Ask most people outside the data team about governance and you'll hear about the department of no: the team that slows projects down and asks awkward questions.
Most people in data would now say it should be the opposite. The hard part is making that true, and in my experience it comes down to building governance before you need it.
We recently finished masking personal and sensitive data in our data warehouse. Personal and sensitive fields are classified and masked by default, so unless someone's role needs the detail, people and tools see the data without it. Once that was done, a whole set of AI work became possible. We could put warehouse data into AI tools under the provider's contract, because the personal details had been masked out. Without the masking, every one of those projects would have been its own long conversation with cyber and legal. With it, the answer was yes.
Here are four more moments you'll probably recognise.
"Who can see this?" Before we had one central place for logins, answering that meant chasing people and checking systems one by one. Now access runs through a single identity provider. It's auditable, and when someone joins, changes role or leaves, most of what they can see changes automatically.
How many customers do we have? It sounds like a question with one answer. Ask around and you'll get several: every customer ever, live customers, customers in the last few years. Each one is right for someone. The problem is when they share a name. Different views are fine, as long as each has its own name and someone owns the definition.
The email. You can build systems that make sure the right people see the right data, with fail-safes, and still lose control the moment someone exports a file and emails it. The risk is usually the step outside the system. Good governance makes the safe route the easy one, so people don't go around it.
The project that stalls. I've seen AI projects get a long way before anyone asked what the contract actually said, or where the data would be processed. Then cyber and legal see it for the first time, and it stops. I wrote about where AI actually runs in Your data stays put. Does your AI? Bringing cyber, legal and the DPO in at the start means those questions get answered while they're still cheap to answer.
These five moments only cover a few areas of governance. There are twelve in all, from value and ownership through to data sharing and AI. I went back to the main frameworks, including DAMA, the EDM Council, the ICO and Ofgem, the energy regulator, and there's a lot of common ground in what they cover. What they don't give you is one practitioner's view of how it plays out, so I've written mine for each of the twelve in the strategy piece, along with how you'd show each one is working.
If you're starting out, start small: classify the data your revenue depends on. Once you know what that data is, most of the other decisions get easier.