Data Governance as the Key to Implementing GDPR

Internal and external pressures have sharply increased interest in formal methods for managing enterprise data. Consistent implementation, by contrast, has progressed comparatively slowly. A study conducted by erwin, Inc. in 2017 examined the challenges of introducing enterprise-wide data governance and the state of the market at the time.

Online Survey on Data Governance

Data governance is the systematic management of an organization's complete data estate with respect to quality, security, and traceability. In addition to supporting regulatory compliance, it can increase transparency and improve decision-making.

Working with UBM, erwin conducted an online survey of leading North American organizations in November 2017. Participants included CIOs, CTOs, IT professionals, and consultants from more than 20 industries. The survey found very strong cross-industry interest in data governance, while only some organizations had already implemented an initiative. The principal challenges included insufficient organizational support, inadequate budgets, and a lack of understanding of suitable implementation approaches.

For 98 percent of respondents, data governance was exceptionally important to their organization. At the same time, 46 percent reported having no formal governance strategy. The gap showed that the relevance of the topic was understood, but implementation was far from straightforward.

Drivers of Data Governance Initiatives

The strongest driver was compliance, especially the European Union's General Data Protection Regulation (GDPR). Sixty percent of participants cited it as the primary reason for their interest in data governance. Forty-nine percent expected higher customer satisfaction, and 45 percent considered better decision-making an important motivation.

The study also examined obstacles. Four in ten respondents said that they understood the importance of appropriate measures but lacked sufficient funding to implement them. Limited knowledge of how to introduce and operate an enterprise-wide governance strategy was another important factor.

Connecting Data Governance and GDPR

New regulation increases the pressure to act. Organizations that conduct business involving people in the European Union must account for the applicable privacy requirements. These include the ability to provide information about collected personal data, delete data promptly in response to a valid request, and document its processing path.

Those obligations can be met reliably only when data management is treated as a strategic objective and coordinated across the departments involved. A data governance initiative combines ownership, processes, and technical controls in a traceable framework.

The study findings at the time showed that many international organizations still lacked a functioning solution for comprehensive data management despite recognizing its importance. In addition to limited funding, a lack of understanding of the appropriate approach was a major reason.

Recommendations

Four fundamental recommendations follow from the challenges identified:

1. Define data governance as a strategic corporate objective and secure full management support.
2. Assign responsibilities and prepare a budget and timeline that account for everyone involved.
3. Treat GDPR and its national implementations as binding constraints.
4. Communicate the risks and benefits of data retention, along with expectations and responsibilities, transparently throughout the organization.

The original article linked to the complete “2018 State of Data Governance Report.” That historical download no longer resolves unambiguously to the study, so it has not been presented as a current link here.