, who has overall responsibility for the data, who uses the data, who routes it, and who oversees its use. The titles you typically see assigned under this process are Data User, Data Owner, and Data Administrator.

This step is one of the most important for the organization. During data classification, the business will look at all of the data types it has identified and categorize them into groups.