Introduction

This chapter explains how data governance can help and not hinder the business; in fact, how data governance can drive innovation. The elements of good data governance are outlined, and how good data assurance can keep the data strategy and business on track.

Data governance and data protection

Data governance is one of the pillars of a data strategy and a large part of the CDO's task and responsibilities. Why are we singling out data governance in particular for its own chapter in this book, and not master data management, metadata or some other core deliverable in a data strategy?

The answer is twofold. First, it could be argued that data governance is the underpinning principle of any data capability: it is fundamental to the work of a CDO. Second, the introduction of GDPR in May 2018 brought data governance into sharp focus, and the role of the Data Protection Officer (DPO) within organisations is worth some examination in relation to the CDO; as the legislation has become more embedded, so the role has evolved and become more understood. So, the first reason for examining the CDO's role in data governance is the importance of the business outcomes that effective data governance provides and the second reason is regulatory pressures.

In fact, since the first edition of this book more countries are taking the regulation of data protection much more seriously. Various African nations have introduced (or are reviewing) amendments to their 2004 law on the protection of personal data which strengthen the rights of the individual with regard to their data. US states such as California, with ‘the California Consumer Privacy Act’, seek to establish an enforceable right of privacy. Canada has also reviewed and changed some of its privacy regulations, and the list goes on.

Not only have regulations been updated (and tightened) but they are also, in our opinion, being taken much more seriously. Equifax agreed to pay a fine of $575 million because not only did they fail to fix a critical vulnerability months after a patch had been issued, but they then failed to inform the public of the breach for weeks after it had been discovered.