What is a Data Governance Policy? Examples + Templates

Section

Effective data governance is table stakes for every business. Without it, teams work off of incomplete or inaccurate data, leadership makes misguided business decisions, and the entire organization could risk violating data privacy laws.

A data governance policy is one of the foundational blocks of successful data management, making your data governance practices, goals, and responsibilities transparent and accessible across the organization.

What is a data governance policy?

A data governance policy is a document that defines how an organization uses and manages its data. It provides an overview of all the roles and responsibilities related to data governance, as well as other aspects of managing data assets, such as data quality, security, and access.

A policy is not meant to be a static document, and organizations may change it as the business evolves and privacy regulations change. 

Data governance policy types

Data governance can take the form of four different formats:

• Formalized, with training programs and performance reviews.

• Non-invasive, which takes existing roles and formalizes them for data governance. 

• Command-and-control, which creates roles at the top of the organization and assigns managers and supervisors to delegate each data task.

• Adaptive, a flexible approach to integrating best practices into daily processes as they make sense.

More than one of these formats can be used at once, changing as the organization grows or needs evolve.

Benefits of a data governance policy

A data governance policy has several purposes. It acts as the single source of truth on standards and practices everyone should follow to ensure data quality and accuracy. It provides clarity into individual data-related roles to prevent confusion about responsibilities. The policy also defines procedures employees should follow in different scenarios, such as a data breach.

By unifying all of the information related to data standards and practices, a data governance policy enables organizations to experience the following benefits:

• Trustworthy data. With clear standards in place for data collection, categorization, and storage, you will prevent poor quality data from entering the organization and influencing important business decisions.

• Data democratization. A good data governance policy introduces procedures for democratizing data, i.e., removing data silos with centralized data hubs. Teams can quickly and independently access the data they need for their campaigns, allowing them to expedite decision-making.

• Regulatory compliance. Clear controls for data collection, access, and usage help organizations avoid being fined for misusing sensitive information (along with reputational damage). 

Who should be involved in the data governance policy process?

Drafting the policy is a collaborative effort across IT, data, legal, security,  and compliance departments and anyone else who is a part of your data governance structure. The exact structure will vary depending on the complexity of your data, the business processes, and the size of your organization.

When deciding who to include in the policy drafting process and how to divide their responsibilities, it’s helpful to refer to the Data Governance Institute’s participant recommendations.

• Data governance office (DGO): This office can be one person, such as the chief data officer, or a group of employees who run the entire data governance program.

• Decision bodies: These consist of data stakeholders who will be affected by the policy. In large organizations, there may be multiple decision bodies to advise or set different aspects of the policy.

• Data stewards and custodians: Stewards are employees who work with data on a regular basis, which allows them to monitor for any data-related issues or opportunities and surface them to the decision-makers. Custodians are responsible for managing the technical aspects of data to improve its quality.

Data governance policy examples and templates

For examples of real-life data governance policies, you can refer to a number of public institutions that have made their policies public. 

• The U.S. Department of Transportation’s Federal Highway Administration (FHWA) offers a thorough, 36-page data governance plan with documentation forms to copy, a well-stated series of goals and individual standards for various types of data, and a roster of those responsible. The plan stands out as very visual, with charts to break up information into actionable steps. 

• The State of Oklahoma Office of Management and Enterprise Services policy is brief but thorough, offering a clear list of data management functions/knowledge areas and roles of responsible parties. The flowcharts help readers understand how committees and the Data Governance Office (DGO) work together to support each of the various roles. 

• The University of Nevada Las Vegas (UNLV) keeps its policy brief, covering Data Governance Structure, Data Access Policy, Data Usage Policy, and Data Integrity and Integration Policy. It then links out to other reputable and useful resources, such as its own internal IT policies, Family Educational Rights and Privacy Act (FERPA), and Health Insurance Portability and Accountability Act (HIPAA). 

• The University of New South Wales (UNSW) provides a simple diagram of its data policy framework and a table overview of all data governance roles and their responsibilities. The document also links to related policies, such as the university’s IT security policy.

• The New Hampshire Department of Education defines the policy’s mission and intended outcomes and explains the responsibilities of individual roles and bodies, such as the Data Governance Committee (DGC). The document also includes a section on the policy’s scope.

• King’s College London incorporates a section on the data governance principles that underpin the policy, in addition to a table of definitions that explains the roles of different data stakeholders.

Essential components of a data governance policy

Although the exact structure of a data governance policy varies from one organization to another, it will often include the same several components.

Purpose and scope

How does your business handle its data? Which stakeholders are involved in shaping your company’s data infrastructure, policies, and procedures, as they relate to data collection, usage, and deletion? These are the questions you should be answering when talking about the purpose and scope of your data governance policy. It should pivot between a high-level view and then concrete steps as to how you’ll be measuring success (e.g, linking out to both short-term and long-term goals as well as noting key performance indicators). 

Roles and responsibilities

The roles and responsibilities section will list the relevant data governance stakeholders and which tasks or business areas they oversee. It’s helpful to outline the hierarchical structure of your data governance team so everyone is clear on delegation and lines of communication. 

Remember to add a data governance glossary to keep everyone on the same page regarding important data definitions and acronyms.

Related data policies

Your policy document needs to address different aspects of data governance, from quality to usage. Each of the sections could be several pages long, so for the sake of brevity, briefly summarize each section and provide links to individual policies where employees can find more information.

• Quality: How does your organization manage data integrity and quality? What kinds of procedures ensure its consistency and accuracy? This policy should also explain how data stakeholders are to identify and solve any quality-related issues.

• Security: What is your organization's data security policy? What kind of procedures do you have in place to protect sensitive data, and how should data stakeholders mitigate security risks? The data security policy also needs to address processes for reporting security breaches.

• Access: How do you ensure team members have appropriate access to the data they need? In addition to access permissions, the data access policy should also explain how your organization will respond to any unauthorized access to information assets.

• Usage: How does your use of data comply with applicable laws and privacy regulations, such as GDPR and HIPAA? What kind of controls have you implemented to prevent inappropriate or unlawful use of customer data? The data usage policy should also explain how the organization will respond to any instance where employees have misused sensitive data. 

Prevent and detect data quality issues with Segment Protocols

Improving data quality is one of the chief purposes of implementing a data governance policy. Good data governance is underpinned by tools such as Segment Protocols that can validate data and automatically identify issues before they wreak havoc on your decision-making process.

Protocols also helps you orchestrate your data with a tracking plan that creates a company-wide standard around what events are being tracked and their naming conventions (to standardize data collection). If you're looking for help creating your own data tracking plan, check out our customizable template below.

Companies such as Adevinta (an online classifieds provider) and Univision (a Spanish-language media company) have implemented Protocols to improve their data infrastructure, resulting in several key benefits. Adevinta improved operational efficiency by 10% and lowered data costs by 5%. Univision is able to track more than 400 million events per day with confidence that the data sets are accurate, as Protocols uses in-app reporting and daily emails to notify them of issues.

Data Tracking Plan Template

A data tracking plan helps businesses clarify what events they’re tracking, how they’re tracking them, and why. Use this template to help create your own tracking plan.