Data Governance and Ethics
Data governance and ethics covers the decision rights, controls, and justifications that surround data before any model is built. The exam tests whether you can name the accountable roles, distinguish privacy techniques by the guarantee each one actually gives, and reason from principle to a defensible decision rather than reciting slogans.
Governance roles and instruments
- A data owner is accountable for a domain's data; a data steward owns definitions and day-to-day quality; a custodian operates storage and access controls.
- Core artefacts: a business glossary, a data catalogue with lineage, and data quality rules covering completeness, accuracy, timeliness, uniqueness, validity, and consistency.
- Access models are role-based or attribute-based; the lifecycle runs plan, collect, store, share, archive, destroy, and retention must be technically enforceable, not just written down.
Ethics, law, and privacy engineering
Purpose limitation, minimisation, storage limitation, transparency, and accountability are the working principles. Consent is one lawful basis among several (contract, legal obligation, vital interest, public task, legitimate interest), not a universal key. Data subject rights typically include access, rectification, erasure, portability, and objection.
Pseudonymisation replaces identifiers but keeps a re-identification route; anonymisation claims the route is gone. Test the claim against a stated attacker model using k-anonymity (every quasi-identifier combination shared by at least k records), l-diversity, or differential privacy with a published epsilon. Fairness metrics such as demographic parity, equalised odds, and calibration conflict with one another, so name the trade-off you chose.
Worked example
A table carries quasi-identifiers postcode, age, and sex. One combination appears for 3 people, another for 40. With k = 5 the 3-person class fails: generalise age into bands or suppress rows until every equivalence class reaches five records. Note explicitly that k-anonymity does not stop attribute disclosure, which is why l-diversity is layered on.
Traps
Equating pseudonymisation with anonymisation; assuming consent is always required; quoting a regulation's name without the obligation it imposes; and reporting a single fairness number as if it settled the question.