Method · Data governance

How I set up data governance

INDEPENDENT CONSULTANT · DATA GOVERNANCE, DATA QUALITY & MDM

The link between business and IT teams · Coaching, training and knowledge transfer

In short

I start by listening: in two to four weeks I map what exists, the documents, tools, roles, legal frame and the way projects are decided. Then we agree where to go together: priority domains, concrete use cases and a roadmap. The roadmap becomes a programme with a project review board, and the projects run in short sprints followed in Jira and Confluence. Training and coaching run all along, and I write governance documents only where a gap calls for one.

Start from what exists

Reuse the documents, tools and roles already in place; fix the missing links.

Business first

Each action answers a business question carried by a use case and a data owner.

Small, visible steps

Two-week sprints with a report at each sprint; the PRB decides at each step.

Documents only when needed

Write a policy, standard or procedure when a gap calls for it, not by default.

Leave autonomy behind

Train and coach so that the teams keep the governance running after the mission.

The plan at a glance

A first mission of about three months covers phases 1 to 3 and the first sprintsW1W2W3W4W5W6W7W8W9W10W11W12W131Get to know2–4 weeks2Where are we going4–6 weeks3Set up the programme2–3 weeks4Deliver and follow up the projectsOngoing · 2-week sprintsTraining and coachingGovernance documents (if needed)ongoingIndicative durations for a mid-size organisation and one consultant; overlaps are deliberate.

Durations are indicative and adapt to each situation. When I join a team where governance is already in place and well structured, the first steps are shorter, sometimes much shorter.

The four phases

1

Get to know: as-is analysis

Understand how data is governed today, before changing anything.

2–4 weeks · 4 deliverables›

Goal

Build a shared, documented picture of the current governance: documents, applications, legal frame, actors, sources, consumers and the way projects are decided. The checklist of reference documents shows the missing links.

Who takes part

SponsorData Governance LeadCouncil members (if any)Data Owners and Data StewardsIT / data architects / CISODPO and legalPMO and project managersMain data consumers

Key questions

Governance and documents
  • Which governance documents exist (policy, standards, guidelines, procedures)? Where are they, who owns them, are they up to date?
  • Is there a data governance council, a governance lead, data owners and data stewards? Are the roles written down?
Legal and ethics
  • Which laws and regulations frame the company's data (GDPR, AI Act, sector rules, NIS2)?
  • How does the company position itself on data ethics, and how is that written into the governance?
  • Is personal data classified for GDPR, and how does the governance apply GDPR (records of processing, DPIA, retention)?
Catalogue and architecture
  • How is the data catalogue structured (domains, terms, hierarchy)? Which tool is used?
  • How is the catalogue mapped to the physical structures (databases, tables, columns)?
  • What are the main sources? How are contracts with external sources managed?
Security and access
  • How is data secured? Who has access, and how are access rights requested, granted and reviewed?
Consumers and requests
  • Who are the main data consumers? How do they ask for data, report a bug or request an improvement? Is there a ticketing system?
Projects and decisions
  • How are projects managed? Who decides which projects start, and when?
  • What is the current roadmap? Who are the project managers? Is there a project review board (PRB)?

Deliverables

  • D1.1Documentation inventory
    Existing documents and applications, with links, owners and contact persons.
  • D1.2Stakeholder map
    Governance actors, sources and consumers, with their role and how they interact.
  • D1.3Gap checklist
    Reference document checklist (section 9) filled in: present, partial or missing.
  • D1.4Initial recommendation
    Findings, risks and the priority documents to create for the mission.
Exit criterion

The sponsor validates the as-is report and the list of priority documents.

RACI

ActivityConsultantSponsorDG LeadCouncil / PRBData OwnersData StewardsIT & SecurityDPO / LegalPMO
Kick-off: scope, contacts, calendarRAC–––––I
Collect existing documents and applicationsA/R–C––CCCC
Interview the governance actorsA/RCCCCCCCC
Map sources, consumers, request and ticketing channelsR–A––CC–C
Fill in the reference document checklistA/R–C––C–––
Present findings and initial recommendationRACIIIIII

R = Responsible · A = Accountable (one per activity) · C = Consulted · I = Informed

2

Where are we going: gaps, use cases and roadmap

Assess eight dimensions, select priority domains and use cases, build the roadmap.

4–6 weeks · 5 deliverables›

Goal

Measure the gaps against a target governance framework on eight dimensions, choose the priority domains, describe concrete use cases and agree a data governance roadmap with the sponsor and the council.

Who takes part

Data Governance LeadCouncilData Owners of the candidate domainsData StewardsIT, architecture and securityDPO and legalPMO

Deliverables

  • D2.1Gap assessment
    Maturity and gaps per dimension, with evidence from phase 1.
  • D2.2Risk register
    Legal, ethical and security risks, with owner and proposed treatment.
  • D2.3Priority domains and use cases
    One use case card per priority (business question, data, owner, value, risk, KPI).
  • D2.4Data governance roadmap
    Target framework and a 12 to 18-month roadmap, by quarter.
  • D2.5Roadmap decision
    Presentation to the sponsor and the council; go decision for phase 3.
Exit criterion

The sponsor and the council approve the roadmap and the priority use cases.

Eight dimensions assessed

Governance framework
  • Is the framework clear, understood and followed?
  • Is the organisation structured? What are the gaps?
  • Which documents exist: policy, standard, guideline, procedure?
  • What is the draft – review – approve – publish flow, and which software supports it?

→ Gaps; target framework and operating model

Data catalogue
  • What are the domains? What are the terms and their hierarchy?
  • Who creates domains and terms, with which flow?
  • Which software is used?

→ Gaps; priority domains; catalogue use case

Data quality
  • How is quality defined and measured?
  • Are there quality standards? Who defines them, with which process?
  • How are bugs and quality incidents reported?

→ Gaps; priority domains; quality use case

Data projects
  • How are projects managed (agile method)?
  • What is the current roadmap, how and when is it defined?
  • Who decides the priorities, and how?

→ Project structure for phase 3

Legal and ethics
  • Which legal constraints apply? Are the controls in place?
  • What is missing? Who decides?

→ Gaps and risks; priority use case

Security
  • How is physical security managed, and by whom?
  • How are data access rights defined, and by whom?
  • How is data classified, and by whom?

→ Gaps and risks; priority use case

Data architecture
  • Which databases exist, and who manages them?
  • Who has access? Who manages the table structures?
  • How are the physical structures linked to the semantic layer (catalogue)?

→ Gaps; lineage and mapping needs

People
  • Who are the data owners and data managers? Do they have a job description?
  • What are their training and coaching needs?

→ Training and coaching plan

RACI

ActivityConsultantSponsorDG LeadCouncil / PRBData OwnersData StewardsIT & SecurityDPO / LegalPMO
Assess framework and organisationR–ACC––––
Assess catalogue, quality and architectureR–A–CCC––
Assess legal, ethics and security; build the risk registerR–AI––CC–
Assess projects and peopleR–A–CC––C
Select priority domains and write the use casesR–RACC–––
Build the roadmap and target frameworkRCAC––––C
Approve the roadmapCARR––––I

R = Responsible · A = Accountable (one per activity) · C = Consulted · I = Informed

3

Set up the programme

Create the project review board, score and select the projects, start them.

2–3 weeks · 5 deliverables›

Goal

Turn the roadmap into a managed programme: a project review board that decides, a scored portfolio, resources, and the first projects started with a clear operating mode in Jira and Confluence.

Who takes part

SponsorCouncil / PRB membersData Governance LeadPMO and project managersData Owners of the selected domainsIT

Steps

  1. Create or organise the project review board (PRB): members, cadence, decision criteria.
  2. Identify the projects with their cost and expected return.
  3. Score and prioritise the projects (value, urgency, risk reduction, effort).
  4. Identify the resources per project.
  5. Select the projects to start (go / no-go).
  6. Start the projects: Jira and Confluence structure, operating mode, deliverables, kick-off.

Deliverables

  • D3.1PRB charter
    Members, cadence, decision criteria, escalation path.
  • D3.2Scored portfolio
    Projects with cost, benefit and priority score.
  • D3.3Resource plan
    People and budget per selected project.
  • D3.4Project charters
    Scope, owner, deliverables, milestones for each selected project.
  • D3.5Operating mode
    Jira project, Confluence space, workflow, templates and ceremonies.
Exit criterion

The PRB has selected the first projects; each one has a charter, an owner and a backlog.

RACI

ActivityConsultantSponsorDG LeadCouncil / PRBData OwnersData StewardsIT & SecurityDPO / LegalPMO
Create the PRB: charter, members, cadenceRA–C––––C
Identify projects with cost and benefitR–A–C–C–R
Score and prioritise the projectsR––AC–––C
Identify resources–A––C–C–R
Select the projects to startCICA/R––––C
Set up Jira / Confluence and kick off the projectsR–C–––C–A

R = Responsible · A = Accountable (one per activity) · C = Consulted · I = Informed

4

Deliver and follow up the projects

Run the projects in sprints, report at each sprint, adjust with the PRB.

Ongoing · 2-week sprints · 5 deliverables›

Goal

Deliver the use cases in short iterations, with written specifications, visible progress and regular decisions by the PRB, until the client teams run the governance on their own.

Who takes part

Data Owners (product owners)Data StewardsIT and data engineersPMO / Scrum masterData Governance LeadPRB (monthly)

Steps

  1. Write the backlog and the specifications (user stories, acceptance criteria, Definition of Ready and Done).
  2. Run the sprints in Scrum (2 weeks) or follow the flow in Kanban, depending on the team.
  3. Report at the start and the end of each sprint: goal, delivered, blocked, next.
  4. Report monthly to the PRB: progress, KPIs, risks, decisions needed.
  5. Handle change requests and re-prioritise with the PRB.
  6. Close with lessons learned and a handover to the client teams.

Deliverables

  • D4.1Backlog and specifications
    User stories with acceptance criteria; Definition of Ready and Done.
  • D4.2Sprint plans and reviews
    Sprint goal, scope and demo of what was delivered.
  • D4.3Sprint reports
    One page at the start and end of each sprint.
  • D4.4Monthly PRB report
    Progress, KPIs, risks and decisions requested.
  • D4.5Lessons learned and handover
    What worked, what to keep, who owns what next.
Exit criterion

The use cases are delivered and the client team runs the sprints and the PRB without the consultant.

RACI

ActivityConsultantSponsorDG LeadCouncil / PRBData OwnersData StewardsIT & SecurityDPO / LegalPMO
Write backlog and specificationsR–––ACC––
Plan and run the sprintsR––––RR–A
Sprint review and reportR–I–C–––A
Monthly report to the PRBRICI––––A
Change requests and re-prioritisationC––AC–––R
Lessons learned and handoverR–AIII––I

R = Responsible · A = Accountable (one per activity) · C = Consulted · I = Informed

Two streams that run all along

A

Training and coaching

Make the roles work: train, coach, and pass on the know-how.

From phase 2›

When

From phase 2, all along the mission

  • Training plan per role, built from the "People" dimension of phase 2.
  • Sessions: governance basics, Data Owner and Data Steward roles, the catalogue tool, data quality rules, GDPR and AI Act awareness.
  • One-to-one coaching of data owners, stewards and the governance lead.
  • Train-the-trainer so that the client teams can onboard newcomers.

Deliverables

  • Training plan
  • Training material
  • Attendance and adoption KPIs
B

Governance documents (if needed)

Write only the documents the gaps call for, with a clear approval flow.

When phases 1 and 2 show a missing document›

When

When phases 1 and 2 show a missing document

  • Order: policy first, then the priority standards, then the procedures and guidelines.
  • Each document follows the draft – review – approve – publish flow of DG-STD-002.
  • Written from ready-made templates (standard, procedure) and existing examples (data dictionary standard DG-STD-001, document management standard DG-STD-002).

Deliverables

  • Approved documents
  • Document register
  • Publication in the repository

How I start: the first 10 days

Day 1

Kick-off with the sponsor and the governance lead: scope, contacts, calendar, access to documents.

Days 2–5

Collect documents and applications; first interviews (governance lead, DPO, IT, PMO).

Days 6–9

Interviews of data owners, stewards and main consumers; fill in the reference checklist.

Day 10

First feedback to the sponsor: what exists, what is missing, what to tackle first.

✓

Reference documents checked in phase 1

23 documents a well-run governance usually needs, grouped by theme

23›
ThemeDocumentTypeContentPriority
FrameworkData Governance PolicyPolicyPrinciples, scope, accountabilityHigh
FrameworkGovernance charter / operating modelPolicyBodies, roles, decision rights, council terms of referenceHigh
FrameworkData governance roadmapPlanPriorities by quarterHigh
OrganisationRoles and responsibilities (RACI)StandardOwner, steward, lead, council, IT, DPOHigh
OrganisationJob descriptions: Data Owner, Data StewardGuidelineTasks, time, skillsMedium
OrganisationDomain ownership registerRegisterOne owner per domainHigh
CatalogueData dictionary / business glossary standardStandarde.g. DG-STD-001High
CatalogueMetadata and naming standardStandardNaming, definitions, modelling conventionsMedium
CatalogueReference and master data standardStandardCode lists, golden recordsMedium
QualityData quality standardStandardDimensions, thresholds, measurementHigh
QualityData quality issue procedureProcedureReport, triage, fix, closeHigh
QualityData quality rule library and dashboardRegisterRules, results, trendsMedium
Legal & ethicsRecords of processing activities (GDPR art. 30)RegisterKept by the DPOHigh
Legal & ethicsDPIA procedureProcedureWhen and how to assess high-risk processingMedium
Legal & ethicsData ethics and AI use guidelineGuidelineAI Act, acceptable useMedium
Legal & ethicsExternal data contracts registerRegisterSources, licences, DPAs, expiryMedium
SecurityData classification standardStandardConfidentiality levels, personal dataHigh
SecurityAccess request and review procedureProcedureRequest, approve, review, revokeHigh
SecurityRetention and deletion standardStandardRetention periods, deletion proofMedium
DocumentsDocument management standardStandarde.g. DG-STD-002High
ProjectsPRB charter and decision logCharterMembers, criteria, decisionsHigh
ProjectsProject charter and sprint report templatesTemplateOne per project / sprintMedium
ProjectsChange request and exception procedureProcedureWho decides, how it is recordedMedium

Concrete follow-up: Jira and Confluence

Every mission comes with a generic project structure that I import into the client's Jira and Confluence on day one of phase 3: one epic per phase and stream, one story per deliverable, and a Confluence space with a page per phase and ready-made templates (use case card, sprint report, PRB minutes, decision log).

See how I run a project in Jira and Confluence

Jira workflow

To Do→In Progress→In Review→Blocked→Done

Ceremonies

CeremonyWhenOutput
Sprint planningStart of sprint, 1–2 hSprint goal and scope
Daily stand-up15 min (Scrum) or board review (Kanban)Blockers
Sprint reviewEnd of sprint, 1 hDemo and acceptance
RetrospectiveEnd of sprint, 45 minImprovement actions
PRBMonthly, 1 hProgress, KPIs, decisions

Let’s talk about your context

The full reference document (phases, RACI, deliverables, checklists and templates) is available as a PDF.

Download the reference (PDF) Contact me