Data Governance and Compliance
What to know
Data governance is the exercise of authority and control over data - decision rights, accountability, and policy. Candidates must understand the difference between governance (who decides, what rules apply) and management/execution (carrying out the work). Key concepts: data stewardship, ownership vs. custody, governance councils/committees, policy vs. standard vs. procedure, and the operating model (centralized, decentralized, federated).
Compliance requires familiarity with major regulatory regimes conceptually: GDPR (lawful basis, data subject rights, DPO, cross-border transfer), CCPA/CPRA (consumer rights, opt-out of sale), HIPAA (PHI, minimum necessary), SOX (financial controls), and PCI DSS (cardholder data). Know the privacy principles: purpose limitation, data minimization, storage limitation, accuracy, integrity/confidentiality, and accountability. Understand data classification (public, internal, confidential, restricted) and how it drives controls. Know the roles: controller vs. processor (GDPR), and the concept of lawful processing.
Traps
- Saying governance does the work - governance sets direction; stewardship executes.
- Confusing data owner (accountable) with data custodian (technical caretaker).
- Assuming consent is the only lawful basis under GDPR - contract, legal obligation, vital interests, public task, and legitimate interests also apply.
- Treating classification as a one-time exercise rather than a maintained control.
Worked rule of thumb
For any privacy scenario, run the minimization test: Do we need this data, for this purpose, for this long? If any answer is no, the control is to collect less, use narrowly, or delete sooner. This resolves most GDPR-style scenario questions.
Regulations evolve; know principles, not just article numbers.