My data governance framework

Published in

ZS Associates

13 min readMar 24, 2025

Over the past 10+ years, I’ve had the opportunity to author or contribute to over 100 data governance strategies and frameworks across various industries. While every organization has its unique challenges, I’ve found that a specific common framework consistently served as an effective starting point for implementing data governance.

Establishing a clear framework early on is critical. It clarifies what data governance is and what it is not, helping to avoid confusion, set expectations, and drive adoption. A well-structured framework provides a simple, repeatable visual that you can use over and over again to explain data governance and how you plan to implement it across the organization.

In this article, I’ll break down the five essential components of my personal framework, providing a practical approach that can work for any organization, in any sector.

Strategy

A well-defined strategy is the foundation of any successful data governance initiative. It establishes the purpose, direction, and priorities of governance efforts, ensuring alignment with business objectives. Without a clear strategy, data governance initiatives will be become fragmented and reactive.

Mission, vision and overall strategy. This subcomponent defines why data governance is necessary, what it aims to achieve, and how it will be implemented. The mission articulates the core purpose of governance, such as ensuring data integrity, compliance, and value creation. The vision provides a long-term outlook, describing the desired state of data governance within the organization. The overall strategy outlines the approach and guiding principles for embedding governance into business operations.
Objectives and goals. To drive meaningful outcomes, data governance must be linked to measurable objectives. This includes setting specific, quantifiable targets such as improving data quality scores by a certain percentage, reducing compliance risks, or increasing metadata adoption. Clear objectives ensure accountability and enable organizations to track progress, demonstrate value, and continuously refine their governance efforts.

Capability areas

To effectively implement data governance, organizations must develop a set of core capability areas that address the policies, processes, and structures necessary for managing data. These capability areas serve as the building blocks of governance, ensuring that all critical aspects — ranging from data quality to security — are covered. A well-defined set of capabilities ensures that governance efforts are mutually exclusive and collectively exhaustive (MECE), avoiding gaps or redundancies.

Policies, standards and compliance. Governance starts with well-defined policies and standards that establish rules, guidelines, and compliance requirements for managing data across the organization. Policies define what must be done — setting expectations around topics like data access, quality, and protection — while standards define how those expectations are implemented through specific procedures or thresholds. Crucially, governance must also include the ability to evidence compliance with these policies and standards through monitoring, reporting, and audit mechanisms, ensuring accountability and regulatory alignment.
Data governance. It may seem a little strange to have “data governance” as a capability within a data governance framework, but it serves a unique and foundational purpose. This capability is what defines and operationalizes roles, responsibilities, and accountability across the entire governance model. It provides the organizational scaffolding that supports all other capabilities, clarifying who is responsible for which decisions and activities, how ownership is assigned, and how governance activities are coordinated across business and IT. This includes defining data owners, stewards, domain leads, escalation paths, and governance forums.
Metadata & cataloguing. Metadata — the data about data — is essential for understanding, organizing, and governing information assets. This capability combines metadata management with data catalog and discovery tools to provide a centralized inventory of data assets, including business definitions, technical metadata, and data lineage. Metadata management also involves defining minimum metadata standards, establishing what metadata must be captured and maintained, and where. A data catalog builds on this foundation by making metadata searchable and accessible, enabling users to find, understand, and trust the data they work with. This drives transparency and data democratization, allowing more users across the organization to access the data they need.
Data architecture. This article is about a data governance framework, not an enterprise architecture or solution architecture framework. As such, the role of data architecture here is specifically limited to those aspects that intersect with data governance. This includes ensuring that, through change programs, solution design processes, and architectural governance mechanisms, the right data governance controls and considerations are embedded early in the lifecycle of new systems, data flows, and processes. This alignment is critical because the return on investment for data governance is significantly higher when implemented during the design phase, rather than retrofitting governance controls after systems have been built and deployed. In this way, data architecture becomes an enabler of sustainable, policy-aligned data management across the enterprise.
Data quality management. High-quality data is the foundation of reliable analytics, AI, regulatory reporting, and day-to-day business operations. This capability encompasses a range of activities that ensure data is fit for purpose, and it can typically be broken down into several distinct areas. First, it begins with understanding the data and articulating clear business requirements — what data is needed, at what level of accuracy, timeliness, or completeness, and for what purpose. Once these requirements are established, organizations can ensure that the right data quality controls are embedded into operational processes to prevent issues at the source (e.g., validation rules in forms or automated checks in data pipelines). A separate but closely related capability focuses on the measurement of data quality itself, using defined metrics and profiling techniques to evaluate data against the business requirements. In addition, a data quality capability can include issue management: a structured process for identifying, documenting, tracking, and remediating data issues. This enables organizations to not only react to data problems but also to analyze root causes and implement lasting improvements, ensuring data remains trustworthy over time.
Master & reference data. Master and reference data management governs the core business data entities (e.g., customers, products, suppliers) to eliminate duplication, improve consistency, and enable a single source of truth. In many organizations, this capability is supported by a Master Data Management (MDM) platform. An MDM platform provides centralized workflows, golden record creation, data matching, and synchronization across systems. It plays a critical role in ensuring data consistency, integrity, and accuracy, particularly for enterprise-wide reporting and transaction processing.
Data security. Data security ensures that sensitive, critical, and regulated data is protected from unauthorized access, misuse, or exposure, in accordance with governance policies and data classification schemes. This includes implementing and monitoring role-based access controls, encryption, tokenization, masking, secure data transfer protocols, and segregation of duties. Effective data security governance also ensures that security measures align with approved data usage policies and are routinely tested and evidenced through compliance checks and risk assessments.
Ethics & privacy. Technically, this area could be interpreted as falling under Policies, Standards, and Compliance, since many ethical and privacy requirements are ultimately governed through formal policy. However, it is often worth calling out separately because of its growing relevance and visibility — especially with the rise of AI, algorithmic decision-making, and increased regulatory scrutiny. This capability focuses on ensuring responsible, fair, and transparent use of data by defining ethical principles, privacy practices, consent management processes, and personal data protection strategies. Given how central trust and accountability have become in data-driven organizations, treating Ethics & Privacy as a distinct capability helps ensure it receives the visibility, ownership, and resourcing it requires.
Data literacy & culture. Governance is not— or should not be — only about control. It’s also about empowering people to use data effectively and responsibly. This capability promotes data literacy by equipping business and technical users with the training, knowledge, and tools they need to interpret, trust, and act on data. It includes awareness campaigns, educational resources, best practices, and self-service support to foster a data-driven culture across the organization.

Tailoring the framework

The capability areas outlined above have proven to be a good starting point in every engagement I’ve been part of. But each organization has its own context, operating model, priorities, and history, and as a result, I often spend significant time with client organizations refining this list to best fit their unique situation. Below are some of the most common dimensions along which the capability model is adapted:

Data Security and Data Architecture are sometimes not called out explicitly as part of the data governance capability framework. In many organizations, they are viewed as the responsibility of the IT or technology function, and governance considerations are assumed to be embedded within broader architecture and security governance processes.
Data Literacy is sometimes renamed or reframed, referring to it as change management, data enablement, data evangelization, or data championing. In all cases, the underlying purpose, which is to empower users and fostering a data-driven culture, remains very similar.
Ethics & Privacy are sometimes fully embedded within the broader “Policies, Standards, and Compliance” capability, particularly when ethical and privacy principles are already formally codified through policy instruments. In these cases, the focus is on understanding relevant regulatory requirements (e.g., GDPR, HIPAA, or AI-related laws), translating them into actionable policies and standards, and then driving compliance through governance structures, training, and oversight mechanisms.
Some organizations express interest in calling out AI or analytics enablement as a separate capability, or the governance of them (“AI governance”). Personally, I find that most of what’s required to enable trustworthy analytics and AI can and should be handled through the existing capabilities. However, a small number of organizations I worked with opted to treat this as a separate capability, especially when governance over AI/ML models is a current priority.

Implementation (adoption & execution)

While the strategy and capability areas of data governance are largely universal, the implementation of governance can vary significantly across organizations, industries, and regulatory environments. This component focuses on how governance is structured, embedded, and operationalized within an organization. It is about how you “do” the governance — how you drive execution on the ground.

This part of the framework is somewhat unique to my personal view on data governance. While most organizations define governance through a list of capabilities or pillars, they stop short of integrating how governance is actually implemented. I deliberately include it as part of the core framework, because I believe that without a clear path to execution and adoption, governance risks remaining theoretical. Embedding implementation directly into the framework reinforces that governance must be actionable, lived, and embedded in day-to-day operations — not just a set of good intentions.

How you think about implementation may vary, but I typically call out two key components: roles and domains. Defining roles (like data owners or stewards) helps clarify who is responsible for what and ensures consistency across the organization. Defining domains (such as customer, product, or finance data) helps structure governance around logical business groupings. Together, these components enable a domain-driven approach to data governance — which means embedding governance responsibilities within the business areas that know the data best, and executing governance in context, not in isolation.

Key roles & responsibilities

Ownership and accountability can be clarified through a defined set of roles. While there are many roles involved in data governance, the ones below represent some of the most important ones that are commonly repeated across data domains:

Domain owners. Responsible for overseeing governance within a specific business domain, such as customer data, finance, or product. They help prioritize efforts, ensure alignment with business goals, and are accountable for the success of governance within their domain.
Data owners. Accountable for the quality, security, and lifecycle of specific data (or data sets). They make decisions about data usage, access, and critical governance requirements.
Data stewards. Typically work on behalf of data or domain owners, performing much of the day-to-day work involved in data governance. This includes enforcing standards, maintaining metadata, supporting data quality initiatives, and coordinating issue resolution.
System owners. Responsible for the technical systems and platforms where data is stored, processed, or shared. They ensure that governance requirements are built into the architecture, controls, and access layers of these systems.
Business process owners. Ensure that governance policies and data standards are integrated into the business processes that collect, create, or modify data. They help embed governance into operational workflows and process design.

Data domains

Governance can be applied within meaningful business contexts, known as data domains. These domains define logical groupings of data based on how it is used within the organization. While the specific domains will differ based on industry (hence, this part of the framework is necessarily custom), the following examples illustrate how a retail company might structure its data domains:

Customer — Information about individuals or organizations who buy or use your products or services.
Product — Details about the goods or services offered, including structure, pricing, and descriptions.
Supplier — Information about vendors, their contracts, and how they perform.
Financial — Records of income, expenses, budgets, and other financial transactions.
Employee — Information about staff, including roles, compensation, and HR history.
Sales — Data on purchases, transactions, and revenue-generating activities.
Inventory & supply chain — Tracks stock levels, product movement, and delivery processes.
Marketing & campaigns — Captures campaign activity, ad spend, and targeting strategies.
Compliance & regulatory — Data used to meet legal, audit, and regulatory obligations.
Digital & web analytics — Measures how users interact with digital platforms and websites.

Technology enablement

Technology plays a crucial role in making data governance practical and scalable. While these technologies align with the key capability areas of data governance, they do not map 1:1, as many capabilities are supported by broader tech stacks or integrated solutions. Additionally, the way organizations structure and deploy these technologies can vary significantly depending on their size, industry, and data maturity.

That said, in most cases, data governance-related technology can be grouped into the following key categories.

Data stewardship platform. These platforms enable organizations to define and manage data ownership, stewardship responsibilities, workflows, and approvals, as well as facilitate governance operations like issue logging, data change requests, and attestation. Increasingly, they also support workflow-based issue management, allowing organizations to assign, track, and resolve data governance issues across teams. These tools serve as a backbone for making governance actionable and visible across domains.
Examples: Collibra, Informatica Axon, Alation Stewardship Workbench
Data quality. Ensuring high-quality data requires specialized monitoring, profiling, cleansing, and remediation tools. These solutions identify inconsistencies, missing values, and errors, allowing teams to fix data issues in real-time and enforce data quality standards across systems.
Examples: Informatica Data Quality, Talend, Ataccama ONE
Data catalog & observability. Data catalogs provide a central inventory of data assets, combining metadata, lineage, and business definitions to enhance data discovery and transparency. Increasingly, catalogs are paired with data observability tools to monitor data health, freshness, and behavior in real time. Some tools also offer automated data scanning and classification across the data landscape.
Examples: Alation, Collibra, BigID
Master data management. MDM platforms are essential for governing core business entities such as customers, products, and suppliers. These tools support data matching, golden record creation, validation workflows, and synchronization of master data across systems. They are key to enabling enterprise-wide consistency, de-duplication, and a single source of truth for key data domains.
Examples: Informatica MDM, Reltio
Data security solutions. This category includes tools that manage access control, encryption, masking, tokenization, and secure data transmission. It also supports data access request workflows, ensuring that only authorized users can access sensitive or classified data based on governance policies and data classifications.
Examples: Immuta, Privacera, Microsoft Purview Data Security
Ethics, privacy & compliance monitoring. These tools support the enforcement and monitoring of ethical data use, privacy regulations (e.g., GDPR, HIPAA), and internal policies. They provide capabilities for data subject rights management, consent tracking, audit trails, and usage monitoring, which are critical for building trust and meeting regulatory obligations.
Examples: BigID, OneTrust, Collibra Protect

When creating this part of the framework, you can substitute the generic categories with the actual tools and platforms you are using, such as listing Collibra instead of “data stewardship platform” or Informatica Data Quality instead of “data quality tools.” This provides a more tangible, organization-specific view of how specific technology is enabling key capabilities.

Governance of data governance

For data governance to work, it needs clear coordination, ongoing oversight, and steady progress. That’s what the governance of data governance is all about — making sure the rest of the framework actually gets done. It brings structure to how all the parts work together and holds people accountable.

Policies & standards

Policies and standards are the foundation of data governance. They define the rules, expectations, and responsibilities, like traffic laws do on the road. Everything else in the framework points back to them. Policies set the direction, and standards make it real:

A policy says what must be done. It’s a clear rule, like “customer data must be protected.”
A standard says how to do it. It gives the details, like “encrypt customer data and keep it for 3 years.”

Governance forums

Governance forums provide the necessary oversight, coordination, and decision-making structures for data governance. While the specific forums depend on the organization’s structure and governance needs, common types include:

Enterprise data governance council. A central body that sets strategic direction, resolves cross-functional issues, and ensures governance alignment with business objectives.
Domain-specific data governance forums. Groups that oversee governance within specific data domains (e.g., customer, finance, product), ensuring domain-level policies are implemented while escalating critical issues to the enterprise level.
Regional or business unit governance forums. In global or decentralized organizations, data governance may be structured along regional, business unit, or divisional lines to account for local requirements, regulatory variations, and operational needs.
Capability-specific working groups. Some organizations establish governance groups focused on specific capabilities, such as data quality, metadata management, data security, or data ethics, to drive best practices and technical implementation.

Metrics & performance measurement

To demonstrate the effectiveness and impact of data governance, organizations must track key performance indicators (KPIs) such as data quality scores, policy adherence rates, governance issue resolution times, and metadata adoption. These metrics help justify investments, identify gaps, and drive continuous improvement.

Change management

For governance to be truly embedded, you can drive awareness, adoption, and behavioral change, for example through training programs, communication strategies, and engagement initiatives.

Closure

A strong data governance framework provides clarity, structure, and a repeatable, scalable approach to governing data. While every company’s governance journey is unique, the framework presented in this article serves as a proven starting point — one that can be tailored to fit any industry, any organization, and any level of data maturity.

The key is to establish it early, communicate it clearly, and embed it deeply.

Good luck!