Data Governance Framework: 7 Steps to Ownership, Quality and Access Rules a Mid-Sized Business Can Run

A data governance framework is the set of rules, roles and processes that decides who owns each piece of company data, how it is defined, what quality it must meet and who may access it. The aim is that everyone in management trusts the same number. Start small: name an owner, write a definition and measure quality regularly for a handful of critical fields.

Key takeaways

• Data governance is not software; it is the set of roles and processes deciding who makes data decisions, and by which rules.
• In the 2025 Drexel LeBow and Precisely survey, 67% of respondents said they don't fully trust the data their organisation uses.
• A workable framework has 7 steps; picking critical fields, naming data owners and writing a business glossary already make a difference.
• The data owner is not IT but the business manager who knows what the data means: sales for customer records, finance for accounts.
• Adding personal data, purpose and retention period columns to the data dictionary lets it share one source with the KVKK inventory.

What problem does data governance solve? Three revenue figures in one meeting

In the monthly management meeting, the sales director quotes one revenue figure, finance quotes a lower one, and production planning offers a third based on shipments. Nobody is wrong. Each is reading the "revenue" field in their own system: one counts orders, one counts invoices, one counts delivery notes. The first half hour goes on arguing about the number, and the decision slips to next month.

Customer records tell the same story. One company appears three times in the enterprise resource planning (ERP) system under slightly different spellings, the customer relationship management (CRM) software is missing its tax number, and the address used for e-invoicing is out of date. We looked at that problem in detail in our guide to data quality and duplicate records. Cleaning duplicates is a one-off job; stopping them coming back is a governance job.

Data governance is often treated as something only for banks and large groups. In practice the problem does not depend on size. A 40-person manufacturer and a 400-person logistics firm both ask the same question: "Who produced this figure, how was it calculated, and how do we know it is right?"

What does bad or untrusted data cost?

Having data is not the same as trusting it, and the cost of distrust often stays hidden. International research puts numbers on the gap:

In a survey of 565 data and analytics professionals by Drexel University's LeBow College of Business and data software company Precisely, 76% named data-driven decision-making as the top goal of their data programmes, yet 67% said they don't fully trust the data their organisation uses. (Drexel LeBow & Precisely, 2025 Outlook: Data Integrity Trends and Insights)

In the Drexel LeBow and Precisely survey, respondents also named a lack of data governance, cited by 62%, as the top data challenge holding back AI initiatives, and only 12% said their data is AI-ready. The obstacle to an AI project is usually not the model but the data underneath it, a point we also make in where to start with AI in your business.

The financial effect of bad data is not small either. Data quality expert Thomas C. Redman, writing in MIT Sloan Management Review, "Seizing Opportunity in Data Quality" in 2017, estimates the cost of bad data at 15% to 25% of revenue for most companies. That is an expert estimate rather than a measurement, but once you add up wrong shipments, rejected invoices, rework and delayed decisions, the direction it points in is hardly surprising.

In Türkiye the basic reporting infrastructure is still being put in place. According to the Turkish Statistical Institute (TurkStat) ICT Usage in Enterprises Survey 2025, 28.3% of enterprises with 10 or more employees used ERP software and only 6.5% used business intelligence (BI) software; as these questions are asked every two years, this is the latest official figure as of 2026. For a business just starting to report properly, that is an opportunity: set the rules first and you greatly reduce the clean-up later. As data volumes grow, so does this cost; what is big data looks at when a big data platform is genuinely needed.

What data governance is, and what it is not

Data governance is neither a piece of software nor a department. It is the arrangement that decides how decisions about data get made. Separating it from the terms it is often confused with helps at the start:

Data governance sits above these four disciplines and steers them. A data warehouse and ETL pipeline brings data together technically, but it is governance that decides which system is the master for "customer".

How do you build a data governance framework? 7 steps

The seven-step data governance framework below is designed for a mid-sized business without a full-time data team. You do not need to do them all at once; the first three alone make a noticeable difference.

1. Pick the critical data fields. Do not start with everything. List the 10 to 20 fields argued about most in management meetings: customer, product code, revenue, order status, stock quantity. It makes sense to do this alongside setting your KPIs; if you do not measure it yet, you do not need to govern it yet.
2. Give every field an owner. The owner is the business manager accountable for the field's definition and quality, not IT. Customer records belong to sales, product master data to production or purchasing, supplier and customer accounts to finance. Bringing that master data together into one record across systems is the work of master data management (MDM).
3. Write the business glossary. For each critical term: a one-sentence definition, the calculation rule, the source system and the update frequency. For example, "Revenue = excluding VAT, net of cancellations and returns, by invoice date". Technical definitions of tables and fields (type, length, allowed values) live separately in a data dictionary; we explain how the two connect in data catalog and data dictionary.
4. Set quality rules and measure them. Mandatory fields, format rules (a Turkish company tax ID has ten digits), uniqueness (no second record with the same tax number) and timeliness. Track the error rate for each rule every week.
5. Define access by role. Who reads, who edits, who deletes? Permissions go to roles, not individuals, and a leaver's access closes on their last day. The document side of this is covered in our guide to file sharing permissions, and the boundaries for users building their own reports in self-service analytics governance.
6. Flag personal data separately. Which fields are personal data, which are special category data, and how long are they kept? This must match your KVKK personal data inventory; our data retention and disposal policy guide explains how retention periods are set.
7. Agree how changes and disputes are handled. Creating a field, changing a definition or settling a "which number is right" dispute between two departments needs a named decision-maker. A short monthly data council meeting is enough for most businesses.

Data governance roles: who does what?

• Data owner (business manager): approves the definition, sets the quality target and approves access requests in line with the principle of least privilege.
• Data steward (practitioner): monitors quality day to day and corrects, or gets corrected, bad records. Do not confuse this internal role with the "data controller" under KVKK: the natural or legal person that determines the purposes and means of processing, which in most cases is the company itself.
• IT / system administrator: applies the rules in systems, keeps access logs and runs the integrations.
• Data council: a small group of owners that resolves disputes and sets priorities.

Definitions must hold not only in month-end reports but on live screens too. If a "late order" is calculated differently on a live panel than in the month-end report, the two will contradict each other; we cover that trap in our guide to real-time reporting. The same principle applies to field data: the quality of any route optimisation project depends on customer addresses coming from a single, correct source.

How does data governance support KVKK compliance?

KVKK, Law No. 6698 on the Protection of Personal Data, is Türkiye's main data protection law and was largely modelled on the EU's earlier data protection framework. Together with its secondary regulations, it expects a data controller to know why personal data is processed, who it is transferred to and how long it is kept.

Knowing the purpose, recipients and retention period of personal data underpins privacy notices, and organisations required to register with VERBİS (the Data Controllers' Registry Information System) must also maintain a personal data inventory and a retention and disposal policy. Data governance asks for the same information anyway: an owner, a purpose and a retention period for every field. Running the two exercises separately means maintaining two versions of the same inventory.

To join KVKK and data governance in practice, adding three columns to the data dictionary is enough: is it personal data, what is the purpose, what is the retention period? Your KVKK compliance programme inventory and your reporting dictionary then draw on the same source. AI projects that touch personal data need a separate assessment on top; we cover that in our guide to AI and KVKK.

How does Digital Bridge run a data governance project?

At Digital Bridge, we do not hand over a binder of policies and walk away; we build the rules into the systems people actually use. A typical engagement runs like this:

• Discovery and requirements analysis. We review your systems (ERP, CRM, production, spreadsheets) and the reports management relies on, then map where the most disputed figures come from and how they are calculated. This is the starting point of our data governance and quality service.
• A pilot area. We usually start with customer or product master data. Owners are named, the business glossary is written, quality rules are defined and the error rate appears on a scorecard. Because the pilot is measurable, the decision to expand is made on evidence.
• Integration and a single source. We build checks that apply quality rules at the moment of entry, matching between systems and a shared reporting layer. Where reports draw on several sources we design a data warehouse, and we automate data flows between systems through system integrations.
• KVKK alignment. We map the data dictionary to your personal data inventory and, where needed, prepare retention, disposal and privacy notice processes through our data protection compliance consultancy.
• Making it visible. Once definitions are settled, the data goes onto a management dashboard (BI), so everyone in the meeting looks at the same figure.

Business email and documents are part of data access governance too. Our own business application family, Smart360, gives products such as SmartMail, SmartFiles, SmartOperator and SmartPass a single identity (SmartID). Departments are defined once and become permissions in each product: when someone leaves a department, the access they had through it is removed across every product automatically, and an administrator closes a leaver's access from one place. It is a concrete example of enforcing a permission rule in the system rather than on paper.

Data is only one dimension of an organisation's overall digital maturity; for the seven-dimension method, see our article on digital maturity assessment.

Where should you start with data governance this week?

There is one thing you can do this week: write down the three figures argued about most in management meetings, and for each one note its source, calculation rule and the person responsible. The empty cells show where governance work should begin. Bring that list to us through our contact page; we will review your systems with you and propose the first pilot area and its scope in writing. For more guides on this subject, see our Data & Analytics hub.