Data Governance
What the exam tests
Data governance items test whether you can assign accountability for data and keep it fit for purpose across its lifecycle. The exam separates governance (decision rights and rules) from management (execution), and it strongly favours questions about who owns what.
Roles
- Data owner: the accountable executive for a domain; approves classification, access and use.
- Data steward: operates on the owner's behalf - defines quality rules, resolves issues, maintains definitions.
- Data custodian: technical implementation - backups, access provisioning, storage. Accountability cannot be delegated to a custodian. A common failure is labelling a system administrator the "data owner" because they control the database.
Classification and handling
Typical tiers: public, internal, confidential, restricted. Classification drives handling rules - encryption, access approval, sharing, retention. Classify the data element or dataset, not the system that happens to hold it; one system can hold several tiers simultaneously.
Quality, metadata and lifecycle
Data quality dimensions: accuracy, completeness, consistency, timeliness, validity, uniqueness. Define a measurable rule and threshold per critical data element. Metadata comes in three flavours: business (definitions), technical (schema, lineage), operational (job logs, refresh times). Lineage answers "where did this number come from" during an audit or incident review. Lifecycle: create or acquire → classify → use → share → retain → dispose. Retention schedules must state a period and a trigger, and disposal must be evidenced.
Worked example
A CRM dataset holds customer contact details and purchase history. The owner classifies it confidential and sets retention at seven years after the last transaction for tax purposes, with contact details purged two years after account closure. The steward defines a quality rule (no record without a validated email); the custodian implements field-level encryption and a scheduled deletion job whose output is logged as evidence.
Traps
- Confusing data governance with data management.
- Assigning ownership to IT by default.
- Keeping data indefinitely "because storage is cheap" - retention limits are a privacy obligation, not a preference.
- Classifying a whole system at the highest tier, then over-restricting everything.
- Writing retention rules with no disposal trigger and no evidence of deletion.