What is Data Governance?

What is Data Governance?

Data Governance is the set of practices, policies, and organisational structures that ensure an organisation's data is managed as a valuable asset. It answers fundamental questions about data: Who owns it? Who can access it? How is its quality maintained? How long is it retained? And how does the organisation comply with data regulations?

Think of data governance as the management system for your data, similar to how financial governance ensures that money is tracked, accounted for, and spent responsibly. Without financial governance, an organisation would quickly descend into chaos. The same is true for data.

Key Components of Data Governance

Policies and Standards

Written rules that define how data should be handled. This includes:

• Data classification: Categorising data by sensitivity (public, internal, confidential, restricted)
• Data retention: How long different types of data are kept and when they should be deleted
• Data quality standards: Minimum quality requirements for different datasets
• Naming conventions: Standardised naming for data fields, tables, and systems across the organisation

Roles and Responsibilities

• Data owners: Senior leaders accountable for specific data domains (e.g., the CFO owns financial data, the CMO owns marketing data)
• Data stewards: Operational staff who maintain data quality and enforce policies on a day-to-day basis
• Data custodians: IT staff responsible for the technical infrastructure that stores and processes data
• Data governance council: A cross-functional group that sets priorities, resolves disputes, and oversees the governance programme

Processes and Workflows

• Data access requests: How employees request and receive access to data
• Change management: How changes to data structures, definitions, or policies are approved and implemented
• Issue resolution: How data quality problems, policy violations, and access disputes are escalated and resolved
• Audit and compliance: Regular reviews to ensure governance policies are being followed

Technology and Tools

• Data catalogues: Tools like Alation, Collibra, or open-source Apache Atlas that document what data exists, where it lives, and what it means
• Access control systems: Tools that manage who can see and modify which data
• Data lineage tracking: Tools that trace data from its source through all transformations to its final use
• Data quality monitoring: Automated systems that continuously check data against defined quality rules

Data Governance in Southeast Asia

Data governance is particularly important for businesses operating across ASEAN because of the region's evolving regulatory landscape:

• Singapore PDPA (Personal Data Protection Act): Comprehensive data protection law with significant penalties for non-compliance
• Thailand PDPA: Modelled after GDPR, with strict consent and data subject rights requirements
• Indonesia PDP Law: Personal Data Protection law enacted in 2022 with a transition period for compliance
• Malaysia PDPA: Applies to commercial transactions and requires registration for certain data processors
• Philippines DPA (Data Privacy Act): Enforced by the National Privacy Commission
• Vietnam's Decree 13: Governs personal data protection with localisation requirements

Each market has different requirements for consent, data storage, cross-border transfer, and breach notification. A strong data governance framework helps organisations navigate this complexity systematically rather than reactively.

Building a Data Governance Programme

For SMBs, data governance does not need to be complex or expensive. A practical approach:

1. Start with compliance: Identify the regulatory requirements that apply to your business across the markets you operate in. This creates urgency and executive support.
2. Classify your data: Understand what data you have, where it lives, and how sensitive it is. Focus on personal data, financial data, and competitively sensitive information first.
3. Assign ownership: Ensure every critical dataset has a clear owner. Start with the data that carries the highest risk or regulatory exposure.
4. Define essential policies: Draft policies for data access, retention, and quality. Start simple and refine over time.
5. Implement access controls: Ensure only authorised people can access sensitive data. This is often the quickest governance win.
6. Train your team: Ensure employees understand data handling policies and their responsibilities. Regular, brief training is more effective than one-time sessions.