Ownership, data quality and master data in a model that works even when you do not have a large data team.
In short
Data governance for a mid-sized company means three things: every important dataset has a named business owner, the quality of data used in decisions is measured automatically, and customers, products and suppliers exist in one trusted version. Start with the three to five datasets behind your key reports, then expand once the model works.
Data governance is the set of roles, rules and routines that decide who owns your data, what it means and how good it has to be. For a mid-sized company it does not have to be a forty-page policy. It has to answer the questions that already cost you time: why finance and sales report different figures for the same month, who is allowed to change a customer record, and why a broken report went unnoticed for weeks.
This guide is written by Devies, a Gothenburg-based product and engineering consultancy that builds and runs data platforms for Nordic companies. It covers the roles you need, the smallest model that works, quality rules you can measure, the tooling that is actually required and a realistic plan for the first 60 days.
Roles: who owns what in data governance
A lightweight data governance model needs three roles, held by named people rather than full-time hires.
The most common mistake is to hand all ownership to IT. Governance then becomes a technical topic that nobody in the business feels responsible for, and definitions drift apart again within a year.
Data owner
A data owner is a business manager who is accountable for one dataset, for example the head of sales for customer data or the head of purchasing for supplier data. The owner decides on definitions, who gets access and what level of quality is good enough. This is a business responsibility, not an IT task.
Data steward
A data steward is the person who knows the data in practice: which fields are used, where errors usually appear and how the source system behaves. The steward follows up on quality rules and is the first point of contact when a number looks wrong.
Platform lead
A platform lead is the data or IT engineer responsible for pipelines, permissions and monitoring. This person makes sure the rules the owner has decided on are actually enforced in the technical setup.
What is minimum viable governance?
Minimum viable governance is the smallest set of decisions that makes your most important data trustworthy, applied to a handful of datasets instead of all of them.
Start with the three to five datasets that matter most. Typically that is customers, products, orders, financial results and sometimes employees. For each of them, this is enough at the start:
- An owner and a steward, named and known across the organisation.
- One definition per metric. What does "active customer" or "net revenue" mean? Write it down, together with where it is calculated.
- One source of truth. Decide which system is the master for each concept, so other systems read from it instead of keeping their own copy.
- A simple access rule. Who can read, who can change, and who approves new users.
- A forum. A short monthly meeting where owners review quality deviations and new requests.
Master data first
Master data is the core reference data that appears in almost every process: customer, product, supplier, item and account. In Swedish organisations you will often hear it called masterdata. If the same customer exists three times with different spellings in the CRM, the ERP and the support tool, every report and every AI application built on top becomes unreliable. Choosing one master system and one rule for handling duplicates often has more effect than any tool purchase.
What about data mesh?
Data mesh is a set of architectural and organisational principles in which business domains own their data and publish it as products for others to use. Zhamak Dehghani, who coined the term, describes four principles in her original write-up on data mesh: domain ownership, data as a product, a self-serve data platform and federated computational governance. The idea of domain ownership is useful at any size. The full model, with many autonomous domain teams on a shared self-serve platform, assumes a scale and maturity most mid-sized organisations do not have. Borrow the ownership idea, and keep the platform shared and simple.
Quality rules you can measure
Data quality becomes manageable only when it is measured automatically against a few explicit rules for each dataset.
Pick a small number of rules per dataset and run them in the platform at every load, not in spreadsheets once a quarter.
Dimension
Example rule
Who acts on a deviation
Completeness
Example rule
Every customer has a company registration number
Who acts on a deviation
Customer data steward
Uniqueness
Example rule
No duplicate registration numbers
Who acts on a deviation
Steward, decision by owner
Validity
Example rule
VAT rate is one of the permitted values
Who acts on a deviation
Platform lead
Timeliness
Example rule
Order data is at most 24 hours old
Who acts on a deviation
Platform lead
Consistency
Example rule
Monthly revenue in BI matches the finance system
Who acts on a deviation
Finance data owner
Set a threshold for each rule and decide what happens when it is crossed: an alert, a stopped load or simply a note for the monthly meeting. Five rules that are followed up beat fifty that nobody reads.
There is also a regulatory reason. As of October 2026, Article 5 of the General Data Protection Regulation (GDPR), which has applied since 25 May 2018, requires personal data to be accurate, kept up to date where necessary and limited to what is needed for the purpose. Clear ownership and quality rules for person-related master data make it far easier to show that you meet those principles.
AI adds a second reason. As of October 2026, the European Commission's AI Act overview states that high-risk AI systems in the sensitive areas listed in Annex III must meet strict obligations from 2 December 2027, including high-quality datasets. Even if your own use cases are not high-risk, AI models, chatbots and agents read the same customer and product data as your reports, so weak data produces confident but wrong answers.
Tooling: what do you actually need?
Tools do not solve ownership, but the right tools make the rules cheap to follow, and a mid-sized company rarely needs more than four of them.
- A shared data platform (warehouse or lakehouse) where data from source systems is collected, with separate layers for raw data, cleaned data and business-ready tables.
- Automated tests in the pipelines that run the quality rules at every load and report results to the steward.
- Access control tied to your existing identity management, so roles and groups decide who sees what.
- A simple data catalogue or glossary with the definition, owner and source for each concept. It can start as a wiki page.
Dedicated governance and master data management (MDM) platforms can make sense later, when the number of sources and users grows. Do not buy them first. A tool bought before the roles exist tends to become an expensive, empty catalogue.
The first 60 days
A realistic data governance start takes about 60 days and needs a few hours a week from a handful of people, not a new department.
Days 1-15: map. List your most important reports and decisions and trace which datasets and systems they depend on. Note where figures already differ between departments today.
Days 16-30: appoint and define. Name owners and stewards for three to five datasets. Write definitions for the ten most important metrics and decide the master system for customer and product.
Days 31-45: measure. Introduce five to ten quality rules in the platform and record a first result. That becomes your baseline.
Days 46-60: review and adjust. Hold the first owners' meeting, fix the largest deviations and choose the next dataset to bring in. Write down what worked.
After 60 days you should be able to answer three questions: who owns our most important data, how good is its quality today, and which system is the master for customers and products. If you can, you have a working foundation, even without a large data team. The same foundation is what later lets an AI assistant answer from your own documents and systems, a topic we cover in how RAG lets AI answer from your company's own data.
Keep reading
From our work
Client Case: Stena LineStena Line modernised its Azure data platform - improving Power BI reliability, reducing pipeline runtimes and scaling with medallion architecture.Read the caseDevies
Want a second opinion?
Devies, a Gothenburg-based product and engineering consultancy, works on questions like this with Nordic product and IT teams. Tell us where you are and we will suggest a sensible first step.
Frequently asked questions
Do we need a Chief Data Officer to start with data governance?
No. In most mid-sized companies it is enough to give one existing manager a clear mandate to coordinate, and to spread data ownership across the business managers who already run sales, finance and purchasing. A dedicated data leadership role becomes relevant when the number of datasets, sources and users turns coordination into a full-time job, which is usually well after the first year.
Do we need a data platform before we start with governance?
You can start with roles, definitions and the choice of master systems without a new platform. Quality rules that must be measured continuously are much easier once data is collected in one place with automated tests, so in practice the two efforts usually run in parallel. Start with ownership and definitions in the first month, and add automated measurement as the platform takes shape.
What is the difference between data governance and master data management?
Data governance is the overall model of roles, definitions, rules and routines for all important data. Master data management is one part of it, focused on keeping core records such as customers, products and suppliers consistent across systems. A mid-sized company can handle master data with a chosen master system and duplicate rules long before it needs a dedicated MDM tool.
How does data governance relate to our AI plans?
AI applications use the same data as your reports. If customer data exists in several versions or definitions differ between departments, an AI assistant or agent will give uncertain or contradictory answers, often with high confidence. Ownership, shared definitions and measured quality are therefore a precondition for moving AI from an interesting pilot to something the organisation can rely on in daily operations.
Sources
- Regulation (EU) 2016/679 (General Data Protection Regulation), Article 5
- European Commission, AI Act: regulatory framework and application timeline (checked 13 October 2026)
- Zhamak Dehghani, Data Mesh Principles and Logical Architecture, martinfowler.com
- Devies, Data Foundation Platform
- Devies, Data Hub
- Devies, Client case: Stena Line
