Data governance in practice: owners, stewards and custodians

Data governance is often described in terms of frameworks, councils and tools. In practice it comes down to a simpler question: for each important set of data, who decides what it means, who keeps it fit for use, and who runs the systems that hold it. When those answers are clear, quality, security and retention improve. When they are not, data is governed by default.

This article sets out the core roles and building blocks, how they connect to obligations already in force in Australia, and why they matter for AI.

Three roles, not one

Most mature data governance models distinguish three roles. The labels vary between organisations, but the separation of responsibilities is what matters.

Data owner. A senior business leader accountable for a data set. The owner decides who may access it, what it may be used for, how long it is kept and what level of quality is acceptable. Ownership is a business role, not a technical one. The owner of customer data is usually the executive responsible for customers, not the head of IT.

Data steward. A subject matter expert who looks after the data day to day on the owner’s behalf. Stewards maintain definitions, set and monitor quality rules, resolve issues and answer questions from users. They are usually close to the business process that creates the data.

Data custodian. The person or team that operates the systems where the data lives. Custodians implement access controls, backups, security measures, retention and deletion, in line with the owner’s decisions. Custodians are often in IT or a technology provider.

Responsibility	Owner	Steward	Custodian
Accountable for the data set	Yes
Approves access and permitted uses	Decides	Advises	Implements
Sets retention and destruction rules	Decides	Advises	Implements
Maintains definitions and glossary entries	Approves	Maintains
Defines and monitors quality rules	Approves thresholds	Defines and monitors	Supports with tooling
Resolves data quality issues	Escalation point	Coordinates	Fixes system causes
Applies classification and handling controls	Approves classification	Proposes classification	Applies controls
Documents lineage		Business lineage	Technical lineage

A common failure is to assign all three roles to the system administrator. The custodian then makes business decisions, such as who may see data or how long to keep it, without the authority or context to make them well.

Start with critical data sets

Few organisations can govern all their data at once, and they do not need to. Begin with critical data sets: those that hold personal or sensitive information, support significant decisions about people, feed regulatory or financial reporting, or are reused across many processes. A register of ten to twenty critical data sets, each with named roles, is a more useful starting point than an inventory of every table.

Definitions and a business glossary

Disagreements about numbers are often disagreements about meaning. What counts as an “active customer”, a “client”, or a “completed episode of care”? A business glossary records agreed definitions for key terms, who owns each definition and where it is used. It is maintained by stewards and approved by owners. It sits above the technical data dictionary, which describes fields, formats and allowed values in specific systems.

Classification

Classification assigns each data set a sensitivity level that drives how it is stored, accessed, shared and destroyed. Private sector organisations set their own scheme, often with three to five levels such as public, internal, confidential and restricted. The value comes from linking each level to concrete handling rules, not from the labels themselves.

Australian Government agencies use the scheme in the Protective Security Policy Framework. The Australian Government Style Manual describes four security classifications, OFFICIAL: Sensitive, PROTECTED, SECRET and TOP SECRET, with OFFICIAL used for routine government information. That scheme is designed for government information. It is not a requirement for private organisations’ own data, although it can be a useful reference point.

Data quality dimensions

Quality is not a single measure. Organisations commonly assess it across dimensions such as:

• accuracy: does the data reflect reality
• completeness: are required values present
• timeliness: is it current enough for its use
• consistency: does it agree across systems
• validity: does it conform to the defined format and rules
• uniqueness: is each real-world entity recorded once.

The dimensions that matter depend on the purpose. A mailing list needs current addresses. A clinical or credit decision needs accuracy and completeness. Stewards should set measurable rules for the dimensions that matter, with thresholds approved by the owner.

Lineage

Lineage records where data comes from, how it is transformed and where it goes. Business lineage describes this in terms of processes and reports. Technical lineage traces it through systems, pipelines and code. Lineage lets you answer questions that otherwise take weeks: which reports use this field, which systems must be updated when a customer asks for correction, and what data trained a model.

The Australian obligations it supports

Data governance is not itself a legal requirement under the Privacy Act, but it is how organisations meet several requirements that are in force.

APP 10 requires an APP entity to take reasonable steps to ensure the personal information it collects is accurate, up to date and complete, and that the information it uses or discloses is, having regard to the purpose, accurate, up to date, complete and relevant. The OAIC’s guidelines suggest steps such as practices and systems to audit, monitor and correct information, recording information in a consistent format, and checking the quality practices of third parties who supply information. Those are data stewardship activities.

APP 11 requires reasonable steps to protect personal information from misuse, interference and loss, and from unauthorised access, modification or disclosure, and to destroy or de-identify it once it is no longer needed for a permitted purpose. Since amendments in the Privacy and Other Legislation Amendment Act 2024, APP 11.3 states that reasonable steps include technical and organisational measures. The OAIC’s guidelines point to governance, policies, training and practices that identify information due for destruction. Retention decisions need an owner, and destruction needs a custodian who can find every copy.

AI readiness

AI systems magnify the state of the data beneath them. Poor definitions, unknown lineage and unmanaged access become harder to detect once data has been used to train or prompt a model.

The Guidance for AI Adoption, published in October 2025 and developed by the National AI Centre, sets out six essential practices, from deciding who is accountable to testing, monitoring and maintaining human control. It is voluntary. It asks organisations to extend their data governance and cybersecurity practices to AI systems, and to share key information across the AI supply chain, including training data sources. Organisations with owners, glossaries, classification and lineage in place can do this. Those without them generally cannot.

A worked example (illustrative)

This example is fictional and generic.

A regional health provider wants to use its patient contact data set to send appointment reminders and, later, to support an AI tool that predicts missed appointments.

• The owner is the executive responsible for patient services. She approves the reminder use, rules out marketing use, and sets a retention rule for inactive records.
• The steward is the outpatient bookings manager. He defines “active patient” in the glossary, sets quality rules for mobile number validity and address currency, and reports monthly on both.
• The custodian is the IT applications team. It restricts access to the bookings and reminder systems, applies the provider’s “restricted” classification controls and runs the destruction process for records past retention.
• Before the AI tool is considered, the steward and custodian document lineage from the booking system to the proposed model, and the owner decides whether the data is fit for that purpose.

No new platform was needed. What changed was that each decision had a named person behind it.

General information, not legal advice. Confirm how the Privacy Act and any other obligations apply to your organisation with your legal adviser.