Data governance: roles, the rules behind it, catalog costs and why programs stall

What data governance covers: the core activities

The US Federal Data Strategy's Data Governance Playbook, published in July 2020, lists six activities.^8,9

• Data identification: find the data assets and build an inventory with metadata.⁹
• Data management policy: short statements of intent and basic rules for the creation, acquisition, privacy, integrity, security, quality and use of data.¹⁰
• Data issue management: a process to find and remove what stops data being used well.¹¹
• Data assessment: ways to measure the quality, utility and impact of data.¹²
• Data oversight: monitoring the data assets and the work done to improve them.¹³
• Data communications: channels that keep staff and managers informed.¹⁴

Data governance roles: owners, stewards and a council

The governance body goes by many names: Data Governance Board, Data Council, Data Strategy Team. In the federal model the agency head charters it and the Chief Data Officer chairs it.^15,16

The playbook asks for a written charter that formalizes roles. Each role should come with an agreed authority to set policies and procedures and to monitor compliance. Executives should get regular updates and hold members accountable for raising data maturity.^17,18,19

Data owners sit in both the business and IT. BCBS 239 asks banks to assign ownership and quality of risk data to both functions. Those owners, working with risk managers, should keep adequate controls in place across the data's lifecycle.^20,21

Stewards do the daily work of enforcement. A NIST glossary definition, drawn from CNSSI 4009-2022, says data stewards enforce policies while functional data managers implement them and manage day-to-day quality. Another definition there adds that stewards maintain data names, business definitions, integrity rules and domain values for a subject area.^22,23

Setting up the body is quick. The playbook says standing one up takes a few months, while working its recommendations into daily processes may take several years.²⁴

Data governance regulations: GDPR, CCPA, BCBS 239 and the EU AI Act

GDPR sets different fine ceilings by article. Infringing the basic principles in Article 5 can draw a fine of up to €20 million or 4% of worldwide annual turnover, whichever is higher. The controller and processor obligations, which include the Article 30 record, carry up to €10 million or 2%.^41,42

California's Attorney General calls the law "CCPA, as amended". The CPRA changed the CCPA rather than creating a separate law. The California Privacy Protection Agency's board adopted the risk assessment and cybersecurity audit rules on July 24, 2025.^31,33

BCBS 239 sets a high bar for risk data. Controls on it should match those on accounting data, and banks should work toward a single authoritative source for each type of risk.^43,44

The AI Act's Article 10 also sets a quality standard. Training, validation and testing data must be relevant, sufficiently representative, and as free of errors and as complete as possible for the intended purpose.⁴⁵

Data catalogs, metadata and data lineage

BCBS 239 spells out what a bank's data inventory must describe. It asks for integrated data taxonomies across the banking group, with metadata, single identifiers and unified naming conventions for legal entities, counterparties, customers and accounts.³⁶

Lineage answers where data came from. The AI Act requires providers of high-risk systems to cover data collection processes and the origin of data, and for personal data the original purpose of collection. GDPR's Article 30 record already lists the purposes of processing and the categories of personal data.^27,39

Platform defaults vary. Google keeps automatically captured lineage metadata for 30 days by default and bills it as metadata storage. Databricks says Unity Catalog provides automated column-level lineage. Snowflake lets every account create tags, but tag propagation and tag-based masking policies need Enterprise Edition or higher.^46,47,48

Supervisors find lineage still missing at large banks. The Basel Committee's November 2023 progress report says several banks lack a common taxonomy and complete data lineage, which makes it harder to harmonize systems and detect data defects.⁴⁹

What data governance tools cost: published prices

Cloud providers publish usage-based prices for their catalogs. Each meters a different unit: governed assets at Microsoft, compute hours at Google, requests and storage at Amazon.^50,51,52

Data quality costs and data governance results: the evidence

The Federal Reserve said Citigroup had also failed to put compensating controls in place to manage its ongoing risk. Its fine was $60.6 million, for violating a 2020 enforcement action.^62,64

Redman's estimate rests on research by Experian and two consultants. He puts the cost in people correcting errors, checking other sources and dealing with the mistakes that follow.^65,67

Why data governance programs fail

• Too little money and attention. The Basel Committee found bank adoption programs often underfunded, limited in scope and short of attention from boards and senior management.⁶⁸
• Timelines that ignore legacy IT. Several banks failed to assess how complex and interdependent the projects were, especially those addressing legacy IT systems, and set ambitious timelines.⁶⁹
• Grading your own work. Some banks considered themselves fully compliant, in some cases several cycles earlier, while still struggling with systemic data quality issues.⁷⁰
• Starting AI before the data is fit. The same report says many banks still lack quality data, which it calls a prerequisite for any digitalization project.⁷¹
• Ownership left below the board. The Committee says boards should take full responsibility for overseeing data governance frameworks, and banks should build a culture of ownership and accountability for data quality.⁷²
• Treating the council as the finish line. The federal playbook expects the body to take months to form and its work several years to embed.²⁴