Data governance: what it is, what leadership decides and how to start

The scene repeats in many boardrooms: sales presents one revenue figure, finance another, and the next twenty minutes go to arguing which one is true instead of what to do about it. The problem isn't the dashboard or the system: no one decided which source the official figure comes from or who answers for it.

This guide explains what data governance is, what the international standard says about the role of governing bodies, how it differs from data quality and data management, what leadership must decide and how to start without a year-long project.

What is data governance?

Data governance is the set of decisions and rules that define who owns each data set, which system its official version comes from, which quality rules apply when it is captured and transformed, who may use it and for what. It is not a tool or a cleanup project: it is the decision structure that keeps the cleanup from having to be repeated every year.

ISO/IEC 38505-1:2026, Information technology — Governance of data — Part 1, published in August 2026 in its second edition, defines the governance of data as a subset or domain of the governance of IT, which is itself a subset of organizational or corporate governance. In other words: governing data is a responsibility of the company's governance, not only of the IT department.

What does ISO/IEC 38505-1 say about the role of leadership?

According to its official abstract, the standard provides principles for governing bodies of organizations — owners, directors, partners, executive managers or similar — on the effective, efficient and acceptable use of data, by applying the governance principles and model of ISO/IEC 38500 to the governance of data, assuring stakeholders and informing and guiding governing bodies in the use and protection of data.

It applies to the governance of the current and future use of data created, collected, stored, secured, protected or controlled by IT systems, and to organizations of all sizes regardless of how much they depend on data. It also guides executive managers, external specialists, service providers (including consultants) and auditors.

If the standard addresses data governance to owners and directors, the question for leadership isn't which tool to buy, but which decisions are theirs.

What is the difference between data governance, data management and data quality?

Three things that get mixed up are worth separating. Data governance decides: owners, official version, rules and who may use what. Data management executes: it captures, integrates, stores, protects and delivers data according to those rules; the DAMA-DMBOK, published by DAMA International, is the recognized reference framework for that management. Data quality is an outcome: completeness, uniqueness, validity and consistency of the data that management produces under the rules governance defined.

When a company 'cleans the CRM' every year and the duplicates come back, what's missing isn't more cleaning: it's governance. No one decided who owns the customer record or which rule prevents creating a customer that already exists.

Does every department have its own right number?

We define owners, the official version and quality and access rules on the systems already in production, and the data controls AI may and may not touch.

• Governance model: domains, owners and committee
• Catalog of critical data with its lineage

Learn about data governance consulting

What must leadership decide?

Five decisions, in our view, cannot be delegated to the IT department:

Domains and owners: which data domains exist (customers, products, suppliers, finance, people) and who answers for each, by name.

Official version: which system the figure the board sees comes from — sales from the CRM or the ERP, inventory from the ERP or the WMS — and why.

Minimum rules: which fields are mandatory, what prevents duplicates, who validates a change to master data.

Access and use: who may view, change and export each domain, and which data stays out of reach of any artificial intelligence model.

Review: how often the catalog is reviewed, who measures quality and whom it is reported to.

How do you start with data governance, step by step?

1. Choose two or three critical domains, not all of them. Customers and products are usually the starting point in our projects, because they live in the CRM and the ERP and feed sales, invoicing and inventory.

2. Run a short assessment: which systems generate that data, where it is duplicated (spreadsheets included) and which figures don't reconcile between departments.

3. Name an owner per domain and define the official version. It's the decision that prevents the most arguments later.

4. Write the minimum capture, deduplication and access rules, and enforce them in the systems that already exist: mandatory fields, validations and duplicate detection in the CRM and the ERP.

5. Build the catalog of critical data and its lineage: where every indicator the board sees comes from.

6. Define the controls for AI: which data a model may use, which it may not, and with what traceability. This is the bridge to AI governance.

7. Measure and review: duplicates, empty fields, figures that reconcile. Without measurement, rules loosen within months.

Ordered data is the foundation of AI governance

A model is only auditable if it is known which data it used and who answered for its quality. We work on both governances together.

• Data controls for AI integrated into the framework
• Adoption plan so the rules keep being followed

Talk to our team

Do you need a data governance tool?

Not at first. Capture, deduplication and access rules are enforced first in the CRM and ERP that already exist. A catalog or data quality tool is evaluated later, once owners and rules are defined, and with the same vendor-independent criteria used in any software selection. Buying the tool before naming the owners is, in our view, the fastest way to get a catalog nobody maintains.

How does it relate to AI governance?

Data governance is the foundation of AI governance. A model is only auditable if it is known which data it used, where it came from and who answered for its quality; and it is only safe if it is written down which data it may not touch. That is why data controls for AI are defined within data governance and integrated into the AI governance framework, not as a separate project.

How we can help

At Cyrrus we provide data governance consulting: data assessment, governance model (domains, owners, committee), quality and access policies enforced in the systems that already exist, a catalog of critical data with its lineage and the data controls for AI, with an adoption plan so the rules keep being followed after we step back.

To prepare leadership, Leadership Academy offers the data governance for executives workshop. If the starting point is the CRM, read how Dynamics 365 and HubSpot detect duplicates and which rules leadership must define.

To go deeper into related topics: what AI governance is and which frameworks to use, and what IT strategy is.