HOW TO IMPLEMENT DATA GOVERNANCE

Data governance is a business practice of protecting and making the best use of data in an organization. The goal is to mintage the risk and maximizes the value of the corporate data asset. Data governance implements how organizations gather, analyze and use data as a strategic asset to fulfill their missions. The methods should include the data-related activities' guidelines, practice, and auditing process. 

Data Governance Strategy should

• Start with setting up the effort's vision, policy, and priority.
• Perform an assessment of the maturity of data management, which includes data identification and data management rules for the creation, acquisition, privacy, integrity, security, quality, and usage. 
• Establish practices after the assessment, so the implementation has the minimum impact on the current business workflow and leads to moderate organizational change management. The typical arrangement includes metadata management, data cataloging, auditing, and tools to automate and simplify the operation. 
• Create a collaborative culture of data management and sharing. It's essential to create a knowledge base and create data champions committed by subject experts who advocate data and facilitate data usage. 

Data governance strategy execution requires extensive collaboration with stakeholders and influencing the team to adopt the process and standard. 

Data Privacy is about adhering to privacy regulations. The regulations are typically interpreted by the legal team. They give suggestions to each business unity as privacy initiatives that drive the changes needed to comply with the new regulation requirements. The practices include the following major areas.

• (Level1) PII classification (ICM): the data catalog has to be created with explicit PII classification. The PII data should be layers related to the importance of Privacy protection.
  • Action: Implement Metadata Management with all data registered and classified per PII classification. The classification should have auto-discovery and data lineage functionality the automate the process. 
• (Level 2) GDPR compliant (Global Data Privacy Regulation)/California Consumer Privacy Act (CCPA) includes GDPR Pseudonymization, GDPR Nullification, and GDPR Delete. 
  • Action: create a service (generally as a web service with HTTP endpoints) that can generate new PseudoIDs per new user account creation from IDMS, keep the mapping for PseudoIDs lookups, and receive request mapping PseudoIDs during the ETL process for DW data loading. The services are critical for all business transactions, so High availability (HA) has to be set up. 
• (Level 3) Data Lifecycle Management includes data creation, access, and deletion policy (active, delete, mark for delete, and restricted). 
  • Action: Create tools for data governance practices for data creations 
  • Action: Create rules and an engine to implement a data retention policy. 
  • Action: Create a rules engine and report for user data access management and auditing. 
• (Level 4) A Scorecard and Operation dashboard are required to measure the progress and operation demands for privacy practices. ​

Data Privacy Best Practices: Start with minimum requirements and then expand. Create an operational report and privacy scorecard to monitor the process and compliance status. ​

References

1. Federal Data Strategy, Data Governance Playbook, July 2020