Data Governance

Nobody buys governance. They buy an end to arguing about numbers.

Governance has a naming problem: it sounds like committees, policies and documents nobody reads. In practice, a company looks for governance when sales and finance arrive at the meeting with different revenue figures, and the next hour is spent working out which of the two is right instead of deciding what to do about it.

The cause is almost never the dashboard. It is that cliente means one thing in the CRM and another in the ERP, that nobody knows where a given field came from, and that the spreadsheet feeding the most important report lives in someone’s personal folder. Governance is fixing that. The side effect is that data protection becomes a matter of design rather than effort.

The four layers

None works on its own. It is the combination that stops the numbers diverging.

• Quality and cleansing. Deduplication, key standardisation and correcting inconsistencies at the source. With quality rules that run on their own and raise a flag when something arrives out of pattern instead of someone finding out three months later, at closing.
• Data catalogue. The inventory of what exists: every table, every field, what it means in plain language and who is accountable for it. It is what lets a new person find the data without asking three colleagues.
• Lineage. The path each number travels from source to dashboard. When a value changes, you can answer why in minutes and before the board asks.
• Access policy. Who sees what, defined by role rather than by exception, with an audit trail: who accessed, when and what they did.

Where data protection comes in

Governance done well already covers most of what the law requires at the data layer, without becoming a separate project.

• Mapping personal data. Where it sits, in which tables and for what purpose. It is the inventory the law asks for, and the catalogue produces it anyway.
• Least necessary access. Each role sees what it needs to work, nothing more. That is access policy, not an extra compliance layer.
• Audit trail. The record of who accessed what, which serves both the auditor and the response to a security incident.

What you are left with

• A living catalogue. Documented, with a named owner for each data domain.
• Quality rules running. Automated, with an alert when something falls out of pattern.
• The access matrix. By role, reviewable, with a history of who changed what.
• Team training. To keep catalogue and rules up to date without depending on us.

How we run it

We start with a quality assessment on the sources that matter most usually not all of them, and insisting on covering everything at once is what delays governance projects the most. We prioritise the domains that support the highest-value decisions, deliver governance there, and use the result as the template for the next ones.

How we measure results

The most frequent indicators are the reduction in divergence between departments, the time it takes to answer where a number came from, and the number of out-of-policy accesses found in the first review that last one tends to surprise.

We now have a far more robust, fast and visual view of each management area’s results.

Sales director national fuel distributor