How do you implement data governance and compliance programs?

Data governance establishes policies, processes, and accountability for data management across the organization. Framework: (1) Data strategy: define how data supports business objectives, identify critical data assets, and establish governance priorities. (2) Policies: data classification (public, internal, confidential, restricted), data retention (how long to keep data per category), data access (who can access what data under which conditions), and data quality (standards and SLAs per dataset). (3) Roles: data owner (business stakeholder accountable for data quality and access decisions), data steward (implements governance policies, resolves data issues), data custodian (technical team managing data infrastructure), and data protection officer (GDPR/privacy compliance). (4) Processes: data access request and approval, data quality issue management, data change management, and privacy impact assessment. Regulatory compliance: GDPR (data inventory, lawful basis, consent management, right to access/delete/port, breach notification), CCPA/CPRA (consumer rights, do-not-sell, sensitive data protections), HIPAA (PHI protection, access controls, audit trails), and SOX (financial data accuracy, change controls, audit trails). Implementation: deploy a data catalog for asset inventory, implement data classification (automated scanning for PII, PHI, PCI data using tools like BigID or Amazon Macie), enforce access controls based on classification, implement consent management for consumer data, and maintain audit logs for all data access. Data privacy: implement data minimization (collect only necessary data), purpose limitation (use data only for stated purposes), anonymization and pseudonymization for analytics, and automated data retention enforcement (delete data when retention period expires). Monitoring: track policy compliance rates, data access audit coverage, data quality SLA adherence, and incident response times.