All services Every engagement has a fixed, published price. Book a strategy call
A six step data governance framework sized for UK mid market companies, with a ninety day plan, effort ranges and the failure patterns to avoid.
Most published data governance frameworks were written for organisations with a chief data officer, a data office and a budget to match. A UK company turning over between roughly £20 million and £500 million has none of those things. It has a finance director who does not trust two of the monthly reports, a head of IT already at capacity, and an AI project that has stalled because nobody can vouch for the underlying data. Applying an enterprise framework in that setting produces a folder of policies and no change in behaviour.
This guide sets out a six step implementation designed for that middle ground. It runs on existing people, delivers something usable inside ninety days, and is sequenced so that each step earns the right to the next. Intelance sells data governance advisory, so read it as the method we use rather than as neutral instruction. It is published in full because the design was never the difficult part.
The short answer. Implement data governance in six steps. Pick one business problem worth solving. Name owners for the data behind it. Write down what good looks like for those specific fields. Measure the gap and publish the number. Put a small decision forum in place that meets fortnightly and records what it decides. Then extend to the next domain. Expect ninety days to a working first domain and around twelve months to cover the data that matters. Do not buy tooling until steps one to five are running.
Four patterns account for nearly every stalled programme we are asked to rescue, and none of them is technical.
The sequence below is arranged specifically to avoid these. Each step produces something a director can look at, which is what keeps the sponsorship alive.
Start with a business problem that already costs somebody time or credibility. Two reports that disagree at month end. A customer record so unreliable that pricing is guesswork. A regulator or insurer question nobody could answer quickly. An AI use case blocked on data the team does not trust.
Write the problem in one sentence, name the executive who cares about it, and identify the handful of datasets involved. Governing those datasets is your first domain. Everything else waits.
Done when a named executive agrees the problem is worth solving and the datasets behind it are listed.
Ownership is the whole foundation, and it is where mid sized organisations gain the most ground fastest. An owner is a single named person, in the business rather than in IT, who answers for what the data means and whether it is fit to use. Not a team. Not a committee.
Expect discomfort here. People decline ownership because they fear being blamed for problems they inherited. Answer that directly: the owner is accountable for the definition and for raising issues rather than for having created them.
Done when every dataset in scope has one name against it, and each of those people knows and accepts it.
For each dataset, agree the definition, the fields that matter, and the rule that makes each field acceptable. Customer status has four permitted values. Every active account has a verified billing contact. Product codes match the finance master. Keep it to the fields that carry the business problem from step one.
This is the step that produces arguments, and the arguments are the value. Two teams discovering they have been counting customers differently for six years is a finding worth more than any policy document.
Done when the rules exist in plain language, on one page per dataset, agreed by the owner.
Run the rules against the live data and count the failures. A simple query is enough. Ninety three percent of active accounts have a verified billing contact. Four hundred and twelve product codes do not match finance. Publish the numbers to the owners and the sponsor.
Measurement changes the conversation from opinion to fact, and it gives you a baseline to improve against. It also protects the programme, because a number that moves is the clearest evidence that governance is doing something.
Done when a baseline exists per dataset and the sponsor has seen it.
Governance needs somewhere decisions get made and recorded. For a mid sized organisation that is four to six people meeting fortnightly for forty five minutes: the sponsor, the data owners in scope, and someone from IT. It resolves definition disputes, agrees fixes, and accepts or rejects new uses of the data.
Record every decision in one place with the date and the reason. That record is what you show a regulator, a customer or an auditor, and it is what stops the same argument recurring every quarter.
Done when the forum has met twice, resolved something real, and written both decisions down.
Only now do you widen the scope. Take the next business problem, repeat steps one to five, and reuse the forum and the rule format you already have. Each domain is faster than the last because the machinery exists.
Tooling becomes a sensible purchase somewhere around the third or fourth domain, when manual tracking genuinely stops coping. By then you know what you need it to do, which makes the selection straightforward.
Done when two or more domains are running to the same method and the forum handles both.
This is the shape of a first domain for a UK mid market organisation using existing staff, with senior help for a few days a month. It assumes one part time internal lead and cooperation from two or three business teams.
| Weeks | What happens | What exists at the end |
|---|---|---|
| 1 to 2 | Agree the problem and the sponsor. List the datasets behind it. Interview the people who create and use the data. | A one page scope and a named executive who wants it solved |
| 3 to 5 | Agree owners dataset by dataset. Hold the conversations that ownership requires. | A short register with one name against every dataset in scope |
| 6 to 8 | Write the definitions and rules with each owner. Settle the disagreements that surface. | One page of agreed rules per dataset, in business language |
| 9 to 10 | Run the rules against live data. Produce the baseline and share it. | A measured quality position the sponsor has seen |
| 11 to 12 | Stand up the fortnightly forum. Run it twice. Agree the remediation priorities and the next domain. | A working forum, a decision log, and an agreed plan for domain two |
Effort matters more than budget in the mid market, because the constraint is usually attention rather than money. These are the ranges we see for a first domain of five to ten datasets.
| Step | Internal effort | Where it usually goes wrong |
|---|---|---|
| Choosing the problem | Two or three meetings | Choosing something nobody senior cares about |
| Naming owners | A few days spread over three weeks | Assigning a team instead of a person |
| Writing the rules | Half a day per dataset with the owner | Drifting into a full data dictionary for the whole estate |
| Measuring the gap | One to three days of analyst time | Waiting for a tool instead of writing a query |
| Running the forum | Forty five minutes a fortnight | Letting it become a status meeting with no decisions |
| Extending | Roughly two thirds of the first domain | Widening scope before the first domain holds |
Two forces make this work urgent for UK companies, and both reward the same groundwork.
On compliance, the ICO accountability framework expects organisations to know what personal data they hold, why, and who is responsible for it. The Data Protection Act 2018 and UK GDPR put that duty on a statutory footing, and the ICO expects records of processing to be maintained rather than produced when asked. Steps two and three of this framework produce exactly that evidence as a by product.
On AI, every governance obligation eventually resolves to a question about data. What went in, who owned it, whether its use was lawful. Our guide to why data governance is the foundation of safe AI sets out that dependency, and for companies inside the scope of European rules, the EU AI Act guide explains what applies and when.
If you want the formal reference behind the discipline, the DAMA data management body of knowledge is the standard text. The framework above is a deliberately reduced version of it, sized for organisations without a data office.
Everything above can be run by an internal team with this article in hand, and some organisations should do exactly that. Where senior capacity or independence is missing, the engagements are published so you can judge the cost before a meeting.
A Data Governance QuickScan completes steps one to four in ten working days from £14,500 + VAT, including the measured baseline. Data Governance Foundations builds the full operating model from £45,000 + VAT. Where the constraint is leadership rather than method, a Virtual CDO provides a named senior leader from £7,500 + VAT per month, and data governance as a service runs the function from £9,500 + VAT per month. For programme critical data work, Project DG starts from £22,000 + VAT per month. Our data governance cost guide shows the market ranges these sit within, and if you are still choosing a provider, our guide to which firms specialise in data governance in the UK explains what to ask before you sign. New to the subject entirely, start with what data governance is.
A first domain takes about ninety days for a UK mid market organisation, ending with named owners, agreed rules, a measured baseline and a working decision forum. Covering the data that genuinely matters usually takes around twelve months, adding domains one at a time.
Start with one business problem that already costs somebody time or credibility, such as two reports that disagree or an AI project blocked on untrusted data. Govern only the datasets behind that problem first. Starting everywhere at once is the most common reason programmes stall.
No. The first four steps need conversations, a short register and a few queries. Tooling becomes worth buying around the third or fourth domain, when manual tracking stops coping and you know precisely what the tool has to do.
An executive sponsor owns the outcome, individual named people in the business own each dataset, and one part time internal lead keeps the machinery running. IT participates but should not own definitions, because governance run from IT is treated as overhead by everyone else.
A framework is the working machinery: owners, rules, measurement and a forum that decides. A policy is a statement of intent. Policies are quick to write and change nothing on their own, which is why this framework produces a policy late rather than first.
Show three things: the measured quality baseline moving in the right direction, a decision log with real decisions in it, and the time taken to answer a regulator, customer or auditor question falling. Documents produced is not a measure of anything.
It is the right foundation, and regulated organisations will need more on top, including formal records of processing, impact assessments and sector specific controls. The steps here produce much of the underlying evidence those requirements depend on.
Emmanuel Olatunji
Chief Enterprise Architecture Partner
Emmanuel founded Intelance in 2017 and has led architecture, AI governance, cyber and deal engagements across the UK, Europe, the Middle East and Africa. Every Intelance engagement runs under his direction, and every guide he publishes comes from that work.
See his record on LinkedIn About IntelanceThirty minutes with a senior adviser. A clear view of where to start, what it costs and what your team can run themselves.
Talk to a senior adviser
Data Governance
Data Governance