Data governance: from by-product to managed asset

What is data governance?

Data governance is the organisational grip on your data: you have explicitly assigned who owns it, what quality is required, who has access and how long you retain it. It is not a technical matter to throw over the fence to IT, but a management choice. Data is no longer an administrative left-over — it is the raw material on which your services, your accountability and your AI applications all run.

Where information security is about protection and data sovereignty is about where your data lands, governance asks a different question: who actually governs our data, and on what basis?

Governance is two-sided: the individual at the wheel too

Data governance has two sides. One is the organisation steering its own data. The other is the individual — the citizen, the customer, the applicant — who should have control over their own data in your systems. The GDPR gives people concrete rights for this: access to what you record, rectification of what is wrong, erasure, data portability and objection to certain uses.

In the public sector this goes a step further. Under the banner of 'citizen control over data', government is working towards people deciding for themselves with whom they share their data, rather than agencies exchanging it unnoticed. That shifts the say to the person it concerns.

Those rights come with a mirror obligation for you. You may not simply record data: the GDPR requires purpose limitation. You explicitly record for which purpose you process data, and that purpose must fit your core task or a legal basis. What you do not need for that task, you should not store or process. Governance therefore starts with the question: why do we actually hold this data, and are we allowed to?

The same applies at the other end. There are strict limits on how long you may use and keep data. The GDPR requires that you retain it no longer than necessary; at the same time the Archives Act and its retention schedules determine which government data you must keep for a set period, or even archive permanently. The two can be in tension, and data governance means knowing those periods and actively steering on them — so that you do not keep too much, but also destroy nothing you are legally required to preserve.

The two sides are connected. You can only offer someone fast and accurate access, correction or erasure if you internally know which data you hold about them and where it sits. Without internal governance, the individual's right remains a paper promise. The governance we describe below is exactly what you need to make those rights real in practice.

Data without governance is a creeping risk

Without governance, shadow data emerges: spreadsheets on a network drive, exports no one cleans up, records where it is unclear who maintains them. As long as things go well, it goes unnoticed. But the moment a data breach, a privacy request or an audit arrives, no one can say which data sits where, and why.

The consequence is twofold. You run a compliance risk — you cannot account for your processing — and you are unknowingly building on unreliable ground. Every report, every dashboard and every AI model you place on top inherits the mess underneath.

Start with ownership

The heart of governance is ownership. Every important data set should have a single responsible person — a data owner who decides on quality, access and use. That is deliberately not an IT role, but someone from the process itself: the person who knows the data and feels the consequences of errors.

A perspective from the commercial world helps here. In businesses, data has long been an asset with an owner and a business value; in the public sector it is more often a compliance topic. Combining those two worlds — ownership and diligence — produces data that is both reliable and responsible.

Know your data: register and classification

You cannot govern what you cannot see. A simple data register — which data do we have, where does it sit, who owns it, how sensitive is it — is the backbone of governance. Pair it with classification: not all data deserves the same protection, but you do need to know which category requires extra care.

That register is not an end in itself. It is the instrument with which you arrange information security, privacy and access in a targeted way, instead of firing blind. How this connects to the Dutch BIO, ENSIA and NIS2 frameworks is something we set out in our information security compass.

Quality: complete, correct and current

Governance stands or falls on the quality of your data. Three properties determine whether you can build on it: is it complete (is anything essential missing?), correct (is what it says accurate?) and current (does it reflect today's situation, not that of two years ago?). If you do not guard those three, you make decisions — and train AI models — on shaky ground.

Quality is cheapest to safeguard at the source: clear definitions, input validation and a single place where a data point is the truth. A lifecycle belongs to it — data is created, changes, ages and should at some point be cleaned up or destroyed. Without agreements on quality at the source and retention periods at the end, the mess piles up. Whoever governs completeness, correctness and currency lays the foundation on which automation and AI can work at all.

The public-sector reality: replication from national facilities

In the public sector a stubborn practical problem plays out. A great deal of data is unlocked from national facilities and base registrations — think of the Dutch BRP (persons), BAG (addresses and buildings), the Commercial Register or the WOZ (property valuation) — and then replicated into local systems. Every change at the source arrives as a stream of messages that has to be processed. In practice this still costs organisations a lot of manual effort: staff who monitor the message traffic, check mutations and reconcile differences between source and copy.

This is exactly where governance proves its worth. Whoever explicitly knows which registration is the source and which is a replica, who guards the currency of those copies and automates the mutation processing as far as possible, gains two things at once: less manual work and more reliable data. In the government context, data governance therefore also means getting a grip on the data flows between the national facilities and your own systems, instead of endlessly assigning more people to them.

Assurance and challenge: the Privacy Officer and CISO

Governance that exists only on paper is not governance. You need people who test the policy and organise challenge. The Data Protection Officer (privacy officer) and the CISO fill that role — and work in two directions.

Internally they test the policy you have formulated: is privacy by design and security by design genuinely built in, or does it only exist in a document? The DPO has an independent, legally anchored position; the CISO guards the information-security policy and its alignment with frameworks such as the BIO. Externally they are the anchor for auditing and assessment: the ENSIA accountability report, supervision under NIS2, the Data Protection Authority and the auditor. That is how you make governance not just workable, but demonstrable — for yourself and for those entitled to hold you to account.

The tooling has to mature

One uncomfortable truth belongs in this story: much existing software cannot yet do this on its own. Guarding data quality, keeping replicas in sync, handling individuals' rights, demonstrating who can access what — it rarely works without a disproportionate amount of human effort. The burden thus falls on the organisation, and on the people who wrestle with it day after day.

That is no reason to wait, but it is a call to the market. Software vendors will have to build these governance functions in further, so that control over data does not become the privilege of organisations with a large team, but is achievable and accessible for everyone. Until then, it helps to choose deliberately which steps you already take yourself, and where you automate smartly instead of repairing by hand. That is exactly where we like to think along — from the practice of everyday data processing, not from theory.

Governance is the precondition for both AI and sovereignty

The two big themes of the moment — AI and data sovereignty — both lean on governance. You can only deploy AI responsibly if you know which data goes in, whether it is correct and whether it may come out. And you can only make sovereign choices about where your data lands once you actually know which data you hold and how sensitive it is.

Data governance is therefore not a stand-alone project, but the layer on which information security, AI governance and sovereignty come together.

How to tackle data governance in practice

Start small and concrete. Pick one core registration that truly matters, appoint an owner for it, and record what quality you expect and who has access. Map your most important data sets in a simple register and classify them by sensitivity. Determine which data is a replica from a national facility and how you guard its currency. Agree how you handle individuals' rights, and have the DPO and CISO review both policy and practice.

You do not have to get your entire information landscape in order in one go. Governance grows by asking the same question of every new registration, every dashboard and every AI application: whose data is this, is it correct, and is this allowed? It is exactly at that intersection of business ownership and public diligence that we work as DWDA. Want to know where your organisation stands? Take our free maturity scan, or use our entry-level vouchers to deliver a first analysis at a fixed price. Feel free to get in touch — and together we will find where you can take back control fastest.