An independent study reference written by Dr Phuc V. Nguyen. It is not official subject material — for assessment requirements always follow your subject outline and vUWS.
Data governance
Data governance is the set of decisions about data that an organisation makes once, deliberately, instead of a thousand times by accident. Khatri and Brown organise it as five decision domains: principles, what the data is for; quality, what standard applies and who signs it off; metadata, how data is described so it can be found and understood; access, who may see what and how that is granted and revoked; and lifecycle, how long data is kept and what happens at the end. For each domain, governance names a decision right and an accountability. That is what separates it from a policy nobody reads.
Why it matters
Governance is plumbing, not policing. Somebody has to decide what "active customer" means, who is allowed to change that definition, where it is written down, who can read the table, and when the 2019 rows get deleted. If nobody owns those decisions they get made ad hoc by whoever is closest to the keyboard, and six teams end up quoting six different customer counts in the same meeting.
Two teams disagree about revenue for the same quarter and both queries are technically correct. What does good governance actually change?
Formulas
Worked examples
An insurer discovers that three dashboards report different active-policy counts for the same month, and an executive meeting stalls arguing about which one is right.
This is a governance failure, not an engineering one. Each dashboard used a defensible definition. One counted policies in force at month end, one counted policies with a premium received, one excluded policies inside a grace period. The fix is a decision right: one named steward who owns the definition of an active policy, the definition recorded as metadata next to the field where an analyst will actually see it, and a rule that no dashboard may invent a new measure without registering it. The engineering work is trivial. The governance work is deciding, and being accountable for having decided.
A convenience chain installs in-store tablets that capture a customer's face while they complete a feedback survey, in order to profile respondents and detect duplicate responses.
The Australian Information Commissioner found in 2021 that 7-Eleven had collected sensitive biometric information without consent and that the collection was not reasonably necessary for the stated purpose. Every governance domain was in play. Principles: what is this data for? Access: who could reach the faceprints? Lifecycle: how long were they retained and what destroyed them? Accountability: who signed this off, and were they entitled to? Governance is the mechanism that surfaces those four questions while the answer is still a design change rather than a regulator's determination.
Common mistakes
- ✗Governance is a policy document. A document with no named decision rights changes nothing. Governance exists when a specific person is accountable for a specific decision and can be asked, months later, why they made it that way.
- ✗Governance is just data quality with more meetings. Quality is one domain of five. Governance also decides what data is for, how it is described, who may reach it and when it is destroyed, and those decisions constrain quality rather than the other way round.
- ✗More governance means more control, so lock everything down. Access that is too hard to obtain produces shadow copies in spreadsheets and personal drives, which is worse than a governed grant. Governance optimises appropriate access, not minimum access.
- ✗Once data is de-identified, governance no longer applies. De-identification is a control with a measurable strength, not a permanent state. Combinations of ordinary attributes are close to unique, and joining a release to another source re-identifies people without breaking anything, so de-identified releases still need access rules and retention limits.
Revision bullets
- •Khatri and Brown: principles, quality, metadata, access, lifecycle
- •Each domain needs a decision right and a named accountability
- •A steward owns a definition; lineage records where a number came from
- •Retention is a decision: keeping data forever carries cost and liability
- •k-anonymity: every record shares its quasi-identifiers with at least k-1 others
- •Six versions of one number is a governance symptom, not an engineering bug
Quick check
Two teams disagree about revenue for the same quarter and both queries are technically correct. What does good governance actually change?
An organisation publishes a de-identified dataset of hospital discharges containing postcode, age band and admission date. What is the main governance question still open?
Connected topics
More in Ethics and Governance
Sources
- Khatri, V., & Brown, C. V. "Designing Data Governance." Communications of the ACM, 53(1), 148-152, 2010.The five decision domains, and the separation of decision rights from accountabilities that the rest of the field builds on.
- DAMA-DMBOK, 2nd editionDAMA International. DAMA-DMBOK: Data Management Body of Knowledge. 2nd ed. Technics Publications, 2017.Practitioner reference covering stewardship roles, lineage, retention and the surrounding data management functions.
- Sweeney, L. "k-anonymity: A Model for Protecting Privacy." International Journal of Uncertainty, Fuzziness and Knowledge-Based Systems, 10(5), 557-570, 2002.Defines k-anonymity and quasi-identifiers. Sweeney's earlier work showed that a combination of postcode, sex and date of birth identified a large majority of a national population uniquely.
- OAIC determination, 7-Eleven (2021)Office of the Australian Information Commissioner. Commissioner initiated investigation into 7-Eleven Stores Pty Ltd (Privacy), [2021] AICmr 50.Found the collection of facial images and faceprints via in-store survey tablets breached the Australian Privacy Principles on sensitive information and notification.