Data governance maturity: where you are, and how to move up a level

Governance used to be treated as a compliance cost. Today it's what makes data usable at scale: analysts trust the numbers, AI teams can access data lawfully, and regulators get clear answers about where personal data goes. Weak governance is one of the most common reasons strong platforms underdeliver.

• Initial: no named owners; quality issues fixed ad hoc; policies, if any, are documents nobody reads.
• Developing: a governance lead exists; critical data elements are identified; some definitions agreed.
• Defined: data owners and stewards per domain; a business glossary and catalogue in use; quality rules monitored for key datasets; privacy requirements mapped.
• Managed: governance is measured: quality, access requests, lineage coverage and policy exceptions are tracked and reported.
• Embedded: controls are built into pipelines and platforms by default (classification at ingestion, automated retention, policy-as-code), and governance enables self-service rather than blocking it.

• Ownership and stewardship: named, accountable owners per domain, with time to do the job.
• Data quality: defined rules, monitoring and a remediation loop for critical data.
• Metadata and lineage: whether you can trace a metric back to its sources.
• Access and security: role-based access, least privilege, auditability.
• Privacy and compliance: purpose limitation, consent, retention and cross-border transfer controls against GDPR, CCPA, POPIA, LGPD and the other regimes you operate under.
• Policy and operating model: a governance council or equivalent that makes decisions and resolves conflicts.

Don't try to govern everything. Start with the data that drives revenue, regulatory exposure or AI use cases. Name owners, define critical data elements, automate quality checks on them, and make lineage visible for the metrics leadership uses. Shift controls left, into ingestion and the platform, so compliance isn't a manual task. Measure governance outcomes, not activity.

AI raises the bar: training and retrieval data needs clear provenance, lawful basis and access control, and model outputs need oversight. If you're planning AI, assess governance alongside AI readiness. See the AI readiness assessment guide.

A healthcare provider has a governance policy, a council that meets quarterly and a catalogue nobody updates: on paper it's defined, in practice it's developing. The assessment pins down why. Stewards have no allocated time, quality rules exist only for billing data, and patient data lineage stops at the warehouse. Instead of rewriting the policy, the provider names stewards for patient and billing domains with protected time, automates quality checks on the critical elements, and extends lineage to the reports clinicians use. Within a quarter, governance becomes something people see working.

Fewer disputes about which number is right; access requests handled in a predictable way; privacy questions answered from lineage, not memory; and data teams asking governance for help instead of working around it.

carbon.iq scores governance as part of your data maturity snapshot and runs privacy and compliance readiness checks across GDPR, CCPA, POPIA, LGPD, PDPA, APP and PIPEDA. Each check highlights the highest-risk categories and a priority action plan. These are structured self-assessments, not legal advice. carbon.iq Pro ($19 a month) adds every recommendation for your gaps, the Intelligence Roadmap and Report Builder with native Google Workspace and Microsoft 365 export, to turn findings into a plan you can share. Pro is $19 a month (charged as R300). Assess your governance with carbon.iq →