Data governance, without the framework talk

DAMA calls it the exercise of authority and control over the management of data assets, which is precise and lands badly in a meeting. What it means day to day is deciding who decides: who owns a definition, who approves access, who is accountable when a number turns out to be wrong. Policies, roles and rules are how those decisions get written down so they still hold six months after the meeting.

Governance decides, management builds. Governance sets the strategy, the policies and the decision rights: who owns the customer definition, who approves access, what quality level is good enough. Data management is the technical work that carries those decisions out across architecture, integration and security. You need both. One without the other is either a policy nobody implements or a platform nobody agrees on.

Data literacy is your teams being able to read a number, question it and act on it. It is the difference between a dashboard people cite and a dashboard people trust. And it is usually a vocabulary problem rather than a numeracy one: people are rarely bad at reading a chart, they are unsure whether "active customer" means the same thing on your slide as it does in their report.

Rather than govern the whole enterprise at once, you pick one use case that already hurts, such as the customer domain or the board report, and you govern it end to end: owner named, definitions agreed, quality measured, access controlled. You get something working in weeks instead of a framework document in months, and your sponsor gets a result they can see.

The data owner is a business leader who can actually change things: authority and budget over a domain such as Customer or Finance, and the consequence when a call goes wrong. The data steward is the person who does the work, maintaining definitions, chasing quality issues, applying business rules and answering what a field means. An owner without a steward is accountability with no capacity; a steward without an owner is work with no mandate.

In three places, and you can usually count all three. Cost: the hours your people spend cleaning data, reconciling reports and rebuilding numbers nobody trusts. Revenue: the analytics and AI models you can act on because what feeds them is dependable. Risk: the fines, breaches and audit findings you did not have. If you want a figure to open the conversation with, put your own rework hours into the cost of bad data calculator on this site.

No. Tools help; they do not decide anything. You can start with what you already own: a spreadsheet for the glossary, a RACI for the roles, a written rule for classification and access. Buy the platform once you know what you want it to do, because a catalog full of definitions nobody has agreed on is an expensive list of table names.

Almost every AI problem I get called into turns out to be a data problem: nobody can say where the training data came from, who approved its use, whether it holds personal records, or why the model answered the way it did. Governance is what answers those questions, through lineage, classification, access control and retention. That is why the organizations that governed their data first are the ones whose AI work survives contact with a regulator.

A diagnostic plus a first governed use case usually runs 8 to 12 weeks: a few weeks to see clearly where it hurts, the rest to fix one thing end to end. What you have at the end is not a finished program. It is a working example and a plan the organization believes, which is what you need before taking on the next domain.

The sponsor has to be someone in the business who feels the pain and can make other leaders turn up, typically a COO, CFO or Chief Data Officer. Where the team sits matters less than that it is not seen as an IT project, because the decisions governance makes (definitions, ownership, acceptable use) are business decisions. IT is an essential partner for the tooling and the controls, but when governance reports only into IT it tends to become a platform project that the business politely ignores.

Put it in their job description, or at least in their objectives, because goodwill runs out by the second quarter. Then make the time visible and small: a steward role is a named share of someone's week, not an extra evening. And start where the pain already is, so the first thing people experience is a problem they had going away rather than a new form to fill in. Recognition helps too: name the people whose work fixed the board report.

Usually not. A catalog is where agreed definitions, owners and lineage live, so if nothing has been agreed yet you are buying an empty library. Start with one use case, agree the definitions and owners in a spreadsheet, and let the pain of keeping that spreadsheet up to date tell you what you need the catalog to do. Then the tool selection becomes a short conversation instead of a six-month evaluation of features nobody will use.

Most organizations end up federated: a small central team sets the standards, the policies and the shared vocabulary, and the domains own and steward their own data within those rules. Fully centralized works in smaller or highly regulated organizations, but it becomes a bottleneck as you grow. Data mesh is federation taken further, with domains publishing data as products, and it only works when the domains already have the skills and the appetite. Choose for the organization you have today, not the one in the conference talk.

Answering what a field means, chasing a quality issue back to the system that caused it, reviewing a change to a definition, approving or routing an access request, and keeping the glossary entries for their domain honest. For most stewards that is somewhere between half a day and a day a week, alongside their main job. If it is taking much more, the scope is too wide; if it is taking nothing, the role probably exists only on the org chart.

Pick the one that already hurts, that someone senior cares about, and that you can fix in about three months. The board report with two revenue numbers, the customer data behind a failed campaign, the regulatory submission that takes three weeks of reconciliation: those are good candidates. Avoid the most important domain if it is also the most politically difficult one, because your first job is to prove that governance works, not to win the hardest argument in the building.

Regulation tells you what you must achieve; governance is how you can show you achieved it. GDPR expects you to know what personal data you hold, why, where it goes, who can see it and when it is deleted. Each of those is a governance question: classification, lineage, access control, retention. Organizations without governance answer them once per audit, by hand and under pressure. Organizations with governance answer them from records that already exist.

Track things that change behavior, not activity. Good signals: the share of critical data elements with a named owner and an agreed definition, the trend in data quality scores for the data that feeds key reports, the time it takes to resolve a data issue or approve an access request, and how often the same number is disputed in a meeting. Counting policies written or catalog entries created tells you people were busy, not that anything improved.

If you work in or around data management, yes: it gives you a shared vocabulary with the profession, a structured map of the eleven DAMA knowledge areas, and a credential that recruiters and clients recognize. It will not teach you how to run a program in your company, which is the gap experience fills. To prepare, read the DMBOK chapters on governance, data quality and metadata closely, do plenty of practice questions, and focus on understanding why the answers are right rather than memorizing them.

Rarely because of the framework or the tool. They fail because there is no business sponsor, because they try to govern everything at once, because roles are assigned without time to do them, or because they produce documents instead of decisions. The way to avoid it is unglamorous: one painful use case, owners who have real authority, small routines that people actually attend, and a result your sponsor can show within a quarter. Then do it again on the next domain.