Data Governance in Organisations: Who Owns Your Data?

Data governance in organisations: who owns the data and who may use it?

Data governance isn’t a project for large organisations only. It is a set of clear rules that decide who owns each type of data, who may see and change it, and how it stays accurate and protected.

Data and AI 6 min read

By Nour Aldein Tleti. Updated 7 October 2026.

What is data governance and why does your organisation need it?

Data governance is the set of rules and roles that govern how data is created, used, protected and kept within an organisation. Your organisation needs it because unmanaged data leads to conflicting reports, leaks of sensitive information and the loss of important records. In practice it starts with assigning an owner to each dataset and setting clear access permissions.

The components of data governance

Ownership: Each dataset has an owner in the relevant department. Sales owns customer data, for example, and finance owns the accounts.
Permissions: Who can view, edit and delete, following the principle of the least access needed to do the job.
Quality: Shared definitions, entry rules and regular checks for errors.
Privacy and protection: Classifying data by sensitivity, with particular protection for personal and financial data.
Retention and archiving: How long each type of record is kept, and when it is archived or deleted under current legal requirements.

Why it matters in the Syrian context

Many systems and files: Data moving between notebooks, Excel files and different software makes it hard to know which version is correct.
Staff turnover: When an employee who alone knows where the files and passwords are leaves, whole areas of work grind to a halt.
NGOs and donors: Charities that collect beneficiary data need strict rules on privacy and on sharing with partners.
Risk of data loss: Power cuts, device failures and lost phones make backups and documentation part of governance.
Work data on personal phones: Many staff keep work files and customer chats on their own phones, which calls for clear rules on deletion when they leave.

Roles in data governance

Senior management: Approves the policy and settles disputes over data ownership and permissions.
Data owner: The manager of the relevant department, who decides who can access their data and monitors its accuracy.
Technical lead: Implements permissions and backups and monitors access to systems.
Every employee: Enters data accurately, protects their password and reports any error or leak.

Implementing data governance step by step

01
Inventory your data
A list of the main data: where it lives, who uses it and how sensitive it is.
02
Assign owners
A person responsible for each dataset who approves permissions and monitors quality.
03
Classify sensitivity
Public, internal and confidential, with rules for sharing and storage for each category.
04
Review permissions
Close shared accounts and the accounts of staff who have left, and give each person only what they need.
05
Write a short policy
Two or three pages in plain language that staff read and are trained on.
06
Review regularly
Reviews of permissions, quality and backups at fixed intervals.

Classifying data by sensitivity

Category	Examples	Handling rules
Public	Published prices and official contact details	Published without restrictions
Internal	Operational reports and procedures	For staff only, through work channels
Confidential	Salaries, contracts and customer data	Defined permissions, encryption and backups
Highly sensitive	Health data and data on the most vulnerable beneficiaries	As few people with access as possible and a log of every access

Read also

Data and AI

Frequently asked questions

Does a small company need data governance?

Yes, in a simple form: who is responsible for each type of data, who can access what, and where the backups are.

How do we share beneficiary data with a partner?

Share only the minimum needed, preferably after removing identifying information, and under a written agreement that sets out the purpose and the retention period.

How does governance relate to AI?

Governance rules decide what may be entered into AI tools, and prevent sensitive data from leaking through them.

How long should records be kept?

It varies by type of record and by current legal and accounting requirements, so ask your accountant or legal advisor to set the periods.

Are shared accounts really a problem?

Yes, because they make it impossible to know who carried out each action, and they make it hard to remove access when an employee leaves.