Data governance framework: what it is and how to build one

Every company has data governance, even if nobody calls it that: someone decides who sees the customer list, someone notices when sales figures disagree, someone (eventually) deletes old files. A data governance framework makes those decisions deliberate. This guide explains what data governance is, what a framework contains, how the well-known frameworks compare, and a version a small company can run without a data office.

By Alex Martyushin, founder & risk consultant · Updated 30 October 2026 · 16 min read

What is data governance?

A practical data governance definition: data governance is how an organisation decides, and checks, what happens to its data. It answers questions such as:

• Who is accountable for the customer database, and who may approve new uses of it?
• What does “active customer” mean, and which report is the source of truth?
• Which data is personal, confidential or regulated, and where does it live?
• How accurate does the data need to be, and who fixes it when it is wrong?
• How long do we keep it, and how do we prove it was deleted?

Data governance is often confused with neighbouring disciplines. The distinction matters because it tells you who does what:

Governance is the layer that connects them. It sets the rules that privacy, security and data teams apply, and it is where conflicts between them get resolved — for example, marketing wanting to keep data indefinitely while privacy wants it deleted.

Why it matters to a smaller business

Data governance has a reputation as something for banks with a Chief Data Officer. In practice the problems it solves show up early: decisions made on figures nobody trusts, personal data scattered across inboxes and shared drives, former staff and agencies who still have access, an AI tool fed with customer data without anyone approving it. These are risks like any other, and they belong in the same place as your other risks. If you are new to the idea, our guide on what risk management is explains the wider process data governance plugs into.

Data governance principles

Frameworks phrase them differently, but most data governance programmes rest on a handful of principles. They are worth writing into your data policy because they settle arguments before they start:

• Accountability — every important data set has a named business owner.
• Data as an asset — data is managed for its value and its risk, not left to whoever created it.
• Quality at source — errors are fixed where data is created, not patched in every report.
• Standard definitions — one agreed meaning for key terms such as customer, revenue and churn.
• Protection by classification — controls follow how sensitive the data is.
• Minimisation and lifecycle — collect what you need, keep it as long as justified, then delete it.
• Transparency and auditability — decisions, access and changes can be traced.

Why is this important? Because without these principles the same problems repeat: reports that disagree, sensitive data spread across tools nobody approved, and no one able to say who may use what. Good governance makes data trustworthy enough to base decisions on, cuts the cost and impact of breaches, and makes compliance with privacy law far easier to prove.

Components of a data governance framework

The well-known frameworks label things differently, but almost all contain the same building blocks. Use this as a checklist when you design or review yours.

Roles: owners, stewards and custodians

Roles are the part that most often goes wrong, usually because “IT owns the data” by default. The common model separates accountability from day-to-day care and from technical operation:

• Executive sponsor — sets direction, resolves disputes between departments, provides budget.
• Data owner — a business manager accountable for a data domain (customer, product, finance, HR). Approves access and new uses, accepts data risks.
• Data steward — looks after definitions, quality rules and issues for a domain. Often a power user in the business, part-time in the role.
• Data custodian — IT or a supplier running the systems: backups, access provisioning, technical controls.
• Governance forum — in a larger organisation a council that meets regularly; in a small one, a standing item in the management meeting.

Policies and classification

A data policy states principles (data is an asset, has an owner, is classified, is kept only as long as needed) and points to more detailed standards. Classification is the most useful single standard because it drives access, encryption, sharing and retention. Four levels are enough for most organisations: public, internal, confidential, and restricted (personal data of special category, payment data, health data, credentials, trade secrets).

Data catalogue and inventory

You cannot govern data you cannot find. An inventory lists systems and data sets with owner, classification, location (including country), suppliers involved and purpose. If you are subject to GDPR, much of this overlaps with your record of processing activities — build them together. Our GDPR compliance checklist covers the record of processing in detail.

Data quality

Quality is usually measured along dimensions such as accuracy, completeness, consistency, timeliness, validity and uniqueness. Do not try to measure everything. Pick the data that drives revenue, customer experience or regulatory reporting, write a handful of rules (“every active customer has a valid email address”, “invoice totals match the ledger”), measure them monthly and assign issues to stewards.

Privacy, security and sharing

Governance does not replace your security programme; it tells it what matters. Classification decides which controls apply. Data owners approve access and sharing. Supplier contracts reflect the data involved — see third-party risk assessment for vendors that hold your data.

Lifecycle and retention

Keeping data “just in case” increases breach impact, storage cost and legal exposure. A retention schedule lists each record type, its retention period, the reason (legal requirement, contract, business need) and what happens at the end: deletion, anonymisation or archiving. The hard part is running the deletion, so give it an owner and a date.

Data governance frameworks compared

People searching for “data governance frameworks” usually find the same names. They are not competing standards so much as different lenses: a body of knowledge, a governance operating model and a maturity assessment.

A few notes on currency. DAMA has been working on a revised edition of the DMBOK; until it is published, the second edition (and its 2024 revision) remains the common reference, and sources disagree on the timing of the next edition. Vendors such as cloud data platforms and catalogue providers also publish their own “frameworks”; these are useful checklists, but treat them as marketing until you have compared them with the sources above.

How governance fits risk frameworks

If you already run ISO 31000 or another risk management framework, you do not need a separate one for data. Treat data governance as a set of controls and accountabilities that address data risks, and manage those risks through the same register, scoring and review cycle. Information security standards such as ISO/IEC 27001 cover classification, access control and supplier controls; governance adds ownership, definitions, quality and lifecycle.

Data governance maturity: where are you now?

Maturity models such as DCAM score capabilities in detail, but most use a version of the same five-level scale. A quick self-assessment tells you which next step is realistic:

Most small companies start at level 1 or 2, and level 3 is a good target for the first year. Moving more than one level at a time usually means writing documents nobody follows.

A lightweight framework for a small company

For an organisation of tens or a few hundred people, a workable data governance framework fits on a few pages and takes weeks, not a programme. Here is a sequence that works.

Week 1: decide scope and owners

• List your five to ten critical data sets: typically customers, orders and payments, employees, product or pricing, finance, and anything regulated (health, children’s data, payment cards).
• Name a business owner for each. The person who would be called if the data were wrong or leaked is usually the right one.
• Name one person as governance lead. In a small company this is often the operations, finance or compliance lead, not a full-time role.

Weeks 2–3: inventory and classify

• Build a spreadsheet of systems: name, data held, owner, classification, location, supplier, number of users with access, admin accounts.
• Include the shadow estate: shared drives, spreadsheets that feed reports, marketing tools, AI assistants staff use, exports sitting in email.
• Apply your four-level classification.

Week 4: write the minimum policies

• Data policy — principles, roles, classification levels and what each level means for access, sharing, storage and encryption.
• Retention schedule — record type, period, reason, end-of-life action.
• Acceptable use of data with AI tools — which tools are approved, which classifications may be entered, who approves exceptions.

Month 2: quality, access and metrics

• Define your top ten business terms in a glossary: customer, active customer, revenue, churn, order, and so on.
• Write three to five quality rules on the data that drives money and compliance; measure them monthly.
• Run an access review on restricted and confidential data; remove leavers, agencies and excess admin rights.

Ongoing: review quarterly

Put data governance on the management agenda once a quarter: quality scores, open data issues, access review results, deletions completed, new data uses approved, and changes to data risks. That rhythm is most of what “operating model” means in a small company.

Data governance framework examples

What the framework looks like depends on the business. Three sketches of a first-year version:

In each case the framework is a few pages, a spreadsheet inventory and a quarterly agenda item — not a new department.

Data governance tools: when you need them

Searches for “data governance tools” return long vendor lists. The categories are more useful than the brands:

Many cloud data platforms now include built-in cataloguing, classification and access policies. Use what you already pay for before buying a specialist tool.

Data risks to log in your risk register

A data governance framework is a set of controls. The risks it controls should sit in your risk register, scored on the same risk matrix as everything else, so the board sees data risk next to commercial and operational risk. Example entries:

Scores are illustrative residual scores on a 5×5 matrix. Breach-related data risks also need a response plan — our data breach response plan guide covers that side.

Indicators that show whether governance is working

• Critical data sets without a named owner (target: zero).
• Data quality rule pass rate on key data sets, tracked monthly.
• Access reviews completed on time for restricted data.
• Records past retention not yet deleted.
• Open data issues older than 30 days.
• New systems or AI tools adopted without classification and owner approval.

Common mistakes

• Making it an IT project. IT runs the systems; the business owns the meaning, use and risk of the data.
• Boiling the ocean. Governing every table in every system stalls. Start with the critical data sets.
• Policies without owners. A retention policy that nobody executes is worse than none — it documents that you knew.
• Tool first. A catalogue fills up with metadata; it does not decide who is accountable.
• Separate silos for privacy, security and governance. One inventory, one classification scheme and one risk register save duplicated effort.
• Ignoring new uses. AI tools, analytics and data sharing with partners are where governance decisions are most needed and most often skipped.

This guide is general information, not legal advice. Where data governance supports legal obligations such as data protection, confirm the specifics with a qualified adviser.