Cloud Computing: A Gathering Storm for Data Governance?

In the latest of Trillium Software’s Hashtag chats (see #DQChat for details of the discussion) I moderated a session focusing on the rapid growth of Cloud Computing and its impact on Data Governance. We explored questions such as: How is Cloud impacting Data Governance? What are the major issues to be addressed? How can these be tackled? How does Data Governance as a discipline need to evolve to meet these challenges? Is Cloud a gathering storm for Data Governance and its practitioners or a sunlit window of opportunity?

As usual these questions generated many opinions and a few disagreements. There was however strong consensus that Cloud is radically changing the traditional Data Governance paradigm. Increasingly the storage and management of data in the Cloud, held as it is outside the traditional physical boundaries of organisations, means that Data Governance has to shift from being largely an inward facing activity to one where active involvement with external third party suppliers of IaaS, SaaS, etc. becomes the norm. One outcome is, as one participant contended, that it ‘makes the need for Data Governance greater than ever’. But it also requires Data Governance practitioners to develop new commercial skills in contract management, negotiation, SLAs and so on.

And Data Governance is a critical enabler to effective management of data in the Cloud. Many remain concerned about the threats to data security & privacy, especially with regard to personal & financial data, in the multi-tenanted hosted world which characterises public Cloud provision. Worries were also expressed (rooted in one participant’s personal experience) that some Cloud providers do not adhere to industry best practices in data management and security. A final worry expressed by several was that Cloud makes it harder for organisations to ensure they remain compliant with general and industry specific legal and regulatory requirements for data storage and usage. Knowing where your data is physically located is critical, not always easy when the Cloud provider could potentially store it in Delhi, Dresden or Des Moines.

So how do you ensure that Data Governance can be effectively applied in this environment? The main suggestions included ensure you address these requirements up front as part of any due diligence activity or contractual negotiation. Second, be very clear about what sorts of data you migrate to the Cloud. Active personal data needs much more rigorous monitoring and management than historic or archival data, so plan accordingly. Third, if you are a global player, ensure you develop data domain expertise across different countries & territories, as this will enable you to ensure you adhere to specific industry and national laws and regulations. Data quality was also viewed as critical. Ensuring your data fitness is known and measured before, during and after migration to the Cloud makes it much more readily controlled and monitored. Finally, and perhaps most important of all, if you are a Data Governance professional and are not active in the formulation of your company’s Cloud strategies, get involved. Highlight the potential pitfalls and ensure Data Governance is an integral and critical part of the strategy, not an afterthought, probably invoked because something has gone badly wrong.

Overall the main conclusion of the chat was that Cloud is indisputably a radical game changer for Data Governance; outsourcing responsibility for data storage is one thing but you cannot outsource Data Governance. It remains your data and your ultimate responsibility. So evolve your Data Governance strategies and practices to a federated model, where Cloud buyers and providers work together to ensure data is managed ethically and legally. Cloud provides a great opportunity for Data Governance and all who care about it. After all, clouds, even storm clouds, have a silver lining.