Data governance in digital transformation

SECTION 1

Introduction

Data governance is an essential part of a company's data management strategy: it ensures that data is accurate, reliable and used ethically. It is a pillar of digital transformation, because it guarantees the availability, integrity and security of the data that fuels digital initiatives.

In concrete terms, data governance refers to the overall management of the availability, usability, integrity and security of the data used in the organisation. It establishes frameworks to collect, store, use and share data in line with the organisation goals and policies.

Long confined to IT departments, data governance has become an executive-committee topic. Two forces explain this rise: European regulatory pressure, which has thickened considerably since the GDPR, and the widespread adoption of artificial intelligence, whose results are only as good as the data that feeds it. A generative AI initiative built on poorly catalogued, poorly qualified or poorly protected data does not just produce bad answers: it exposes the company to very real legal and reputational risks.

SECTION 2

The components of effective governance

### The four pillars: policies, processes, roles and tooling

Effective governance rests on four components. Governance policies set the rules framing the collection, storage, use and sharing of data. Processes define the concrete steps that ensure those policies are followed. Roles and responsibilities designate the people in charge of implementation, data stewards, data owners and governance committees.

Those roles deserve to be spelled out, because this is where many initiatives fail. The data owner, usually a business leader, is accountable for the quality and use of a data domain. The data steward handles its day-to-day management: documentation, quality rules, arbitration on definitions. The governance committee, finally, settles cross-cutting questions, shared reference data, investment priorities, conflicts between domains. Without this clearly established chain of accountability, policies remain documents that nobody applies.

### What policies and tooling actually cover

The fourth component gathers the dedicated technologies: data catalogues, metadata management systems and governance software. A governance policy typically covers data security, the privacy of customer and employee information, access and usage rules, data quality, and data retention and disposal.

On the tooling side, the data catalogue plays a central role: it inventories datasets, documents their business meaning and traces their lineage, where the data comes from, which transformations it has gone through, who consumes it. Modern platforms add automated quality measurement (freshness, completeness, consistency) and the programmatic enforcement of access rules, known as policy as code: rules are no longer described in a document that everyone interprets differently, they are executed and audited by the platform itself.

@cite:principes-d-architecture-de-donnees

SECTION 3

Governance versus data management: two distinct notions

Governance and data management are often confused, yet they differ clearly. Governance concerns the broader structures, policies and processes for steering data: it establishes roles and responsibilities. Management, on the other hand, focuses on concrete actions, acquisition, storage in databases and analysis in service of decision-making.

Put differently, governance sets the framework and management executes it. The two are complementary: management without governance lacks rules, governance without management stays theoretical.

The operating model still has to be chosen. The centralised model entrusts governance to a single team: consistent and easy to steer, but quickly congested as data domains multiply. The federated model, popularised by data mesh, distributes responsibility to the teams that produce the data, framed by shared, automated rules, what is known as federated computational governance. In practice, most organisations converge on a hybrid: a central foundation of rules, standards and tools, with decentralised execution inside business domains, close to the people who genuinely know the data. The right balance depends on the organisation's size, its regulatory exposure and the maturity of its data teams, and it usually evolves over time, starting more central and federating as domains gain autonomy.

SECTION 4

Challenges and implementation steps

### The main obstacles

Several obstacles slow down the setup of governance: a lack of human and technological resources, complexity tied to the volume and diversity of sources, a lack of organisation-wide buy-in, resistance to change, cultural differences in decentralised organisations, compliance requirements and the difficulty of ensuring data quality.

On top of these obstacles comes a more insidious pitfall: governance experienced as bureaucratic overhead. If teams see nothing in the setup but extra forms and approvals, they will work around it. The remedy is to measure and demonstrate the value produced: the share of critical data covered by an identified owner, the quality score of priority datasets, the average time it takes a new project to get access to trusted data, the compliance incidents avoided. Governance that shortens the path to reliable data is governance that teams adopt on their own.

### The implementation steps

The approach follows clear steps: define objectives aligned with business needs, establish policies and communicate them widely, assign roles and responsibilities with the necessary resources, implement data-handling processes, deploy supporting technologies, then regularly monitor and evaluate the effectiveness of the setup. Success depends on clear policies and processes, but also on strong leadership and buy-in from all levels of the organisation. Each step deserves an explicit owner and a deadline: a governance roadmap that nobody is accountable for delivering tends to stall at the policy-writing stage and never reaches the teams who actually handle the data.

Two lessons from the field complete this playbook: start small, one critical data domain, a few visible indicators, rather than trying to cover everything at once; and automate early, because governance that relies solely on goodwill and manual reviews runs out of steam within a few months.

@cite:data-mesh-principes-et-benefices

SECTION 5

Regulation and AI: governance changes scale

Since this article was first published, two developments have profoundly raised the stakes: the accumulation of European regulatory texts and the arrival of generative AI inside information systems.

### A thickening European regulatory framework

The GDPR is no longer the only structuring text. The Data Governance Act, applicable since September 2023, regulates data intermediaries and altruistic data sharing. The Data Act, applicable since September 2025, mandates access to data generated by connected devices and makes switching cloud providers easier. The European AI Act, which entered into force in August 2024, ramps up in stages: prohibitions and AI-literacy obligations since February 2025, obligations for general-purpose AI models since August 2025, then requirements for high-risk systems, whose Article 10 imposes genuine governance of training, validation and test datasets, on a timeline, initially set for August 2026, that is still being adjusted in Brussels.

Sector-specific texts add to the picture, such as DORA, which has subjected the financial sector to strict digital operational resilience requirements since January 2025, or the NIS2 directive for cybersecurity. The regulators' message is constant: it is no longer enough to protect data, you must demonstrate that you know where it sits, where it comes from and who accesses it. Without a catalogue, without lineage and without an up-to-date record of processing activities, that demonstration is simply impossible. In other words, the tooling investments described above are no longer optional conveniences: they have become the evidence base that audits and regulators expect to see.

### Governing the data that feeds AI

Generative AI shifts governance's centre of gravity. Language models consume entire document corpora through RAG (retrieval-augmented generation) architectures: every misclassified, outdated or confidential document that enters the knowledge base can resurface in an answer. Governance must therefore extend to unstructured data, documents, wikis, tickets, emails, long ignored by traditional setups: who may index what, under which sensitivity classification, with what retention period and which access controls enforced all the way down to the vector search engine. A knowledge base is only as trustworthy as the weakest document it contains, which makes curation and classification a prerequisite rather than an afterthought.

Symmetrically, AI outputs themselves become data to govern: traceability of generated answers, prompt logging, detection of personal-data leaks. The most advanced organisations formalise data contracts between producers and consumers, and treat their datasets as products, with an owner, a service level and published quality indicators. That discipline is what separates a promising AI pilot from a production deployment you can defend in front of an auditor. Teams that put these foundations in place before scaling their AI use cases consistently move faster afterwards, because every new project starts from data that is already documented, classified and trusted.

@cite:comment-construire-une-base-de-connaissances-prete-pour-l-ia

SECTION 6

The Adservio approach

At Adservio, we treat data governance as an ongoing process rather than a one-off project: assessing what exists, building the framework, policies, roles, processes, technologies, then improving it regularly in line with objectives and regulatory changes.

Our conviction: governance is only worth the buy-in it generates. We involve stakeholders at all levels, align the approach with business objectives and transfer control to your teams so they keep governance alive and draw value from it autonomously.

FAQ

Frequently asked questions