One of the tenets of Data Governance is that enterprise data doesn’t “belong” to individuals. It is an asset that belongs to the enterprise. Still, it needs to be managed. Some organizations assign “owners” to data, while others shy away from the concept of data ownership. Let’s look at both approaches.
Approach #1: Assigning Data Ownership
This approach acknowledges that enterprise data is “owned” by the enterprise rather than individuals or silos within the enterprise. However, accountabilities for working with that data must be assigned to roles in the organization, and individuals (or teams) fill these roles. So it is often convenient to designate “Data Owners” (typically from business groups rather than technical teams) who help coordinate those accountabilities.
In some organizations, this approach is used for Compliance and Access Management purposes. Data Owners are given the right to decide who can have access to enterprise data. They are involved in a process that is something like this:
- – A person (staff member, contractor, partner, supplier, etc.) requests access to information
- – A business resource (the Data Owner, the person’s manager, etc.) gives the OK
- – A technical resource (usually a DBA) physically grants permission to an application, database, or other data store containing the data. Often, the permission follows a CRUD schema (create, read, update, delete)
Meanwhile,
A) This process is aligned with enterprise compliance and data management efforts (privacy, information lifecycle management, data retention, eSecurity, controls management, etc.), and
B) Request/permissions documentation is collected and retained to satisfy compliance and operational goals
In some organizations, this Access Management function is administered by Data Governance. More often, it is managed through Information Security, Compliance, Privacy, Risk Management, or other groups. Before you decide to use the term “Data Owner” in your Data Governance and Stewardship program (or Enterprise Information Management program), you should understand your organization’s approach to Access Management, whether it employs the concept of Data Owners, and what responsibilities they have.
If you do decide to employ the concept of Data Owners, it’s critical that you clearly define responsibilities for Data Owners versus those for Data Stewards. See more on Approaches to Assigning Data Ownership and Stewardship
Approach #2: Federated Responsibilities
Enterprise data, by its very nature, flows through an organization, touching many business and technical processes and being stored/moved/transformed by many IT systems. It can end up in uncounted numbers of reports, online displays, data feeds, and information products.
In small enterprises – or organizations with simple data flows – it may be possible to trace a type of data from creation/acquisition/collection through all its data flows. If so, it may be feasible to assign accountability for that data to an individual who would be responsible for ensuring that steps are taken to secure the data and to enforce quality rules and other types of data-related standards and rules.
However, this is not feasible for most large or complex enterprises. For them, the concept of Data Ownership may not be useful. Instead, they take another approach: federated data-related accountabilities.
In this approach, they first document data lineage (the path data has taken from its creation/acquisition to a specific system or report). Then they assign data-related accountabilities for a manageable number of segments to Data Stewards, SMEs, and/or Data Custodians (technical resources).
The federated accountabilities approach to stewardship brings several challenges:
- Documenting data lineage / data flows can be hard work. What do you do if this hasn’t been finished? Sometimes you have to assign accountabilities first – and these include researching lineage.
- Assigning accountabilities may be difficult (just as it can be difficult to assign Data Stewardship accountabilities in general). If these accountabilities are in addition to other responsibilities, resources can feel over-burdened.
- Managing and coordinating the responsibilities of groups of responsible parties takes time and effort. You’ll need documents to map roles & responsibilities to data.
- Designating a “point person” (a Data Owner, Data Steward, or other resource) may become necessary. This person would need to be familiar with data flows, would need to be able to discover who is assigned responsibilities for each segment of that flow, and would need to be able and willing to involve those resources in research, issue resolution, and impact analysis.
The federated accountabilities approach to data stewardship has a disadvantage: it’s more complex. But it also has a significant advantage: it works.
