Data governance is a term used on both a
macro and a micro level. The former is a political concept and forms part of international relations and Internet
governance
Governance is the process of interactions through the laws, norms, power or language of an organized society over a social system ( family, tribe, formal or informal organization, a territory or across territories). It is done by the ...
; the latter is a
data management
Data management comprises all disciplines related to handling data as a valuable resource.
Concept
The concept of data management arose in the 1980s as technology moved from sequential processing (first punched cards, then magnetic tape) to ...
concept and forms part of corporate
data
In the pursuit of knowledge, data (; ) is a collection of discrete values that convey information, describing quantity, quality, fact, statistics, other basic units of meaning, or simply sequences of symbols that may be further interpret ...
governance.
Macro level
On the macro level, data governance refers to the governing of cross-border data flows by countries, and hence is more precisely called ''international data governance''. This new field consists of "norms, principles and rules governing various types of data."
Micro level
Here the focus is on an individual company. Here data governance is a
data management
Data management comprises all disciplines related to handling data as a valuable resource.
Concept
The concept of data management arose in the 1980s as technology moved from sequential processing (first punched cards, then magnetic tape) to ...
concept concerning the capability that enables an organization to ensure that high
data quality
Data quality refers to the state of qualitative or quantitative pieces of information. There are many definitions of data quality, but data is generally considered high quality if it is "fit for tsintended uses in operations, decision making and p ...
exists throughout the complete lifecycle of the data, and data controls are implemented that support business objectives. The key focus areas of data governance include availability, usability, consistency,
data integrity
Data integrity is the maintenance of, and the assurance of, data accuracy and consistency over its entire life-cycle and is a critical aspect to the design, implementation, and usage of any system that stores, processes, or retrieves data. The ter ...
and
data security
Data security means protecting digital data, such as those in a database, from destructive forces and from the unwanted actions of unauthorized users, such as a cyberattack or a data breach.
Technologies
Disk encryption
Disk encryption re ...
, standard compliance and includes establishing processes to ensure effective data management throughout the enterprise such as accountability for the adverse effects of poor data quality and ensuring that the data which an enterprise has can be used by the entire organization.
A
data steward is a role that ensures that data governance processes are followed and that guidelines enforced, as well as recommending improvements to data governance processes.
Data governance encompasses the people, processes, and
information technology
Information technology (IT) is the use of computers to create, process, store, retrieve, and exchange all kinds of data . and information. IT forms part of information and communications technology (ICT). An information technology system ...
required to create a consistent and proper handling of an organization's data across the
business enterprise
Business is the practice of making one's living or making money by producing or buying and selling products (such as goods and services). It is also "any activity or enterprise entered into for profit."
Having a business name does not sepa ...
. It provides all data management practices with the necessary foundation, strategy, and structure needed to ensure that data is managed as an asset and transformed into meaningful information. Goals may be defined at all levels of the enterprise and doing so may aid in acceptance of processes by those who will use them. Some goals include
* Increasing consistency and confidence in
decision making
In psychology, decision-making (also spelled decision making and decisionmaking) is regarded as the cognitive process resulting in the selection of a belief or a course of action among several possible alternative options. It could be either ra ...
* Decreasing the risk of regulatory fines
* Improving
data security
Data security means protecting digital data, such as those in a database, from destructive forces and from the unwanted actions of unauthorized users, such as a cyberattack or a data breach.
Technologies
Disk encryption
Disk encryption re ...
, also defining and verifying the requirements for data distribution policies
* Maximizing the income generation potential of data
* Designating accountability for information quality
* Enable better planning by supervisory staff
* Minimizing or eliminating re-work
* Optimize staff effectiveness
* Establish process performance baselines to enable improvement efforts
* Acknowledge and hold all gain
These goals are realized by the implementation of data governance programs, or initiatives using
change management
Change management (sometimes abbreviated as CM) is a collective term for all approaches to prepare, support, and help individuals, teams, and organizations in making organizational change. It includes methods that redirect or redefine the use o ...
techniques.
When companies desire, or are required, to gain control of their data, they empower their people, set up processes and get help from technology to do it.
[Sarsfield, Steve (2009). "The Data Governance Imperative", IT Governance.]
Data governance drivers
While data governance initiatives can be driven by a desire to improve data quality, they are more often driven by
C-level leaders responding to external regulations. In a recent report conducted by CIO WaterCooler community, 54% stated the key driver was efficiencies in processes; 39% - regulatory requirements; and only 7% customer service. Examples of these regulations include
Sarbanes–Oxley Act
The Sarbanes–Oxley Act of 2002 is a United States federal law that mandates certain practices in financial record keeping and reporting for corporations.
The act, (), also known as the "Public Company Accounting Reform and Investor Protecti ...
,
Basel I,
Basel II
Basel II is the second of the Basel Accords, which are recommendations on banking laws and regulations issued by the Basel Committee on Banking Supervision. It is now extended and partially superseded by Basel III.
The Basel II Accord was pub ...
,
HIPAA
The Health Insurance Portability and Accountability Act of 1996 (HIPAA or the Kennedy– Kassebaum Act) is a United States Act of Congress enacted by the 104th United States Congress and signed into law by President Bill Clinton on August 21, ...
,
GDPR
The General Data Protection Regulation (GDPR) is a European Union regulation on data protection and privacy in the EU and the European Economic Area (EEA). The GDPR is an important component of EU privacy law and of human rights law, in partic ...
,
cGMP CGMP is an initialism. It can refer to:
*cyclic guanosine monophosphate (cGMP)
*current good manufacturing practice (cGMP)
*CGMP, Cisco Group Management Protocol, the Cisco version of Internet Group Management Protocol
The Internet Group Managem ...
, and a number of
data privacy
Information privacy is the relationship between the collection and dissemination of data, technology, the public expectation of privacy, contextual information norms, and the legal and political issues surrounding them. It is also known as data ...
regulations. To achieve compliance with these regulations, business processes and controls require formal management processes to govern the data subject to these regulations. Successful programs identify drivers meaningful to both supervisory and executive leadership.
Common themes among the external regulations center on the need to manage risk. The risks can be financial misstatement, inadvertent release of sensitive data, or poor data quality for key decisions. Methods to manage these risks vary from industry to industry. Examples of commonly referenced best practices and guidelines include
COBIT
COBIT (Control Objectives for Information and Related Technologies) is a framework created by ISACA for information technology (IT) management and IT governance.
The framework is business focused and defines a set of generic processes for the m ...
,
ISO/IEC 38500
ISO/IEC 38500 is an international standard for Corporate governance of information technology published jointly by the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC). It provides a fr ...
, and others. The proliferation of regulations and standards creates challenges for data governance professionals, particularly when multiple regulations overlap the data being managed. Organizations often launch data governance initiatives to address these challenges.
Data governance initiatives (Dimensions)
Data governance initiatives improve quality of data by assigning a team responsible for data's accuracy, completeness, consistency, timeliness, validity, and uniqueness. This team usually consists of executive leadership,
project management
Project management is the process of leading the work of a team to achieve all project goals within the given constraints. This information is usually described in project documentation, created at the beginning of the development process. T ...
,
line-of-business managers, and
data stewards. The team usually employs some form of methodology for tracking and improving enterprise data, such as
Six Sigma, and tools for
data mapping
In computing and data management, data mapping is the process of creating data element mappings between two distinct data models. Data mapping is used as a first step for a wide variety of data integration tasks, including:
* Data transformat ...
,
profiling, cleansing, and monitoring data.
Data governance initiatives may be aimed at achieving a number of objectives including offering better visibility to internal and external customers (such as
supply chain
In commerce, a supply chain is a network of facilities that procure raw materials, transform them into intermediate goods and then final products to customers through a distribution system. It refers to the network of organizations, people, activ ...
management), compliance with
regulatory law
Regulatory law refers to secondary legislation, including regulations, promulgated by an executive branch agency under a delegation from a legislature. It contrasts with statutory law promulgated by the legislative branch, and common law or case la ...
, improving operations after rapid company growth or
corporate mergers, or to aid the efficiency of enterprise
knowledge worker
Knowledge workers are workers whose main capital is knowledge. Examples include programmers, physicians, pharmacists, architects, engineers, scientists, design thinkers, public accountants, lawyers, editors, and academics, whose job is to ...
s by reducing confusion and error and increasing their scope of knowledge. Many data governance initiatives are also inspired by past attempts to fix information quality at the departmental level, leading to incongruent and redundant data quality processes. Most large companies have many applications and databases that can't easily share information. Therefore, knowledge workers within large organizations often don't have access to the data they need to best do their jobs. When they do have access to the data, the
data quality
Data quality refers to the state of qualitative or quantitative pieces of information. There are many definitions of data quality, but data is generally considered high quality if it is "fit for tsintended uses in operations, decision making and p ...
may be poor. By setting up a data governance practice or
corporate data authority (individual or area responsible for determining how to proceed, in the best interest of the business, when a data issue arises), these problems can be mitigated.
Implementation
Implementation of a data governance initiative may vary in scope as well as origin. Sometimes, an executive mandate will arise to initiate an enterprise wide effort, sometimes the mandate will be to create a pilot project or projects, limited in scope and objectives, aimed at either resolving existing issues or demonstrating value. Sometimes an initiative will originate lower down in the organization’s hierarchy, and will be deployed in a limited scope to demonstrate value to potential sponsors higher up in the organization. The initial scope of an implementation can vary greatly as well, from review of a one-off IT system, to a cross-organization initiative.
Data governance tools
Leaders of successful data governance programs declared in December 2006 at the Data Governance Conference in Orlando, FL, that data governance is between 80 and 95 percent communication."
That stated, it is a given that many of the objectives of a data governance program must be accomplished with appropriate tools. Many vendors are now positioning their products as data governance tools; due to the different focus areas of various data governance initiatives, any given tool may or may not be appropriate, in addition, many tools that are not marketed as governance tools address governance needs and demands
See also
*
Data sovereignty
*
Information architecture
Information architecture (IA) is the structural design of shared information environments; the art and science of organizing and labelling websites, intranets, online communities and software to support usability and findability; and an emergin ...
*
Information governance
Information governance, or IG, is the overall strategy for information at an organization. Information governance balances the risk that information presents with the value that information provides. Information governance helps with legal compl ...
*
Information technology governance
Information technology (IT) governance is a subset discipline of corporate governance, focused on information technology (IT) and its performance and risk management. The interest in IT governance is due to the ongoing need within organization ...
*
Business semantics management
*
Semantics of Business Vocabulary and Business Rules
*
Master data management
Master data management (MDM) is a technology-enabled discipline in which business and information technology work together to ensure the uniformity, accuracy, stewardship, semantic consistency and accountability of the enterprise's official shared ...
*
COBIT
COBIT (Control Objectives for Information and Related Technologies) is a framework created by ISACA for information technology (IT) management and IT governance.
The framework is business focused and defines a set of generic processes for the m ...
*
ISO/IEC 38500
ISO/IEC 38500 is an international standard for Corporate governance of information technology published jointly by the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC). It provides a fr ...
*
ISO/TC 215
*
Operational risk management
Operational risk management (ORM) is defined as a continual recurring process that includes risk assessment, risk decision making, and the implementation of risk controls, resulting in the acceptance, mitigation, or avoidance of risk.
ORM is the ...
*
Basel II Accord
*
HIPAA
The Health Insurance Portability and Accountability Act of 1996 (HIPAA or the Kennedy– Kassebaum Act) is a United States Act of Congress enacted by the 104th United States Congress and signed into law by President Bill Clinton on August 21, ...
*
Sarbanes-Oxley Act
*
Information technology controls
*
Data Protection Directive
The Data Protection Directive, officially Directive 95/46/EC, enacted in October 1995, is a European Union directive which regulates the processing of personal data within the European Union (EU) and the free movement of such data. The Data Pro ...
(EU)
*
Universal Data Element Framework The Universal Data Element Framework (UDEF) was a controlled vocabulary developed by The Open Group. It provided a framework for categorizing, naming, and indexing data. It assigned to every item of data a structured alphanumeric tag plus a control ...
*
Asset Description Metadata Schema
*
Simulation Governance
References
External links
{{wiktionary
Information technology governance
Data management