Data governance that is measured, not assumed.
We design the ownership, classification and policy structure for your data, including the data lakes and analytics platforms it lands in, and tie each rule to the law or contract behind it.
A policy no one can implement is not governance.
Legal duties set the rules. System design decides whether they can be followed.
What the law and contracts ask
- Purpose and storage limits on personal data
- Accuracy and erasure duties for data you rely on or share
- Sharing and processing agreements that carry the same limits downstream
- Record-keeping duties under sector laws that can conflict with erasure
- Public bodies: the RTI Act alongside the DPDP Act
What the systems must do
- An asset register and catalogue of what is held, where and by whom
- Classification at column level, with personal data tagged
- Stewardship by name, with a RACI for each data domain
- Quality rules that produce a score and a list of failing records
- Access and masking driven by classification, with lineage to show where data goes
Seven steps, one continuous loop.
Each step has an owner, a measure and a record, so progress can be reported rather than described.
One view of the data estate.
A working register that management maintains after the engagement ends, with classification, stewardship and quality in one place.
- Classification at column level. Public, internal, confidential or restricted, with personal data tagged to drive masking and retention.
- Quality as a number. Rules run across the data and produce a score, with failing records listed for correction.
- Accountability by name. Every dataset has a steward, and a RACI maps each domain to the people responsible.
- Policy tied to law. A policy library that records the instrument each policy implements.
Classification column level
| Column | Class | Tag |
|---|---|---|
| mobile_number | Restricted | PII |
| vendor_tax_id | Restricted | PII |
| contract_value | Confidential | — |
| account_open_date | Internal | — |
| ward_code | Public | — |
Policy library 6 policies in force
A data lake is where governance gets tested.
Raw data from many sources lands in one place, often before anyone has decided what it is, who owns it or how long it may be kept. We advise on the design before a lake is built and review it afterwards.
What the law and contracts ask of a lake
- Purpose limits when raw data collected for one use is reused for new analytics
- Erasure and withdrawal that reach raw, curated and backup copies, not only the source system
- Retention that balances storage limits against sector record-keeping duties
- Sharing agreements for datasets passed between departments or to third parties
- Platform contracts on data location, sub-processors, audit rights and cross-border transfer
What the lake must do
- Zones for raw, standardised and curated data, each with its own access and retention rules
- Personal data tagged at ingestion, with a catalogue and lineage for every source
- Access by classification: role-based, with masking or tokenisation of personal columns
- Erasure that works on immutable files, by row-level deletion or key destruction
- Quality rules checked when data moves from one zone to the next
- Audit logs of reads and exports that someone actually reviews
A lake governance review.
A short, evidence-based review of how a lake is designed and run, with the gaps ranked and the fixes sequenced.
- Zone and access design. Who can reach raw data, who sees only curated data, and why.
- Personal data located and tagged. Where it sits in the lake and which datasets carry it.
- Erasure path tested. A real request traced through every zone and copy.
- Promotion rules. The quality and approval checks before data is trusted for reports or AI.
Catalogue 8 of 279 datasets
| Dataset | Layer | Class | Quality |
|---|---|---|---|
| ● Asset register | Gold | Internal | 98 |
| ● Application forms | Silver | Internal | 94 |
| ● Contract ledger | Gold | Confidential | 96 |
| ● Service requests | Silver | Restricted | 89 |
| ◉ Customer master | Gold | Internal | 93 |
| ◉ Billing records | Silver | Internal | 91 |
| ● Event logs | Bronze | Internal | 78 |
| ◉ Document scans | Bronze | Public | 96 |
Lineage Customer view
Governance for government bodies and PSUs.
Public bodies carry the DPDP Act, audit expectations and the RTI Act at once. We build one control set that answers all three.
For background reading on these obligations, see the Govt and PSU data governance hub on DPDPIndia.in ↗, the knowledge portal we help manage.
Know what you hold before deciding what to buy.
A data governance study gives you the register, the owners and the gaps in one document.