# Data Governance Roles, Policies, and Data Stewardship

> Chapter 16 of the Courseiva DATA-PLUS curriculum — https://courseiva.com/learn/data-plus/governance-roles-and-policies

**Official objective:** 5.2 — Describe governance roles, policies, and data stewardship

## Introduction

Data governance is the framework of rules, roles, and responsibilities that ensures an organisation's data is accurate, secure, and used properly. It matters for the DA0-002 exam because governance is the foundation of every data management job—without it, data is just a chaotic mess of spreadsheets and databases with no one accountable.

## The 34-Room Hotel Analogy

A 34-room hotel needs more than just guests and housekeepers to run smoothly. It needs a clear set of rules, a chain of command, and someone to make sure the rules are followed and the data (guest bookings, payment details, preferences) stays accurate and secure.

The Hotel Owner (Executive Leadership) signs off on the big-picture policies: no guest data can be shared without consent, credit card numbers must be encrypted, and only certain staff can access the booking system. The General Manager (Data Governance Council) creates the detailed procedures based on those policies—like what happens if a fire alarm forces an evacuation: who grabs the backup server? The Front Desk Manager (Data Steward) is responsible for the quality of the data. They ensure check-in forms are filled in correctly, duplicates are merged, and outdated records are archived. Their team (Data Custodians) actually handles the physical tasks: entering the data, running the system backups, and resetting passwords.

When a guest checks in and the system shows two different room numbers for the same booking, the Front Desk Manager doesn't just guess—they follow the policy to investigate and correct it. They have a defined role, a process to follow, and the authority to fix the data. Without these roles and policies, the hotel would have chaos: lost reservations, double-booked rooms, and stolen payment information. That is exactly what data governance prevents.

## Core explanation

Data governance is the system of decision-making and accountability for an organisation's data assets. Think of it as the constitution for data: it defines who can do what with which data, under what circumstances, and who is responsible when something goes wrong.

Before data governance existed, organisations often treated data like a free-for-all. Different departments stored customer information in separate spreadsheets, sales used one format, support used another, and no one knew which version was correct. This caused massive inefficiencies: duplicate records, contradictory reports, and security breaches because no one had clear ownership. Data governance solves this by creating structure and accountability.

Key roles in data governance include: the Data Owner, who is a senior executive accountable for a specific data domain (like customer data or financial data) and has the authority to approve who can access it. The Data Steward is a hands-on role responsible for the day-to-day quality, usability, and security of that data. They define data standards, resolve quality issues, and act as a bridge between business users and technical teams. The Data Custodian is the person or team that implements the technical controls: they manage the database, enforce access rules, and run backups. A Data Governance Council (sometimes called a Data Board) is a cross-functional group that reviews policies, approves changes, and escalates issues. Finally, Executive Sponsorship provides budget and authority to enforce governance across departments.

Policies are the written rules that define how data should be handled. For example, a Data Classification Policy might define three categories: Public (can be shared freely), Internal (only for employees), and Confidential (requires encryption and strict access controls). A Data Retention Policy specifies how long different types of data must be kept—tax records for 7 years, customer support chats for 3 years—and when they must be deleted. An Access Control Policy defines who can read, edit, or delete specific data, often based on the principle of least privilege: giving users only the access they need to do their job.

Data stewardship is the operational execution of governance. A data steward doesn't necessarily write the policies, but they make sure the policies are followed. They perform tasks like:

- Checking new data for errors (validating formats, ranges, and completeness)
- Merging duplicate customer records so the company has one single view of each customer
- Documenting where sensitive data lives (data lineage)
- Responding to data quality issues reported by users

The whole system works because of accountability. If a data quality problem is found, there is a named person (the data steward) who can be contacted. If a policy needs changing, there is a committee that reviews it. If a breach occurs, the data owner is responsible for reporting it and defining the remediation plan.

Data governance also involves tools: data dictionaries (catalogues of all data elements and their definitions), metadata management systems (which track where data comes from and how it transforms), and data quality monitoring tools (which measure accuracy, completeness, consistency, timeliness, uniqueness, and validity).

In summary, data governance turns data from an unmanaged liability into a managed asset. It replaces guesswork with documented rules, blame with clear roles, and chaos with control.

## Real-world context

Imagine you are the new data steward at a mid-sized e-commerce company called 'ShopAll'. Here is what your first week looks like, step by step.

On Monday, you receive a report from the customer service team: 'We have 2,000 customer records that look identical—same name, same address, but different customer IDs.' You check the data quality policy, which states you must 'merge duplicate records within 5 business days and keep the most recent phone number.' You open the data entry system and use a merge tool to combine duplicates, ensuring no data is lost. You then update the data dictionary to note that customer.phone is now populated from the most recent source.

On Tuesday, the marketing team asks for access to the 'Customer Purchase History' table to run a campaign. You check the current access control policy: only the sales director and finance team have write access. Marketing has read-only access, but only after signing a data confidentiality agreement. You send the agreement to HR to get it signed, then grant read-only access via the database's role-based access control (RBAC) system. You log the access change in the governance tool.

On Wednesday, you discover that a database administrator (a data custodian) accidentally gave a contractor full access to the 'Payment Transactions' table. This is a breach of the Data Classification Policy (which labels payment data as 'Confidential'). You escalate to the Data Owner for Finance, who revokes access immediately and initiates an incident report. The policy requires that any suspected breach be reported to the Data Governance Council within 24 hours. You draft the report.

On Thursday, you attend the monthly Data Governance Council meeting. The council reviews the incident and votes to tighten access control: from now on, even administrators must use a 'break glass' procedure (special approval) to access payment data. You update the policy document and send a notification to all staff.

On Friday, you run the monthly data quality dashboard. It shows that 98.5% of records have a valid email address, but the target is 99.5%. You create a task for the data entry team to validate 200 recently added records and check if the email field is being left blank by mistake.

This scenario shows the daily reality of data governance: it is not a single task but an ongoing cycle of monitoring, enforcing, documenting, and improving. An IT professional in this role uses tools like data quality platforms, metadata managers, and RBAC systems, but their core skill is understanding who owns data and what the rules are.

## Exam focus

The DA0-002 exam tests data governance in objective 5.2, and it expects you to know the exact definitions and responsibilities of each role, plus how policies and stewardship fit together. Here is what you need to focus on.

First, you will see scenario-based questions where you are given a situation (like 'An employee accidentally deletes a customer database') and asked to identify who is responsible. The exam loves to test the difference between a Data Owner and a Data Steward. Remember: the Data Owner is a senior person who has accountability for the data asset—they approve access and set the rules. The Data Steward is operational—they implement the rules and clean the data. If a question says 'Who defines the data retention policy?' the answer is typically the Data Owner. If it says 'Who fixes a data quality issue?' the answer is the Data Steward.

Common exam traps include: confusing Data Steward with Data Custodian. Data Custodians handle the technology (backups, database management), not the business rules. Another trap is mixing up policies with procedures. A policy is the 'what' (e.g., 'All customer data must be encrypted'), while a procedure is the 'how' (e.g., 'Run this encryption script every night'). The exam specifically tests this distinction.

Key concepts to memorise:
- Data Governance roles: Data Owner, Data Steward, Data Custodian, Data Governance Council, Executive Sponsor
- Policy types: Data Classification Policy, Data Retention Policy, Access Control Policy, Data Quality Policy
- Data Stewardship activities: data profiling, data cleansing, metadata management, data lineage documentation
- The difference between data quality dimensions: accuracy, completeness, consistency, timeliness, uniqueness, validity

The exam also tests the concept of a 'Data Governance Framework' like DAMA-DMBOK or COBIT, but you only need to know that frameworks provide standardised processes—you do not need to memorise their specific details. Expect at least 3-5 questions on this objective, usually matching terms to definitions or choosing the correct role for a given task. One common question type: 'Which role is responsible for ensuring data meets quality standards before it is loaded into the data warehouse?' Answer: Data Steward.

Another exam favourite: asking you to identify a policy violation from a scenario. For example, 'A marketing manager shares a customer list with a third-party vendor without approval. Which policy is being violated?' Answer: Access Control Policy or Data Sharing Policy. Be ready to apply the concepts rather than just recite definitions.

## Step by step

1. **Identify Data Domains** — An organisation first identifies its major categories of data, such as Customer, Product, Financial, and Employee data. Each domain becomes the responsibility of a Data Owner.
2. **Assign Roles and Responsibilities** — A Data Owner is appointed for each domain. A Data Steward is assigned to handle day-to-day quality and policy enforcement. Data Custodians (like DBAs) are identified for technical support.
3. **Define Policies** — Policies are drafted by the Data Governance Council or Data Owners. Examples include data classification (public/confidential), retention periods, and access rules. These policies are approved by executive leadership.
4. **Implement Controls and Tools** — Technical controls are put in place: role-based access in the database, data quality dashboards, metadata repositories, and encryption tools. Data stewards train users on the new policies.
5. **Monitor and Enforce** — Data stewards run regular data quality checks, review access logs, and investigate policy violations. The Data Governance Council meets quarterly to review metrics and resolve escalated issues.

## Comparisons

### Data Owner vs Data Steward

**Data Owner:**
- Senior executive with budget authority
- Accountable for a data domain
- Approves access and policy changes

**Data Steward:**
- Operational staff member
- Responsible for data quality day to day
- Implements policies and resolves issues

### Data Policy vs Data Procedure

**Data Policy:**
- Defines 'what' must be done
- Mandatory and organisation-wide
- Example: 'Encrypt all sensitive data'

**Data Procedure:**
- Defines 'how' to do it
- Step-by-step instructions
- Example: 'Run this script nightly using AES-256'

### Data Governance vs Data Management

**Data Governance:**
- Sets the rules and roles
- Strategic and policy-focused
- Accountability and oversight

**Data Management:**
- Executes the rules
- Operational and technical
- Database admin, ETL, data processing

### Data Custodian vs Data Steward

**Data Custodian:**
- Technical role (DBA, engineer)
- Manages systems and infrastructure
- Implements access controls and backups

**Data Steward:**
- Business role (analyst, manager)
- Manages data quality and standards
- Defines terms and resolves business issues

## Diagram

_The hierarchical structure of data governance roles, from executive sponsor down to data custodian, with policies defined by the council and enforced by the data steward and custodian._

```mermaid
flowchart TD
    A[Executive Sponsor] --> B[Data Governance Council]
    B --> C[Data Owner]
    C --> D[Data Steward]
    D --> E[Data Custodian]
    E --> F[(Databases & Systems)]
    B --> G[Define Policies]
    G --> H[Data Classification Policy]
    G --> I[Data Retention Policy]
    G --> J[Access Control Policy]
    D --> K[Monitor Data Quality]
    K --> L[Resolve Issues]
```

## Common misconceptions

- **Misconception:** Data governance is the same as data management. **Reality:** Data governance is the framework of policies and roles, while data management is the hands-on execution of those policies (like databases and data processing). Governance sets the rules; management follows them. (Because both terms involve 'data' and 'control', beginners merge them into one idea, but DA0-002 distinguishes them clearly.)
- **Misconception:** A data steward is a database administrator. **Reality:** A data steward focuses on business rules, data quality, and compliance, not technical infrastructure. A data custodian or DBA handles the technical side. (Because 'steward' sounds technical, but in governance it is a business role, which confuses beginners from IT backgrounds.)
- **Misconception:** Data governance is only needed for regulated industries like banking or healthcare. **Reality:** Any organisation that creates or uses data benefits from governance—it prevents errors, reduces duplicate work, and improves decision-making. Small businesses need it too. (Because beginners only associate 'governance' with rules and fines, not quality and efficiency benefits.)
- **Misconception:** Once you write a data policy, the work is done. **Reality:** Data governance requires ongoing monitoring, enforcement, and updates. Policies become outdated as regulations change and new data sources appear. (Because people assume governance is a one-off documentation exercise, whereas it is actually a continuous operational process.)

## Key takeaways

- Data governance is the framework of roles, policies, and processes that ensures data is managed as a valuable asset.
- The Data Owner is the senior executive accountable for a data domain, while the Data Steward operationalises quality and compliance.
- Data Custodians manage the technical environment (servers, backups, access controls) and support governance rules.
- Policies define what must be done (e.g., 'encrypt all sensitive data'), while procedures define how to do it.
- Data stewardship includes data profiling, cleansing, metadata management, and enforcing access controls.
- Role-based access control (RBAC) is a common way to enforce the principle of least privilege in governance.
- Without governance, data becomes inconsistent, insecure, and unreliable for decision-making.
- Data governance is an ongoing cycle, not a one-time project—it requires monitoring and regular reviews.

## FAQ

**What is the difference between a Data Owner and a Data Steward?**

A Data Owner is a senior executive with accountability for a data domain—they approve policies and access. A Data Steward is the operational person who ensures data quality and policy compliance day to day.

**Do I need to know COBIT or DAMA-DMBOK for DA0-002?**

Only at a high level. The exam expects you to know that these are data governance frameworks—standardised approaches—but you do not need to memorise their specific components.

**What is a data classification policy?**

A policy that labels data into categories (e.g., Public, Internal, Confidential) and defines how each category must be handled, including access levels and encryption requirements.

**Can one person be both Data Owner and Data Steward?**

Technically yes in small organisations, but DA0-002 expects separate roles. Data Owners are senior and set strategy; Data Stewards do the hands-on work. Separation provides checks and balances.

**What is the principle of least privilege?**

It means giving users only the minimum access they need to perform their job functions. This reduces the risk of data breaches and unauthorised changes.

**How is data governance different from data security?**

Data security is a subset of governance focused on protecting data from unauthorised access. Governance is broader—it includes policies, roles, quality, retention, and compliance, not just security.

## Check your understanding

1. **Which data governance role is held by a senior executive with accountability for a specific data domain?**

   Answer: Data Owner.

2. **What is the term for giving users only the minimum access they need to perform their job?**

   Answer: Principle of least privilege.

3. **A data steward finds that a customer table has 15% missing email addresses. Which data quality dimension is affected?**

   Answer: Completeness.

4. **What type of policy defines how long data must be kept before it is deleted or archived?**

   Answer: Data Retention Policy.

5. **Who would you contact if a database administrator accidentally gives a contractor access to financial records?**

   Answer: The Data Owner for the financial data domain.

---

Interactive version with quiz and diagrams: https://courseiva.com/learn/data-plus/governance-roles-and-policies