Data Governance and Ethics
The Data Governance and Ethics domain tests who controls data, how quality and security are maintained, and how privacy and fairness obligations shape analytics. Expect questions on roles, policies, metadata, lawful use and ethical risk.
Governance foundations
Data governance is the decision-rights and accountability framework for data: policies, standards, owners, stewards and escalation. Data management executes those decisions. A data owner is accountable for a domain; a data steward improves quality and defines meaning; a custodian or administrator operates storage and access. Metadata describes data, including definition, source and owner; lineage traces it from source to report; master data is the shared reference data for customers, products or locations. Access control follows least privilege and separation of duties; the CIA triad covers confidentiality, integrity and availability.
Privacy and ethics
Privacy rules commonly require lawful basis, consent where applicable, purpose limitation, data minimization, accuracy, storage limitation and accountability. Anonymization irreversibly removes identifiability; pseudonymization replaces identifiers but remains personal data because re-identification is possible with a key. Ethics goes beyond legality: bias, fairness, transparency, explainability, human oversight and avoiding deceptive use. Check proxies such as postcode that can encode protected characteristics. Document high-risk decisions in a data protection impact assessment.
Worked example
A retailer wants to reuse loyalty data to infer health status for insurance offers. Governance review finds the original purpose was rewards, no valid basis for the new use, and the inference targets sensitive health data. The fix is not a better model: obtain a lawful basis, minimize data, separate consent, and assess fairness. Reasoning: purpose limitation and ethics block the reuse before technical accuracy matters.
Traps
Do not equate anonymization with pseudonymization, or governance with IT security alone. Ownership is accountability, not exclusive access. Legality does not guarantee fairness. Ignoring retention limits or proxy bias creates compliance and reputational risk.