A data governance framework for a small or mid-sized company needs five things: an owner for each dataset, written definitions, access rules, automatic quality checks, and a record of the personal data you hold. That fits on two pages. You don't need a council, a steering committee or a 200-page policy. This post sets out a practical version with a template you can copy.
What is a data governance framework?
It is the set of rules for who is responsible for your data, what it means, who can see it and how you know it is right. Large frameworks such as DAMA-DMBOK, published by DAMA International, cover the whole field of data management. They are useful references. For a company of 20 or 200 people, though, most of the value comes from a small core done consistently.
The test of a good framework is simple. When two reports disagree, can you find out which one is right, and who fixes it?
The five parts that matter for an SME
1. Owners. Every important dataset has one named owner. Usually that is the head of the team that creates the data. Finance owns invoices. Sales owns the CRM. The owner decides what the data means and approves who can access it. They don't have to fix pipelines themselves.
2. Definitions. Write down the ten or so terms that cause arguments. What counts as a customer? Is revenue booked on the invoice date or the payment date? Is a cancelled order with a fee a sale? Keep each definition short, give it an owner, and apply it in one place, ideally in the data warehouse rather than in each report.
3. Access. Decide who sees what by role, not by person. Salary data, personal records and health information should be restricted from the start. Review access when people join, change roles or leave.
4. Quality checks. Agree a few checks that run on every data load and alert someone when they fail. Row counts against the source, totals reconciled to accounting, no missing days, no duplicates. The owner gets the alert.
5. Personal data. Know what personal data you hold, why, where it is stored and when you delete it. This is the part the law cares about most.
A template you can copy
Fill in one row per dataset. Most SMEs end up with 10 to 30 rows.
| Dataset | Owner | Source system | Key definitions | Who can see it | Quality checks | Personal data? | Kept for |
|---|---|---|---|---|---|---|---|
| Invoices | Head of finance | Accounting | Revenue on invoice date, net of VAT | Finance, management | Totals match ledger monthly | Customer names | As required by accounting law |
| Customers | Head of sales | CRM | Active = ordered in last 12 months | Sales, support | No duplicate emails | Yes | Until 2 years inactive |
| Bookings | Operations lead | Booking system | Counted on travel date | Operations, finance | Row count matches source daily | Yes | Agreed with legal |
| Payroll | HR manager | Payroll system | Cost includes employer taxes | HR, CFO only | Headcount matches HR list | Yes, sensitive | As required by law |
The retention periods above are placeholders. Set yours with whoever advises you on law and accounting.
How does the GDPR fit in?
The GDPR sets principles in Article 5, including purpose limitation, data minimisation, accuracy, storage limitation, and integrity and confidentiality. Article 5(2) adds accountability: you must be able to demonstrate compliance, not just comply. Your framework is how you demonstrate it.
Article 30 requires a record of processing activities: the purposes, the categories of people and data, recipients, transfers outside the EU, planned deletion times and security measures. Organisations with fewer than 250 people are exempt only in narrow cases. The exemption does not apply if processing is not occasional, is likely to put people's rights at risk, or covers special categories of data. Regular processing of customer or staff data is rarely occasional, so most SMEs should keep the record anyway. The "Personal data?" and "Kept for" columns in the template are a good start.
How do you keep it alive?
Frameworks fail when they become a document nobody opens. A few habits prevent that:
- Put definitions where people work. Add them to dashboard descriptions and the warehouse, rather than a shared drive.
- Review quarterly. Thirty minutes per owner: is the row still right, has access changed, did checks fail?
- Tie changes to the framework. A new system or report adds a row before it goes live.
- Start with the data that causes the most pain. Usually revenue and customers. Add the rest later.
What does it look like in a real project?
On our projects, governance is part of the build. For KMÍ, working with Móholt, the warehouse came with access controls, data validation and monitoring. For TourDesk, governance covered data quality, consistency and GDPR compliance across hotels, vendors and bookings.
If you want a governance framework that fits the size of your company, our analytics work shows how we build it into the data foundation, and you can tell us where you are today.