Data Quality, Governance, and Security
Domain 4 - Data Quality, Governance, and Security
This domain tests whether you can define quality objectively, place accountability correctly, and apply controls proportionately to data classification.
Quality dimensions
Completeness (required values present), accuracy (matches reality), validity (conforms to domain, format, range), consistency (the same fact agrees across systems), uniqueness (no unintended duplicates), timeliness (fresh enough for its use) and integrity (relationships hold). Profile first, then encode rules with thresholds and owners; a dashboard of pass rates without an owner and a remediation path changes nothing. Most defects are born at capture, so fix as far upstream as possible.
Governance
Separate data owners (accountable for a domain) from data stewards (day-to-day definitions and quality). Maintain a business glossary and metadata covering both technical assets (schema, lineage) and business meaning. Lineage answers impact analysis: if a source column changes, which reports break? Retention and deletion obligations belong in governance too, not only in legal.
Security and privacy
Classify data (public, internal, confidential, restricted), then apply least privilege via RBAC; use ABAC or row-level security where access must vary by row or column. Protect data in transit (TLS) and at rest (encryption with managed keys); mask, tokenize or pseudonymize non-production copies; log access for audit; enforce purpose limitation and erasure rights such as GDPR.
Worked example
A customer table has 12% null postcodes. That is a completeness failure, but profile before writing a rule: are nulls concentrated in one acquisition channel? If so, the root cause is an optional form field upstream - fix capture and backfill from a reference source. Then set the rule (postcode not null for domestic addresses, threshold 98%), assign the CRM product owner, and monitor daily. Masking postcodes in the analytics sandbox is a separate security control, not a quality fix.
Traps
- Reporting a single "data quality score" that hides which dimension failed.
- Confusing masking (reversible display protection) with encryption (cryptographic protection) or hashing (irreversible).
- Assuming a governance tool equals governance; policy without owners and enforcement is decoration.
- Treating quality as a one-off cleanup instead of continuous monitoring.
- Over-restricting access until analysts bypass controls with local spreadsheets.