Data Governance
Policies, roles and processes that ensure data used across the AI lifecycle is fit for purpose, traceable, secure and managed in line with legal and operational requirements.
How the laws define this
Regulators consistently define data governance as an overarching framework of policies, technical controls, and operational processes managing data quality, security, privacy, and accessibility throughout the dataset lifecycle to support lawful, trustworthy artificial intelligence development. These instruments agree that governance must align data handling with legal compliance, interoperability, and secure storage. However, they diverge on whether the primary operational focus is enabling broad data sharing and open-data initiatives or enforcing restrictive protections and specific accountability constraints. Instruments like the Digital Strategy for Cyprus 2020-2025, Finland’s Artificial Intelligence Programme, and NAISR 2.0 emphasize open data principles, data marketplaces, and cross-sector sharing. Conversely, frameworks such as the Kaohsiung Smart Lighthouse AI Program and the Media Guide on the Use of Artificial Intelligence in Kenya prioritize strict data minimization, purpose limitation, and record-keeping for journalistic auditability.
Synthesised from the 21 statutory definitions below. Each one is quoted in full, with its source.
How jurisdictions differ
What is distinctive in each definition, binding law in force first. Showing 10 of the 21 instruments that define this term; all are listed under Definitions below.
| Jurisdiction | Instrument | Status | What is distinctive |
|---|---|---|---|
| Brazil | Ordinance MCTI No. 4,979, of July 13, 2021 | In Force | Adds infrastructures and practices ensuring quality, availability, interoperability, sharing and responsible use of public and private data underpinning AI development and deployment. |
| Argentina | Disposition 2/2023 – "Recommendations for a Trustworthy Artificial Intelligence" | In Force | Adds recommendations for controls for data minimisation, provenance, documentation via data inventories and ties data governance to privacy protections and procurement specifications. |
| Estonia | AI and Data Action Plan (Kratt) 2024–2026 | In Force | Adds legal, organisational and technical measures enabling responsible data availability across public and private sectors as foundation for interoperable data sharing and GDPR compliance. |
| Italy | Three‑Year ICT Plan for the Public Administration 2024-2026 | In Force | Adds enterprise data governance models, data quality metrics, open data provisions and responsibilities for data stewardship and cataloguing across public administrations. |
| Kazakhstan | Concept of Digital Transformation, ICT Industry Development and Cybersecurity for 2023–2029 | In Force | Limits to institutional and technical arrangements for government and public-sector data, including metadata catalogs, shared platforms and rules for administrative data use. |
| Malaysia | National Artificial Intelligence Office (NAIO) | In Force | Adds rules and technical controls for dataset consolidation, public data stewardship and lawful cross-sector data use to support secure AI systems. |
| Taiwan | Kaohsiung Smart Lighthouse AI Program | In Force | Adds emphasis on data minimization, purpose limitation, data protection by design and by default, plus mechanisms for open and shared non-sensitive data. |
| Chile | Action Plan of the National AI Policy | In Force | Adds technical infrastructures, data catalogues, access policies and provenance tracking to ensure high-quality, interoperable and ethically sourced data. |
| Spain | Basque Country AI Strategy | In Force | Adds overall management of availability, usability, integrity and security especially for data generated by Basque industry within the digital ecosystem. |
| African Union | Continental Artificial Intelligence Strategy | In Force | Limits to robust systems ensuring data protection, privacy, quality and secure sharing specifically for AI development across the African Union. |
What it triggers
- In Estonia, the AI and Data Action Plan sets out arrangements for responsible data availability, quality, access and privacy-preserving use across public and private sectors.source
- In Italy, the Three-Year ICT Plan for the Public Administration 2024-2026 establishes policies and processes to ensure data quality, stewardship and interoperability across public administrations.source
- In Malaysia, the National Artificial Intelligence Office describes rules governing collection, use, sharing, quality and provenance of datasets used in AI systems.source
Definitions (21)
The set of policies, processes and controls governing data collection, quality, minimisation, provenance, storage, access controls and lifecycle management to ensure lawful, ethical and auditable use of data in AI systems. The Recommendations tie data governance requirements to privacy protections, documentation (data inventories) and procurement specifications.
Policies, technical infrastructures and processes to ensure high-quality, interoperable, securely stored, and ethically sourced data, including data catalogues, access policies and provenance tracking to support trustworthy AI development and reuse.
The set of policies, standards, infrastructures and practices for ensuring quality, availability, interoperability, sharing and responsible use of public and private data that underpin AI development and deployment, including data-sharing frameworks and access provisions described in the EBIA Annex.
Arrangements encompassing legal, organisational and technical measures that enable responsible data availability, quality, access, consent management and privacy‑preserving use across public and private sectors. The plan frames data governance as the foundation for interoperable data sharing, trustworthy data pipelines, and compliance with GDPR and related rules.
Operational rules and practices governing the management, sharing and reuse of data, emphasizing open data principles combined with privacy-preserving mechanisms and compliance with applicable data protection law to ensure lawful, secure and ethical data use across public sector projects.
Principles and practices to make data findable, accessible, interoperable and reusable (FAIR) for innovation while ensuring lawful processing and privacy safeguards; includes use of MyData principles, documentation of lawful bases, and processes like DPIAs to manage risk.
Policies, roles and processes established to ensure data quality, stewardship, interoperability and reuse across public administrations, including enterprise data governance models, data quality metrics, open data provisions and responsibilities for data stewardship and cataloguing.
A framework covering lawful processing, consent management, data minimization, retention policies, quality controls, and cross-sector stewardship to ensure privacy-respecting, secure, and appropriate use of data in AI development and deployment.
Institutional and technical arrangements for the collection, classification, storage, sharing and protection of government and public-sector data, including metadata catalogs, shared platforms and rules for administrative data use.
Rules and technical controls governing the collection, use, sharing, quality, and provenance of datasets used in AI systems, including privacy-preserving practices and compliance with data protection laws. NAIO emphasizes data governance to support secure dataset consolidation, public data stewardship, and lawful cross-sector data use.
The technical, legal, and institutional arrangements for interoperable data architectures, secure data sharing, and stewardship of datasets used for AI, implemented consistent with the Philippines' Data Privacy Act (RA 10173) and NPC guidance. NAISR 1.0 frames data governance as enabling infrastructure for AI adoption and reuse while ensuring privacy and compliance.
The set of policies, procedures, standards, and responsibilities governing the collection, storage, sharing, protection, and use of data to ensure privacy, security, quality, and appropriate access for AI systems. In this policy, data governance frames how data supporting AI should be managed consistent with Rwanda's Data Protection and Privacy Law (Law No. 058/2021).
Frameworks, policies, and practices for managing data quality, accessibility, interoperability, privacy, and security across sectors. NAISR 2.0 prioritizes data governance to balance open-data initiatives, data marketplaces, and protection of sensitive information to enable responsible AI value extraction.
The policies and practices governing how data used by AI systems is collected, stored, shared, secured, and made available, emphasizing data minimization, purpose limitation, data protection by design and by default, mechanisms for open and shared non-sensitive data, and measures to ensure data quality and integrity for trustworthy AI operation.
The set of policies, standards, roles and technical measures that ensure data quality, interoperability, privacy protection, stewardship, access controls and, where applicable, data sovereignty; intended to guide responsible data sharing, open data practices and compliance across public sector AI initiatives.
The policies and stewardship arrangements governing data access, sharing, privacy protections, and security, including mechanisms to enable appropriate data sharing for public-interest projects while aligning with privacy, national security, and ethical priorities. The Document positions data governance as a cross-cutting layer to be operationalized by implementing agencies.
The set of policies, processes and record-keeping practices that govern the collection, storage, access, provenance, use, retention and auditing of datasets and models used in journalistic and editorial AI workflows, intended to protect privacy, ensure accountability, and support complaints-handling.
An operational concept encompassing the structures, roles, policies, and processes that enable secure, lawful, and value-creating data sharing and interoperability across public and private actors. In the strategy it underpins recommendations for privacy, data exchange, and national data management.
Defined as the set of policies, technical controls, standards and agreements that enable secure, privacy-preserving sharing, access, storage and reuse of data across public and private entities, including anonymization, security controls and data-sharing agreements.
Data Governance refers to the overall management of the availability, usability, integrity, and security of data used within AI systems and the broader digital ecosystem. This includes establishing policies, standards, and procedures to ensure data quality, privacy, and ethical handling, especially for data generated by Basque industry.
Data governance refers to robust systems that ensure data protection, privacy, quality, and secure sharing for AI development. It is highlighted in relation to the need for robust systems that ensure data protection, privacy, quality, and secure sharing for AI development.
Not to be confused with
Data quality is one specific attribute of fitness for purpose in datasets, whereas data governance encompasses broader policies, roles and processes ensuring overall data management.
Data provenance is documentation of data origin and transformations, while data governance includes wider policies and processes covering quality, security and access.
Data stewardship refers to institutional practices for curating and maintaining datasets, whereas data governance sets the overarching policies, roles and processes including stewardship.
Questions and answers
What does data governance cover in national AI strategies?
Data governance in national AI strategies typically includes policies, standards and processes for data quality, privacy, sharing and security. It often emphasizes interoperability and compliance with data protection laws. Several definitions highlight public sector data stewardship and cross-sector arrangements.
How does data governance relate to privacy in AI policies?
Many definitions tie data governance to privacy protections, consent management and privacy-preserving techniques like anonymization. It ensures lawful and ethical data use across AI lifecycles. This is prominent in guidelines from Argentina, Estonia and Malaysia.
What are distinctive elements of data governance in public sector AI plans?
Public sector plans often add enterprise models, data catalogs, open data provisions and technical infrastructures for interoperability. They focus on government data sharing platforms and stewardship roles. Examples include Italy's ICT Plan and Kazakhstan's digital transformation concept.
Related Terms
Data Quality
The fitness of dataset(s) for an AI system’s intended purpose, judged by attributes like relevance, accuracy, representativeness, completeness and provenance....
Data Provenance
Documentation of data origin, collection, and transformations for AI systems....
Bias Mitigation
Measures to identify and reduce discriminatory outcomes in AI systems....
data stewardship
Institutional practices for curating, maintaining and controlling datasets....