Plan and prioritise · Add-on
Handle data ownership, lineage and access
Know who owns each data source, where data comes from and who can see it. Good governance keeps data safe, legal and trusted.
About 3-5 daysEvergreenLast reviewed 5 November 2026
Who this applies to
- Skills it builds
- Data and measurementTechnical and AI fluency
- PM types
- Data
- Product types
- All
- Starting points
- All
- Ways of working
- All
- Experience
- All
- Size of organisation
- All
Steps, by experience
Beginner (under 1 year)
- List each data source, its owner and what it contains.
- Mark any personal or sensitive data.
- Agree who can access what, and how access is granted.
- Record where data comes from and how it is changed, so people can trace it.
- Agree how long data is kept and when it is deleted.
Intermediate (1 to 4 years)
- Catalogue sources, owners and sensitivity.
- Define access rules and lineage.
- Agree retention.
Experienced (5+ years)
- Design federated ownership with clear standards.
- Automate access and lineage tracking.
- Align with legal and security policies.
Who can do this
Owner: Product manager
Can be delegated to
- Policy / Legal / Compliance: Advise on sensitive data, access and retention
- Data Analyst: Build the data catalogue
Reviewed by: Policy / Legal / Compliance, Architect
Tool examples
- Confluence
- Keep a data catalogue with owners and sensitivity.
- Google Cloud
- Use access controls and data catalogue features.
- Azure
- Use role-based access and data governance tools.
Definition of done
- Sources, owners and sensitivity catalogued
- Access rules agreed
- Retention agreed
Common pitfalls
- No clear owners
- Broad access 'to be safe'
- Keeping data forever
If you lead the team
What good looks like: Every data source has an owner, known lineage and controlled access.
Ask your PM
- Who owns each data source, and who can see it?
- How would we answer a data subject's request?
Warning signs
- No one can say where a number came from.
- Access is granted by default and never reviewed.