Duration: 2–4 weeks · Exit criterion: The sponsor validates the as-is report and the list of priority documents.

Goal

Build a shared, documented picture of the current governance: documents, applications, legal frame, actors, sources, consumers and the way projects are decided. The checklist of reference documents shows the missing links.

Participants

Key questions

Governance and documents

incompleteWhich governance documents exist (policy, standards, guidelines, procedures)? Where are they, who owns them, are they up to date?incompleteIs there a data governance council, a governance lead, data owners and data stewards? Are the roles written down?

Legal and ethics

incompleteWhich laws and regulations frame the company's data (GDPR, AI Act, sector rules, NIS2)?incompleteHow does the company position itself on data ethics, and how is that written into the governance?incompleteIs personal data classified for GDPR, and how does the governance apply GDPR (records of processing, DPIA, retention)?

Catalogue and architecture

incompleteHow is the data catalogue structured (domains, terms, hierarchy)? Which tool is used?incompleteHow is the catalogue mapped to the physical structures (databases, tables, columns)?incompleteWhat are the main sources? How are contracts with external sources managed?

Security and access

incompleteHow is data secured? Who has access, and how are access rights requested, granted and reviewed?

Consumers and requests

incompleteWho are the main data consumers? How do they ask for data, report a bug or request an improvement? Is there a ticketing system?

Projects and decisions

incompleteHow are projects managed? Who decides which projects start, and when?incompleteWhat is the current roadmap? Who are the project managers? Is there a project review board (PRB)?

Deliverables

Code

Deliverable

Content

Link

Status

D1.1

Documentation inventory

Existing documents and applications, with links, owners and contact persons.

[link]

To do

D1.2

Stakeholder map

Governance actors, sources and consumers, with their role and how they interact.

[link]

To do

D1.3

Gap checklist

Reference document checklist (section 9) filled in: present, partial or missing.

[link]

To do

D1.4

Initial recommendation

Findings, risks and the priority documents to create for the mission.

[link]

To do

RACI

Activity

Consultant

Sponsor

DG Lead

Council / PRB

Data Owners

Data Stewards

IT & Security

DPO / Legal

PMO

Kick-off: scope, contacts, calendar

R

A

C

–

–

–

–

–

I

Collect existing documents and applications

A/R

–

C

–

–

C

C

C

C

Interview the governance actors

A/R

C

C

C

C

C

C

C

C

Map sources, consumers, request and ticketing channels

R

–

A

–

–

C

C

–

C

Fill in the reference document checklist

A/R

–

C

–

–

C

–

–

–

Present findings and initial recommendation

R

A

C

I

I

I

I

I

I

R = Responsible · A = Accountable (one per activity) · C = Consulted · I = Informed