Data Governance and Ethics
Data Governance and Ethics is the domain that tests how an organisation assigns accountability for data and how it constrains the use of data beyond bare legal compliance. Questions probe the difference between owning and stewarding data, the hierarchy from principle to policy to standard to procedure, and the reasoning used in ethics review when a lawful use still carries foreseeable harm.
Decision rights and the accountability chain
- The data owner is an accountable business role: approves access, accepts risk, and signs off definitions. The data steward executes - curating definitions, resolving quality issues, maintaining metadata.
- The Data Governance Council arbitrates cross-domain conflicts; domain councils handle local trade-offs. Escalation is defined in advance, not improvised.
- Policies state intent and are binding; standards make policy measurable; procedures describe execution. A guideline is advisory and cannot justify a control failure.
Ethics as a distinct layer
Ethics asks whether a use is fair, explicable and proportionate, not merely permitted. Core tests: purpose limitation, minimisation, transparency to the data subject, fairness across groups, and accountability for downstream use. Proportionality weighs benefit against foreseeable harm and the availability of a less intrusive alternative.
Worked example
A marketing team wants to score customers on predicted health risk to target wellness products. Legal confirms the data is lawfully held. Reasoning: a lawful basis is necessary but not sufficient. Apply purpose limitation - the original collection purpose was order fulfilment, so reuse requires a compatibility assessment. Apply fairness - health-adjacent scoring can create discriminatory exclusion. Apply transparency - customers cannot reasonably infer this use. The ethics review therefore recommends either explicit consent with an opt-out and human review, or rejection. The decision and its rationale are recorded in the governance log so future similar requests are handled consistently.
Traps that cost marks
- Naming the steward as the accountable party for access approval.
- Treating ethics sign-off as a legal team task rather than a documented, repeatable review.
- Assuming anonymisation removes all ethical obligation; re-identification risk and group harm remain.
- Quoting policy without naming the enforcing control or the escalation path.