Data Governance Review Checklist
A review checklist for data governance covering ownership, cataloging, classification, access control, lineage, quality, and retention. It maps directly to audit evidence for frameworks like SOC 2 and GDPR. Use it periodically, before migrations, or ahead of an audit.
When to Use This Checklist
Use this checklist to review the state of data governance across an organization or a specific data platform. Data governance is the set of roles, policies, and controls that keep data trustworthy, secure, and compliant. Run this review periodically, before a major migration, or when preparing for an audit such as SOC 2 or GDPR.
How to Use This Checklist
Work through ownership, cataloging, classification, and access control as the foundation. Governance fails without clear owners, so the first item is non-negotiable. Then assess lineage, quality monitoring, and retention, which together determine whether data can be trusted and lawfully kept. The compliance items map directly to audit evidence, so confirm each with concrete proof rather than assumptions. Use the optional items to assess maturity beyond the baseline.
What Good Looks Like
Mature data governance has a named owner and steward for every critical dataset, a populated catalog with business definitions, and sensitivity classification driving least-privilege access. Lineage traces each field from source to dashboard, and quality rules are monitored, not aspirational. Retention and deletion policies are enforced automatically, access to regulated data is audited, and personal-data handling demonstrably follows the law. New sources enter under governance by default rather than as exceptions.
Common Pitfalls
The most common gap is ownership: datasets exist with no accountable person, so quality and access decisions drift. Catalogs are often stale or empty, making data undiscoverable and untrusted. Classification is skipped, leaving sensitive data without proportionate controls. Retention policies frequently exist on paper but are never enforced, creating compliance exposure. Finally, governance applied only to existing data fails as soon as a new ungoverned source appears, so onboarding must be built into the process.
Related Resources
Anchor the review in a data-governance-framework and codify producer-consumer interfaces with data-contracts. Use data-catalog-and-discovery and data-lineage for trust and traceability, and apply privacy-by-design-7-principles and gdpr-compliance-engineering for regulated data.