A framework of policies, processes, and standards for managing data assets across an organization, ensuring data is secure, compliant, and properly used.
Data governance is the word I've seen most people define after the fact — when a regulator is on the line, when a sensitive column leaked into a dashboard, when a CFO asks "who owns this number?" In practice, governance is the set of decisions you should have made before any of that happened: who owns what data, who can access it, how long it's retained, how PII is classified, who gets paged when a contract breaks. It's not a tool; it's a discipline that tools support.
Ten years in, the governance programs I've seen work share three traits: (1) named owners for every high-value dataset — not a team, a person — with an SLA and a pager rotation; (2) enforced-by-default policies, not PDFs — PII tagged and automatically masked, access granted through roles, policies expressed as code; (3) a usable catalog that real analysts open — not a compliance artifact that nobody touches. Every failed governance program I've seen skipped one of these, usually the third. If your catalog doesn't have search, ownership, freshness, and a "request access" button, it's a shelf trophy.
On one engagement the team had spent 18 months and ~$400K on an enterprise catalog rollout — and nobody used it. The catalog UI was a 2012-era Java app, search was bad, and there was no link between catalog entries and Slack/Teams (where people actually asked "where's the data?"). We replaced it with Atlan plus a Slack bot that answered "what table for X?" by querying Atlan. Adoption went from ~20 weekly users to 400+ within two months. The governance program hadn't failed on policy — it had failed on user experience. Governance works when it reduces friction; it dies when it adds friction without obvious payoff.
Data governance is the framework that defines who can take what actions, on what data, under what circumstances, using what methods. It establishes accountability, policies, and procedures for managing enterprise data assets.
| Role | Responsibility |
|---|---|
| Data Owner | Strategic decisions, accountability |
| Data Steward | Quality, standards, day-to-day |
| Data Custodian | Technical implementation, security |
| Data User | Responsible use, feedback |
Governance programs fail in predictable ways:
Data governance is the set of rules, roles, and processes that answer five questions: (1) what data do we have, (2) who owns it, (3) who can access it, (4) how long do we keep it, and (5) how do we know it's trustworthy. It's not a single tool — it's an ongoing program that combines catalog/metadata tools, policy enforcement (masking, access controls), and human accountability (stewards, owners). Done well, governance reduces risk and builds trust. Done poorly, it becomes a compliance checkbox that slows everyone down without making anything safer.
Three practical reasons: (1) compliance — regulations like GDPR, CCPA, HIPAA, and SOX require demonstrable controls on how data is stored, accessed, and retained, with real penalties for failure; (2) trust — if users can't tell which dashboard is authoritative or whether numbers are fresh, they stop making data-driven decisions; (3) risk reduction — data breaches, accidental exposure of PII, and insider misuse all have governance causes at their root. A mature governance program pays for itself the first time it prevents a breach or answers an audit in a day instead of a quarter.
Data governance is the strategy — policies, standards, roles, accountability, "who decides what." Data management is the execution — the actual systems and processes that store, move, and transform data. Governance says "all PII must be masked in dashboards"; management implements the masking policies in Snowflake, wires them to BI tools, and monitors compliance. They work together: without governance, management has no compass; without management, governance is just slides. Most mature orgs have a governance council that sets direction and engineering/platform teams that implement it.
A data steward is the named human responsible for a specific dataset or domain — its quality, documentation, access policies, and response to incidents. Stewards bridge the gap between technical teams (who build pipelines) and business users (who use the data). A good steward maintains the catalog entry, approves access requests, investigates data-quality regressions, and deprecates old datasets. Stewardship at the dataset level is what turns governance from a policy document into a lived practice — it's the difference between "marketing owns their data" (vague) and "Jane Smith stewards `dim_customer`" (actionable).
Catalog + active metadata: Atlan and Alation lead the modern-data-stack category; Collibra leads on enterprise governance; DataHub is the strongest open-source option. Policy enforcement: Snowflake Horizon (masking, row-access, classification, object contacts) for Snowflake-native; Unity Catalog for Databricks; Immuta and Privacera for cross-platform ABAC. Lineage: OpenLineage as the open standard; Atlan, Alation, and dbt for specific scopes. Choose based on your stack — a Snowflake-only shop gets a lot from Horizon + Atlan; a multi-engine lakehouse typically needs a cross-platform layer.
Meaningful metrics, not vanity metrics. Useful: (1) percentage of datasets with a named owner and catalog entry; (2) catalog weekly active users (governance is working if people actually use it); (3) mean time to answer "where does this number come from?" (should drop to minutes); (4) percentage of sensitive columns with enforced masking/access policies; (5) audit-response time. Less useful: number of policies written, number of columns tagged (without checking accuracy), number of meetings held. Governance ROI shows up in incidents avoided and time saved, both of which require baseline measurement.
Horizon is Snowflake's native governance and security bundle — classification (SYSTEM$CLASSIFY), masking and row-access policies, object tags, access history, data quality monitoring (DMFs), Trust Center scanners, and object contacts. For Snowflake-first orgs it covers a lot of governance surface area without a separate platform: you can classify PII, enforce masking, audit access, and assign ownership all in the warehouse. It doesn't replace a full catalog (it's not designed for cross-source discovery UX) but it's the enforcement layer. Typical 2026 pattern: Horizon as the policy engine inside Snowflake, Atlan/Alation as the cross-source catalog on top.