What Is Information Governance? (Data Compliance)
Information governance is the way an organization assigns responsibility for its data and sets rules for using, protecting, keeping, and disposing of it. It connects privacy, security, records management, and data quality. The goal is to make information trustworthy and useful while meeting the legal, contractual, and operational duties that apply to that organization.
IBM’s 2024 Cost of a Data Breach Report put the average global cost of a data breach at US$4.88 million. That figure is not a prediction for every organization, but it shows why clear data responsibilities matter. Governance cannot prevent every incident. It can help an organization know what information it has, who may use it, and how to respond when something goes wrong.
What is information governance?
Information governance is an organization-wide system for making decisions about information throughout its life. It sets accountability, policies, and controls so data can be found and used appropriately, kept accurate, protected from improper access, retained for the right period, and disposed of safely.
Think of it as the rules and responsibilities behind the tools. A database or cloud service stores information; governance determines who can use it, what uses are allowed, and what happens when the information is no longer needed. It applies to digital files, paper records, messages, research data, and other information the organization manages.
There is no single law called “the information governance law” that applies to every organization. Duties depend on the kind of information, the organization’s activities, its location, and relevant contracts and laws. A sound program begins by finding out which obligations actually apply, rather than assuming that one policy or certification covers everything.
What does information governance cover?
Information governance brings related practices under clear decision-making and accountability. Its scope often includes data ownership, privacy, security, records management, data quality, vendor sharing, and incident response. These areas support one another, but each needs named owners and workable procedures.
A data owner is accountable for decisions about a type of information or a business use. A data steward helps apply the rules in daily work, such as maintaining definitions or resolving quality problems. Neither role automatically grants access to the data; access must still follow approved rules.
| Governance area | Practical question | Example of a control |
|---|---|---|
| Ownership and stewardship | Who makes decisions about this data? | Assign an accountable owner and a working steward |
| Classification | How sensitive is the information? | Label records using approved sensitivity levels |
| Access | Who needs access, and for what purpose? | Approve access by role and review it regularly |
| Quality | Is the data accurate and fit for use? | Set checks for required fields, errors, and updates |
| Retention | How long must records be kept? | Use an approved, record-specific retention schedule |
| Sharing | May this information go to a vendor or partner? | Review the purpose, agreement, access, and safeguards |
| Disposal | How can information be removed safely? | Use approved deletion or destruction methods and record completion |
| Incidents | Who responds to loss or improper access? | Set escalation steps and preserve relevant evidence |
A policy alone is not proof that a control works. For example, an access policy should connect to actual account settings, approval records, and reviews. The organization should also document exceptions, who approved them, and when they will be reviewed.
How do you establish an information governance program?
A governance program turns obligations into assigned work and evidence. Start with the information and risks you actually have, then set decision rights, implement controls, and check whether they work. The sequence below helps teams avoid writing broad policies before they understand their systems, data, and responsibilities.
-
Define the scope. List key data types, systems, business purposes, locations, stakeholders, and vendors. Identify where the data comes from and where it goes. Include paper records and informal processes if they contain important or regulated information.
-
Assess obligations and risks. Review applicable laws, contracts, internal commitments, and operational needs. Record the reason for each requirement and which records or systems it affects. Get qualified legal or privacy advice when applicability is uncertain; a general checklist cannot decide every organization’s legal duties.
-
Assign responsibility. Name an executive sponsor and owners for important data sets and controls. Define who may approve access, sharing, retention exceptions, and policy changes. Make escalation routes clear so staff know where to take questions.
-
Approve usable rules. Set classification levels, access standards, quality expectations, retention schedules, legal-hold procedures, vendor review steps, and disposal requirements. Explain the rules in language staff can follow. Include an exception process rather than relying on informal workarounds.
-
Implement and keep evidence. Configure systems to support the rules. Examples include access controls, audit logs, quality checks, staff training, and incident reporting. Keep records of approvals, reviews, training, tests, exceptions, and corrective actions.
-
Test and improve. Check whether controls work in practice, correct gaps, and review changes in systems, laws, contracts, and business needs. Report significant risks and unresolved findings to the people accountable for them.
One risk deserves special care: premature deletion or over-retention. A blanket schedule can destroy records that must be kept, or retain information longer than is justified. Before disposal, check the record type, applicable schedule, and any legal hold, investigation, litigation, regulatory duty, or contract that may pause deletion. Have the right records, legal, or compliance staff review uncertain cases.
Which laws and frameworks may apply?
Laws set duties for particular organizations, data, or activities. Frameworks and standards can help organize a program, but they do not automatically replace legal review. Applicability must be assessed for the organization’s actual role, information, locations, and processing activities.
| Requirement or framework | Where it may be relevant | What to keep in mind |
|---|---|---|
| FERPA | Covered U.S. education records at institutions or agencies subject to the law | It is not a general privacy law for every record held by every school-related organization |
| HIPAA | Covered entities and business associates handling protected health information | A health-related organization is not automatically covered in every activity |
| GLBA | Covered financial institutions and relevant customer information | Duties depend on the institution and applicable rules, including rules enforced by the relevant regulator |
| GDPR | Processing within the regulation’s territorial and material scope | Assess the organization’s role, the people involved, and the processing activity |
| NIST Cybersecurity Framework 2.0 | Organizations seeking a structure for managing cybersecurity risk | It is a framework, not a law that applies universally |
| NIST SP 800-53 | Control selection where the catalog is applicable | Select controls for the relevant context; the catalog does not itself establish legal compliance |
| ISO 15489-1:2016 | Records-management principles and practices | It can guide records management but does not replace applicable law |
Organizations often use more than one source. For example, a covered organization may map legal duties to internal policies and then use a security framework to organize technical controls. The important question is not “Which framework makes us compliant?” but “Which obligations apply, and what evidence shows we meet them?”
What does implementation look like in practice?
A practical example shows how the rules connect. Consider a hypothetical clinic that stores appointment information in a scheduling system and sends some information to a service provider. The example is illustrative; whether HIPAA applies depends on the organization’s legal status, activity, and the information involved.
The clinic first identifies what information the system contains, who uses it, why it is shared, and which locations and vendors are involved. It assigns an owner and checks the applicable legal and contractual duties. The owner then approves access rules, a vendor review, incident escalation steps, and a retention approach suited to the records.
Next, the clinic configures user access, records approvals, and tests whether staff can see only what their role requires. It documents the vendor’s permitted use and safeguards in the appropriate agreement, where required. It also explains how staff report a misdirected message or a lost device.
When a record reaches its scheduled disposal date, the clinic checks for a legal hold or other pause before deleting it. This is not a one-time setup: the clinic should review access, test procedures, and update the inventory when systems or uses change. The value lies in linking decisions to controls and evidence.
How can you measure whether governance works?
Metrics make governance visible, but a number is useful only when it has a defined meaning, owner, and review schedule. There is no universal target for every organization. Establish a baseline, set risk-based goals, and explain what action follows when a result falls short.
Possible measures include:
- Inventory coverage: Share of in-scope systems and data sets with a named owner, purpose, classification, and location documented.
- Access review completion: Share of scheduled reviews completed by the assigned deadline, plus the number of inappropriate or outdated permissions found.
- Retention execution: Share of records eligible for disposal that were reviewed and handled under the approved schedule, with holds checked first.
- Quality defects: Number or rate of agreed data errors, such as missing required fields, measured consistently over time.
- Training completion: Share of assigned staff who completed the training, alongside results from practical checks or exercises.
- Incident response: Time to escalate and assess incidents under the organization’s procedure, not a universal response-time promise.
- Open findings: Number, age, and risk level of audit or control issues awaiting correction.
A high completion rate does not prove that a control is effective. Pair activity measures, such as completed reviews, with outcome checks, such as whether reviews found and corrected inappropriate access. Report trends and exceptions, not just a single score.
How should students choose information governance training?
Information governance can be studied through degrees, certificates, professional development, or work-based learning. Program titles vary, so compare the published curriculum and requirements rather than relying on a label or ranking. Check the institution, total cost, delivery format, prerequisites, and current course details before committing.
Look for coursework in privacy law, records management, cybersecurity, data lifecycle and quality, risk assessment, and audit or compliance practice. Ask how students apply the material through projects, cases, or supervised work. Credit totals, GPA rules, deadlines, and tuition are set by each institution, so verify them directly.
For U.S. academic study, check whether the institution’s institutional accreditor is recognized by the U.S. Department of Education or CHEA. Information governance does not have one universally required programmatic accreditor. A degree can build knowledge, but it does not by itself guarantee a job or establish that an organization complies with the law.
Frequently asked questions
These answers summarize common information governance questions, but they cannot determine every organization’s legal duties. The details depend on the data, activity, jurisdiction, and agreements involved. Use them as a starting point, then check applicable requirements and seek qualified advice where needed.
Is information governance the same as data governance?
They overlap. Data governance often focuses on data ownership, definitions, quality, and access. Information governance may also include records, privacy, legal obligations, security, retention, and disposal. Organizations use the terms differently, so check how a policy defines them.
Is information governance a law?
No single law applies universally under that name. It is a way to manage information-related responsibilities and controls. Specific laws may apply based on the organization, data, activity, and location.
Who is responsible for information governance?
Responsibility is shared, but it should be assigned. Executives provide accountability; owners make decisions about data; stewards help apply rules; and IT, legal, privacy, records, and security teams support relevant controls.
Does one framework guarantee compliance?
No. Frameworks can help organize controls and risk management, but they do not replace legal analysis or prove that controls work. Organizations need to identify applicable duties and keep evidence that their controls address them.
What is an information governance policy?
It is a document that sets the organization’s principles, responsibilities, and rules for managing information. It should connect to practical procedures for access, sharing, retention, incidents, exceptions, and disposal.
How often should data access be reviewed?
Set the review schedule based on risk, system use, and applicable requirements. Review access when roles change and when a person leaves, as well as on the planned schedule. Keep evidence of decisions and changes.
Can we delete records when a retention period ends?
Not automatically. Check for legal holds, investigations, litigation, regulatory duties, and contractual requirements before disposal. The schedule and review process should reflect the record type and relevant jurisdiction.
What is the difference between information governance and cybersecurity?
Cybersecurity focuses on protecting systems and information from threats and managing cyber risk. Information governance is broader: it also covers data quality, permitted use, records, retention, accountability, and disposal. Strong governance includes security but is not limited to it.
What should a small organization do first?
Start with an inventory of important information and systems. Identify owners, purposes, locations, vendors, and likely obligations. Then address the highest risks and document who approves access, sharing, retention, and exceptions.
Sources for key references: IBM, Cost of a Data Breach Report 2024; U.S. Department of Education, FERPA guidance; U.S. Department of Health and Human Services, HIPAA guidance; Federal Trade Commission, GLBA Safeguards Rule guidance; European Union, General Data Protection Regulation; NIST, Cybersecurity Framework 2.0 and SP 800-53; ISO, ISO 15489-1:2016; U.S. Department of Education and CHEA, accreditation resources.
(This article was written by one of our staff writers, Nathan Sterling. Visit our Meet the Team page.)
