Data Governance

01 What it is

Governance decides; management executes

The cleanest way to hold the idea: governance is "who decides" — the policies, accountability, standards and decision rights — while data management is "who executes", the operational work of storing, moving and maintaining data to those policies. You cannot automate trust into existence; governance is how an organisation agrees what "trusted" even means.

It matters because it turns raw data into an asset you can build on: reliable analytics, defensible compliance, and — increasingly — AI that can be trusted in production. Ungoverned data is the single biggest reason AI projects stall: models hallucinate on data that lacks context, and no one can audit what the model actually used.

02 Core pillars

Nine pillars of a governed estate

Every governance programme is assembled from the same building blocks. Learn them as a system — each one feeds the next.

• Metadata management — the descriptive, technical and operational context about data that makes it findable and understandable.
• Data catalogue — a searchable inventory of data assets and their meaning; the front door for discovery.
• Data lineage — traces data's origin, movement and transformations so you can assess impact before you change anything.
• Data quality — accuracy, completeness, consistency, timeliness and validity, measured against rules and thresholds.
• Master data management (MDM) — a single golden record for core entities such as customer and product.
• Policy & standards — the rules for classification, retention and usage that everything else enforces.
• Stewardship — ongoing human ownership of a data domain; the person who curates and defends it.
• Privacy & compliance — lawful, consented, regulated handling of personal and sensitive data.
• Access control — who can see and use what, via role- or attribute-based rules and masking.

03 DAMA & DMBOK

The framework the whole field shares

DAMA International is the vendor-neutral, not-for-profit professional body for data management. Its DMBOK2 — the Data Management Body of Knowledge, 2nd edition — is the authoritative reference that gives the discipline a common vocabulary, and it underpins the CDMP (Certified Data Management Professional) certification. Its defining picture is the DAMA Wheel: eleven knowledge areas with Data Governance at the hub, coordinating all the others.

DMBOK also frames each area with the same environmental elements — goals & principles, activities, deliverables, roles, practices, technology and metrics — so a governance programme can be planned and audited consistently. In short: DMBOK defines the "what", and governance is the "who decides" that keeps the other ten areas aligned.

04 Building blocks

The building blocks, from domains to data mesh

Governance is assembled from a precise vocabulary. Here are the concepts every programme leans on — each with a concrete example.

How authoritative data flows to consumers

The ADS and the access layer work together: the store is where truth lives; the access layer is how truth is served — governed, once, to everyone.

05 Key personas

Who runs governance

Governance is a team sport with clearly separated accountabilities. Know who does what — ambiguity here is the number-one cause of programmes that stall.

06 Methodology

Stand up a programme, step by step

The reference frameworks split cleanly: DAMA-DMBOK2 gives you the vocabulary and eleven knowledge areas; the EDM Council's DCAM (and cloud/AI-focused CDMC) give you a maturity assessment to measure against. DMBOK defines; DCAM measures.

07 Best practices

What good looks like

08 2026 trends

Where governance is heading

↻ Refreshed 2026-07-16 by the AI desk

09 In practice

From discipline to business value

Governance earns its budget when it changes outcomes. Here is how enterprises apply it, what the analysts and hyperscalers are doing, and how SCIKIQ turns it into a running capability.

What the leaders are doing

The market has moved governance from a compliance chore to the foundation of trusted AI — here's the signal from the standards body, the analysts and the platforms setting the agenda.

10 Developer lab

Hands-on: build governance into the pipeline

# dbt: a governed, tested model contract
models:
  - name: dim_customer
    config: {contract: {enforced: true}}
    columns:
      - name: email
        meta: {pii: true, masking: "hash"}
        tests: [not_null, unique]

# Policy-as-code: mask PII columns unless the caller is privacy-cleared
package data.access

default allow_column := false

allow_column {                              # non-PII columns are open
  not input.column.tags[_] == "pii"
}
allow_column {                              # PII is allowed only for cleared users
  input.column.tags[_] == "pii"
  input.user.groups[_] == "privacy_cleared"
}

mask := "sha256" { not allow_column }     # everyone else sees a hash

models:
  - name: dim_customer
    config:
      contract: { enforced: true }        # break the build on schema drift
    columns:
      - name: customer_id
        data_type: bigint
        constraints: [{ type: primary_key }]
        tests: [unique, not_null]
      - name: email
        data_type: varchar
        meta: { pii: true, mask: sha256 }
        tests:
          - dbt_expectations.expect_column_values_to_match_regex:
              regex: "^[^@]+@[^@]+\.[a-z]{2,}$"

# Auto-classify likely PII before data reaches the lake
import re

RULES = {
    "email": re.compile(r"^[^@]+@[^@]+\.[a-z]{2,}$", re.I),
    "phone": re.compile(r"^\+?\d[\d\s-]{7,}$"),
    "ssn":   re.compile(r"^\d{3}-\d{2}-\d{4}$"),
}

def classify(sample):
    for label, rx in RULES.items():
        hits = sum(bool(rx.match(v or "")) for v in sample)
        if hits / max(len(sample), 1) > 0.8:   # 80% match -> tag it
            return label
    return None

These three files are the backbone of automated governance: OPA enforces access, the dbt contract blocks bad merges, and the scanner tags PII at ingest — no manual review in the hot path.

11 Analyst lab

Hands-on: define trust the business believes

12 Career path

From steward to Chief Data Officer

The ladder climbs from tool execution and stewardship, to policy design and stakeholder management, to strategy, budget and enterprise influence. Bands are indicative US figures and vary widely by region and sector.

13 Skill matrix

Rate yourself, then level up

Use this to self-assess and plan growth — find your current row and aim one column right.

14 Glossary

Terms worth knowing

15 Test yourself

Check your understanding

16 Keep learning

Where to go next

Governance sets the rules; the next tracks put trusted data to work. Continue the path: