TL;DR
Ten data governance trends shape enterprise security in 2026, and three lead them, all about who and what can reach your data. First, control what AI agents can access. Second, stop AI assistants from surfacing files that were shared too widely. Third, keep audit evidence up to date all the time. If you sell high-risk AI in the EU or send personal data abroad, handle those legal duties first. Start small: check who can see what, automate one policy and build an evidence pack in 90 days.
Key Takeaways
AI assistants and agents read enterprise data at machine speed, so governance now decides what they can reach.
Give every AI agent its own identity, permissions scoped at runtime and a named human owner, since agents act on their own.
IBM’s 2026 Cost of a Data Breach report puts the global average breach at $4.99 million, a record high.
Labels, active metadata and lineage turn written policy into controls that run on every query rather than at review time.
EU AI Act Article 10 and the US DOJ Data Security Program also turn governance into dated legal duties.
Prove progress with three numbers: sensitive data labeled, oversharing findings closed and time to answer an auditor.
When a Copilot Answer Exposes the Wrong File
Picture a regional sales rep asking the company’s AI assistant for a commission plan template. Then the answer comes back with a spreadsheet attached, listing the salary and bonus of every employee in the region.
Nothing was hacked. Years earlier, someone shared the file’s team site with the whole company, and nobody ever gave the file a sensitivity label. So the assistant simply respected the permissions it found, even though those permissions were wrong.
Awkward questions follow. Who owned that file’s label, and who approved company-wide access? Can anyone show an auditor, before the day ends, who else retrieved it? These are governance questions, but in 2026 they arrive as security incidents.
This guide covers the ten data governance trends that answer them, together with the control each trend needs. It also suggests an order to adopt them in. Because it stays on security and control, see our separate guide for lakehouse, FinOps and other platform and data-ops trends .
Why Data Governance Became a Security Problem in 2026
Data governance used to mean definitions, owners and quality rules, a discipline that sat next to security rather than inside it. Since then, three forces have pulled the two together.
The first is AI. Copilots and agents read, summarize and act on enterprise data at machine speed. So a loose permission that once exposed one file to a curious colleague can now surface thousands of records to anyone who asks.
Regulation is the second force. Rules now name data practices directly, for example in the EU AI Act’s duties for training data. The US Department of Justice also restricts who may access bulk sensitive data. Similarly, the SEC asks listed companies to describe how they govern cyber risk.
Cost is the third. IBM’s Cost of a Data Breach 2026 report puts the global average breach at $4.99 million, up 12% and a record high. The same report also tracks a 56% increase in AI-driven attacks. In addition, it prices an AI model inversion attack at about $6 million on average.
Together these change what a governance program is for. It still defines and documents data, as our guide to governance fundamentals explains. Its job in 2026, however, is to make sure people, copilots and agents touch only the data they should, and to prove it on demand.
If you are building the program from scratch, set up a governance framework first. Then use the trends below to decide what to tighten.
Trend 1: Governing AI Agents and Non-Human Access
An AI agent is software that takes actions on its own. So it needs what any employee needs before touching data: an identity, permissions and someone accountable for it.
Take a procurement agent that reads supplier contracts and drafts purchase orders. If it runs under a shared service account with access to all of finance, one poisoned document can steer it toward payroll. The agent is not malicious, but its permissions are far wider than its task.
Security bodies now treat this as a named risk. For example, the OWASP Top 10 for Agentic Applications , published on December 9, 2025, lists Identity and Privilege Abuse as ASI03. IBM’s breach research also calls for identity-based access controls for agents, tightly scoped permissions enforced at runtime, and human attribution so every action is auditable.
In governance terms, the agent becomes a data consumer with its own entry in the catalog. Its permissions are granted per task and expire, while its reads and tool calls land in the same audit log as a person’s. Our guide to agentic AI governance covers the operating model.
The protocol layer matters as well, because MCP and context-aware AI agents decide which tools and data sources an agent can reach at all. A tight connector list is the cheapest access control you will ever write.
Before an agent goes live, run through this short checklist:
Give each agent its own identity instead of a shared service account.
Scope permissions to the task, then enforce them at runtime as well as at deployment.
Name a human owner who answers for the agent’s actions.
Log every data read and tool call alongside human activity.
Review agent access on a schedule, and remove permissions once the task ends.
Read More: AI Governance: What It Is and How It Works in Enterprises
Trend 2: Oversharing Controls for Copilots and Generative AI
Generative AI changes the governance question from who can open a file to what an assistant can retrieve on someone’s behalf.
Microsoft says its Copilot only surfaces organizational data to which individual users have at least view permissions. That sounds safe until you remember how many files were shared with everyone over the years. Before AI, those files were hard to find. Now one well-phrased prompt can surface them, as the payroll example above shows.
Oversharing control is the response. Microsoft’s Data Security Posture Management for AI in Purview, for instance, runs risk assessments that identify, remediate and monitor oversharing. It also ships ready-made policies that stop sensitive data from leaking through AI prompts. Its newer version extends that coverage to AI apps and agents.
The wider principle is zero trust applied to data. Never assume a source is trustworthy because it sits inside the network. Equally, never assume a file is safe for an assistant just because it sits on an internal site. Our guide to data security posture management explains how posture scans find exposed data before an assistant does.
A sensible first move is narrow, and the session Data Security Risks in AI: How Microsoft Purview Protects You covers it in depth. Run an oversharing assessment on the sites your pilot users touch, and fix the worst sharing links. Only then widen the assistant’s rollout.
Watch on YouTube
Elevating Enterprise Productivity and Security with Copilot and Purview
Kanerika shows how Microsoft 365 Copilot and Microsoft Purview work together, so the productivity gains from an assistant do not come at the cost of exposed data.
Trend 3: Classification and Sensitivity Labels That Travel With the Data
A sensitivity label is a tag that tells every system how a piece of data must be handled. The trend, then, is about making that tag stay with the data wherever it goes.
Folder permissions protect a file only while it sits in the folder. Once someone downloads it, emails it or pastes it into a chat, the folder no longer matters. Labels close that gap.
In Microsoft Purview , a label can apply encryption and content markings. When you set a default label on a SharePoint library with extended protection, the permissions travel with the downloaded file. So a contract that leaves the building stays locked to the people meant to read it.
The scope is widening too. GenAI reads documents, slide decks, scanned forms and images as well as database columns. Classification therefore has to reach unstructured content, not only tables. Keep the scheme short enough that people apply it correctly, since four levels is a common and workable pattern:
Label Control it triggers Example
Public No restriction beyond a public marking Published product sheets General Internal access, but no encryption Team meeting notes Confidential Encryption, no external sharing and DLP on AI prompts Customer contracts Highly Confidential Encryption and named groups only; can be set to keep content out of assistant answers Payroll and health records
Labels only work when the classification behind them is consistent across sources. That is exactly where one healthcare provider started its Purview program.
Case Study
90% Compliance Adherence for Healthcare with Purview
A top North American healthcare organization built a Purview catalog and classification framework across Azure, SQL and SaaS sources, cutting data discovery time by 57%.
Read the Case Study → Trend 4: Active Metadata and Policy-as-Code Enforcement
Written policy is only as strong as the last person who remembered to apply it. Active metadata and policy-as-code take that memory out of the loop. The catalog triggers actions, and a rule written once is enforced by the platform on every query.
Compare the old approach. A policy document says customer Social Security numbers must be masked for analysts. Someone builds the mask in one report but forgets it in another, and a quarterly review finds the gap months later.
With policy-as-code, the rule lives in the platform, so every query from every tool gets the same answer. Databricks Unity Catalog works this way. It enforces access control on queries and model calls, supports attribute-based policies with row and column controls, and logs activity for audit. Its ABAC policies apply one masking function to every column that carries a sensitive tag, across many tables. At its simplest, a column mask takes a few lines of SQL:
-- Full SSNs for the customer verification team only; everyone else sees a masked value
CREATE FUNCTION ssn_mask(ssn STRING)
RETURN CASE WHEN is_account_group_member('customer_verification') THEN ssn
ELSE '***-**-****' END;
ALTER TABLE customers ALTER COLUMN ssn SET MASK ssn_mask;The same idea drives automated responses. When a scan tags a new column as sensitive, the platform can mask it, quarantine the table or alert its owner, with no ticket. Our guide to automating governance policies walks through the setup step by step.
In practice, the difference shows up most clearly in daily operations:
Task Manual governance Policy-as-code
New sensitive column Found at the next review Masked once it is tagged Access request Ticket, email approval, then a manual grant Granted through a governed path with an expiry date Audit question Spreadsheets assembled by hand Answered by a query against the audit log Policy change Update every report and tool Change the rule once, then every tool follows
Manual review still has a place for edge cases. It simply stops being the control that everything else depends on.
Trend 5: Lineage, Quality and Provenance as Audit Evidence
When a regulator asks which sources fed a credit-scoring model, the answer is either a lineage graph or weeks of interviews. Lineage is the record of where data came from and what happened to it on the way, and auditors increasingly treat it as evidence.
A board member asking why two revenue dashboards disagree faces the same choice. With lineage, the team traces the number back through each transformation to the source system in hours.
The platforms now build this in. Unity Catalog tracks lineage for the data and AI assets it governs, while Snowflake’s Horizon Catalog covers data quality, end-to-end lineage and AI guardrails.
Quality checks change role in the same way. A failed freshness or completeness test becomes a logged event that an auditor can review later.
Clean records also pay off outside audits. Marketing is a good example, since clean prospect and contact records make activities for link building , such as outreach and follow-ups, far easier to track.
Migrations are where lineage earns its keep. When data moves from a legacy warehouse to a lakehouse, lineage shows that every field arrived and no masking rule was dropped. Our guide to data lineage covers the tooling. In the end, the evidence an auditor asks for usually comes down to four records:
Source: the system and owner each dataset came from.
Transformations: every join, filter and calculation applied along the way.
Quality results: which checks ran, and whether they passed or failed.
Consumers: the reports, models and agents that used the result.
How large enterprises keep that evidence intact while data is on the move is the subject of the podcast episode below.
Trend 6: AI Regulation Turning Into Data Obligations
AI regulation is turning into data regulation, because the rules for high-risk AI are largely rules about the data used to build it.
Article 10 of the EU AI Act is the clearest case. It sets quality criteria for the training, validation and testing datasets of high-risk AI systems. Those datasets must be relevant, sufficiently representative and, to the best extent possible, free of errors and complete. Its governance duties also cover design choices, data collection, preparation and the examination of bias. So these are data governance tasks under a legal name.
According to the EU AI Act implementation timeline , as amended by the Digital Omnibus on AI, the Act entered into force on August 1, 2024. Prohibited practices and AI literacy duties have applied since February 2, 2025, and general-purpose AI rules since August 2, 2025.
High-risk systems listed in Annex III follow on December 2, 2027, and AI built into regulated products under Annex I on August 2, 2028. That leaves a defined window to document datasets before the rules apply.
Bias work changes character too, since it now needs dataset documentation, owners and a record of what was checked:
Article 10 duty Governance control Evidence to keep
Relevant, sufficiently representative data Purpose and population documented before training A dataset card with known gaps Free of errors and complete, to the best extent possible Quality checks on each training data version Check results per version Bias examined Bias tests before release Test reports and fixes Choices recorded Lineage from source to training set Lineage graph and approvals
Treat this as one part of a wider AI governance framework , together with practices such as AI TRiSM . The AI governance checklist helps teams confirm nothing is missed before the high-risk dates arrive.
Trend 7: Privacy-First Governance, Consent and Permissioning
Privacy-first governance means a person’s consent, and the purpose they agreed to, travel with their data into every system that uses it.
In the US, the pressure comes from the states. The IAPP US State Privacy Legislation Tracker follows consumer privacy bills and enacted laws, each with its own rights and opt-out rules. In Europe, GDPR already ties processing to a lawful basis and a stated purpose. Large enterprises cannot write one policy per law, so they need consent stored once and enforced everywhere.
Here is the gap in practice. A customer opts out of marketing use in the CRM, but the same email address also sits in a lakehouse table. That table feeds a churn model and a campaign tool. While the CRM honors the opt-out, the other two never hear about it.
Closing that gap is a permissioning problem. Consent and permissioning platforms such as Ketch enforce consent, rights and intended-use policies across connected systems. Whatever the tool, the pattern holds: record the purpose with the data, check it at the point of use and then log the decision.
This also makes privacy requests cheaper to answer. When consent is tracked centrally, an access or deletion request becomes a lookup rather than a search across every copy.
Trend 8: Data Sovereignty and Cross-Border Transfer Controls
Where a dataset sits and who can reach it can now cost more than a billion euros, as Meta found out. Data sovereignty is the principle that data stays subject to the laws of the place it comes from. Transfer controls decide where it may go.
In May 2023, Ireland’s Data Protection Commission fined Meta Ireland EUR 1.2 billion over transfers of EU and EEA personal data to the US. The transfers were made in connection with Facebook, and the regulator also ordered Meta to suspend future transfers.
Since then, the legal route has changed. The EU-US Data Privacy Framework rests on a Commission adequacy decision that lets personal data flow from the EU to participating US companies. Governance teams still need to know which recipients take part, which transfers rely on other safeguards and where copies sit.
Meanwhile, the US has outbound rules of its own. The Department of Justice Data Security Program , effective April 8, 2025, restricts countries of concern from accessing US government-related data and bulk sensitive personal data. That category includes genomic, geolocation, biometric, health and financial data.
For a governance team, these rules become three questions per dataset: where is it stored, who can reach it and from which country.
Rule What it governs Governance control
GDPR transfer rules (the DPC Meta decision) Personal data leaving the EU and EEA A transfer register with approved routes EU-US Data Privacy Framework Transfers to participating US companies Check participation before sharing DOJ Data Security Program Bulk sensitive US data and countries of concern Tag bulk sensitive data, then restrict access by vendor and location
Residency tags make these checks routine. For instance, policy can block a table tagged EU-only from replicating outside the EU. The block itself becomes part of the audit trail.
Kanerika Service
Data Governance Services
Kanerika designs and implements classification, access policies, lineage and compliance evidence on Microsoft Purview, Fabric and Databricks.
Explore Data Governance Services Trend 9: Federated Ownership and Self-Service With Central Guardrails
Federated governance splits the work: business domains own their data products, while a small central team owns the policies and the evidence.
Central-only governance breaks at scale. One team cannot know the meaning of every finance, supply chain and clinical field, so requests queue up and people route around the process. Fully decentralized governance fails the other way, because every domain invents its own labels.
The 2026 pattern sits between the two. Domains define and certify their data products, while the central team sets the classification scheme, access policies and audit requirements.
Self-service still works, but only through governed paths. So a request for a certified dataset is approved quickly and logged automatically. Our piece on data accessibility covers the self-service side in depth.
Large estates often run more than one platform as well. Fabric, Databricks and Snowflake each carry native governance. So the job is to keep one set of labels and policies that maps onto all three, rather than three separate rulebooks.
Responsibility Central governance team Domain owners Platform-native controls
Classification scheme Defines labels and rules Applies labels to their data Enforces protection once a label is set Access policy Sets who may see what Approves requests for their products Enforces policy when a query runs Data quality Sets minimum standards Owns checks and fixes Runs checks, then logs results Audit evidence Collects and reports Answers for their domain Produces logs and lineage
The split also clarifies who gets called when something goes wrong. Domains fix their data, the central team fixes the rule, and the platform log shows which one failed.
Trend 10: Continuous Compliance Monitoring and Audit-Ready Evidence
Audit pain usually comes from evidence assembled in a rush the week before the auditor arrives. Continuous compliance means that evidence is collected all the time instead, so the controls can be shown working on any day.
Disclosure rules push in this direction. Under SEC Regulation S-K Item 106 , registrants describe their processes for assessing, identifying and managing material cybersecurity risks. They also describe how those risks are governed. Such a description is far easier to stand behind when dashboards show the controls running every day.
The shift is practical as well. Logs from the catalog, the labeling service and the access layer already exist. Continuous monitoring joins them into a few measures that leadership reviews monthly and auditors can sample at any time.
Six measures cover most of what an auditor or board will ask, so they make a good scorecard:
Label coverage: the share of known sensitive data that carries a label.
Oversharing findings closed: exposed sites or files fixed after each assessment.
Policy violations closed on time: DLP and access alerts resolved before their target date.
Agent identities with an owner: every agent traced to an accountable person.
Lineage coverage: critical reports and models with source-to-output lineage.
Time to answer an auditor: hours from question to evidence, once a request arrives.
Pick three to start. Label coverage, oversharing findings closed and time to answer an auditor work well, since they show whether the other nine trends are working at all.
Datasheet
Elevate Data Governance, Compliance and Security
A datasheet on how Kanerika approaches governance, compliance and data security for enterprise estates, with the scope of a typical engagement.
Download the Datasheet → Which Data Governance Trends Should You Prioritize First?
The right starting point depends on where your exposure sits, so the order of the ten data governance trends changes with your situation. Find the row that matches your estate:
Your situation Start with these two trends First control Owner
Copilot or GenAI rollout under way Trend 2 oversharing, then Trend 3 labels Oversharing assessment on pilot sites CISO with the Microsoft 365 admin AI agents in pilot or production Trend 1 agent access, then Trend 10 evidence Own identity and scoped permissions per agent Platform owner with security High-risk AI for the EU market Trend 6 AI Act duties, then Trend 5 lineage Dataset documentation for each high-risk model AI product owner with data governance Personal data crossing borders Trend 8 transfers, then Trend 7 consent Transfer register with residency tags DPO with the data platform lead Several platforms, many domains Trend 9 federation, then Trend 4 policy-as-code One label scheme mapped to each platform Chief data officer
Whichever row fits, the first 90 days follow the same sequence. Each step produces something an auditor can see, so the order matters as much as the steps.
Assess: run an oversharing and label-coverage baseline on the data your AI tools touch.
Label and restrict: apply the label scheme to that data, then remove broad sharing links.
Automate one policy: turn your most-violated rule into policy-as-code with logging.
Build the evidence pack: report the three starting measures and keep the logs auditors will sample.
Ninety days will not finish a program. Still, it proves the controls work on real data and gives you baseline numbers to expand from domain by domain.
Governance Platforms Mapped to the 2026 Trends
Most of these trends are now built into the major data platforms. So the practical question is which platform covers which trend in your estate.
Platform Strongest on What it covers
Microsoft Purview Trends 2, 3 and 10 Sensitivity labels with encryption, DSPM for AI, DLP for AI prompts Databricks Unity Catalog Trends 1, 4 and 5 Access control on queries and model calls, attribute-based policies, lineage, audit logs Snowflake Horizon Catalog Trends 1, 4 and 5 Masking and row-access policies, data quality monitoring, end-to-end lineage, AI guardrails on agent outputs
This is a capability map rather than a ranking. For a side-by-side look at catalogs and governance suites, see our data governance tools compared guide. Running two of these platforms side by side works well, so long as one label scheme and one evidence process sit above them.
Case Study: 90% Compliance Adherence for a Healthcare Provider With Purview
A top North American healthcare organization had a familiar problem. Its data was spread across Azure Blob Storage, SQL databases and SaaS applications, but it had no consistent classification or metadata framework.
Stakeholder engagement was weak, so nobody was sure who owned which dataset or which rules applied to it. For a healthcare provider, that uncertainty is a compliance risk as well as an efficiency problem.
Kanerika built a central catalog in Microsoft Purview with metadata and classifications across those sources. The team then designed a classification framework with data steward roles and usage policies. Finally, Power BI dashboards, user guides and process documents gave staff a way to find and use governed data without guesswork.
The results were measurable:
57% reduction in data discovery time90% increase in compliance adherence70% better data accessibility
The project maps to three trends above: classification (Trend 3), catalog evidence (Trend 5) and steward roles for federated ownership (Trend 9). The full case study on governance with Microsoft Purview in healthcare also describes the rollout in detail.
How Kanerika Helps Enterprises Act on These Trends
Kanerika helps enterprises turn these data governance trends into running controls on the platforms they already own, starting with the exposure that matters most.
Engagements run in three stages, and each one ends in something the client keeps. The assessment scans for oversharing, label coverage and agent access, then delivers a ranked list of overshared sites and unlabeled sensitive data. Design produces a label scheme, a steward map by domain and access rules written as policy. Implementation puts those rules on Microsoft Purview, Microsoft Fabric or Databricks. On mixed estates, one scheme maps onto Purview, Unity Catalog or Snowflake Horizon, so every platform enforces the same rules.
Monitoring keeps the program alive after the project ends. Dashboards track label coverage, open findings and audit response time, so the evidence stays current without a scramble before each review. For a hands-on view of the platform, read our guide to governance with Microsoft Purview .
A first phase usually runs the 90-day sequence above on one business domain, then repeats it for the next. Kanerika’s data governance services cover that full sequence, while the Microsoft Purview practice handles the Purview side of the work. For the models themselves, Kanerika’s AI governance services also apply the same discipline to model risk and Article 10 evidence.
Talk to Kanerika
Mapping These Trends to Your Own Estate?
Kanerika reviews where people, copilots and agents can reach sensitive data today and sets out the first three controls to put in place.
Book a Working Session → Which Data Governance Trends Matter Most in 2026?
All ten trends point the same way, because governance is now judged by what it prevents and what it can prove.
If you can act on only three, govern AI agent access, put oversharing controls in front of every copilot and keep audit evidence flowing. Labels, policy-as-code and lineage then make those three enforceable. The other four depend on your exposure. High-risk AI for the EU puts Article 10 first, cross-border personal data puts transfer controls first, and a multi-platform estate puts federation first.
The data governance trends that matter most in 2026 are the ones that control who and what touches your data. So start with agent access, oversharing controls and continuous evidence.
Frequently Asked Questions
What are the biggest data governance trends in 2026?
The biggest data governance trends in 2026 are governing AI agent access, controlling copilot oversharing, sensitivity labels that travel with data, active metadata with policy-as-code, lineage as audit evidence, AI regulation turning into data duties, privacy-first consent, cross-border transfer controls, federated ownership and continuous compliance monitoring. Agent access, oversharing and continuous evidence usually come first.
What is the future of data governance?
Data governance is moving from documents and periodic reviews to controls that platforms enforce automatically and evidence that is collected all the time. It is also merging with security, because AI assistants and agents now reach data at machine speed. Expect governance teams to own policy and proof, while domains own their data products.
What is the difference between data governance and AI governance?
Data governance controls the data itself, including its quality, ownership, classification, access and lineage. AI governance controls models and AI systems, covering their purpose, risk, testing, monitoring and accountability. The two overlap on training data, which is why EU AI Act Article 10 reads like a data governance rule. Mature programs run them together.
What are the core pillars of data governance?
Most frameworks group data governance into a handful of pillars, namely ownership and stewardship, data quality, metadata and cataloging, security and access, and compliance. Some lists add lifecycle or literacy, which is why you see four, five or six pillars. The labels differ, but every version covers who owns data, how good it is and who may use it.
What is a data governance framework and lifecycle?
A data governance framework is the structure of roles, policies, standards and processes that decides how data is owned, protected and used. The lifecycle is the path data takes from creation and collection through storage, use and sharing to archiving and deletion. A good framework applies the right controls at each stage of that lifecycle.
What does a data governance roadmap look like, and how long does it take?
A practical roadmap starts with a 90-day phase that assesses exposure, labels and restricts the most sensitive data, automates one policy and produces an evidence pack. Later phases add domains, platforms and more policies. Timelines depend on scope, but expanding in quarterly waves is usually easier to manage than one long project with a single go-live.
What are the most important data governance KPIs?
Start with label coverage of known sensitive data, oversharing findings closed after each assessment, and time to answer an auditor’s question with evidence. Add policy violations closed within target, lineage coverage for critical reports and models, and the share of AI agents with a named owner. Track them monthly so problems show up before audits do.
How is AI changing data governance?
AI changes governance in two directions. Copilots and agents retrieve data on users’ behalf, so permissions, labels and oversharing controls decide what they can expose. At the same time, rules such as EU AI Act Article 10 set duties for training data quality and bias. Governance now covers both what AI can read and what AI is built from.
How do you govern AI agents' access to enterprise data?
Treat each agent as a data consumer with its own identity rather than a shared service account. Scope its permissions to the task and enforce them at runtime, name a human owner who answers for its actions, and log every data read and tool call. Review agent access on a schedule and remove permissions that are no longer used.
How does data governance improve enterprise security?
Governance tells security what to protect and who should reach it. Classification and labels identify sensitive data, access policies limit who and what can use it, and lineage shows where it flows. Without that map, security tools guard everything equally. With it, controls such as encryption, masking and data loss prevention land on the right data.
What is active metadata in data governance?
Active metadata is catalog information that triggers actions instead of only describing data. When a scan tags a column as sensitive, the platform can mask it, restrict access, quarantine the table or alert its owner automatically. Combined with policy-as-code, it means a rule is written once and enforced on every query from every tool.
How does the EU AI Act affect data governance?
Article 10 of the EU AI Act sets rules for training, validation and testing data of high-risk AI. That data must be relevant, sufficiently representative and, to the best extent possible, free of errors and complete. It also expects documented choices on collection, preparation and bias. Annex III high-risk rules apply from December 2, 2027, so document datasets now.
Is GDPR part of data governance?
Yes. GDPR sets legal requirements for personal data, such as lawful basis, purpose limits, data subject rights and transfer rules, and data governance is how an organization meets them in practice. Classification finds personal data, consent records track purpose, lineage shows where it flows and transfer registers control where it goes. Governance turns the law into daily controls.
How do companies govern data across multiple cloud platforms?
They keep one classification scheme and one set of access policies, then map them onto each platform’s native controls. Microsoft Purview, Databricks Unity Catalog and Snowflake Horizon each enforce permissions and record lineage locally. A central team owns the shared rules and collects evidence from all of them, so audits see one consistent picture.
What is federated data governance?
Federated data governance splits responsibility between a central team and business domains. Domains own and certify their data products, including quality and access approvals. The central team sets the classification scheme, access policies and audit requirements, and platforms enforce them. It scales better than central-only governance and stays more consistent than fully decentralized ownership.
