What is data governance?
Data governance is how an organisation decides and oversees the use of data: who is accountable for each dataset, why the data is collected, how long it is kept, who can access it and how its quality is measured. It is not a piece of software but a set of roles, policies and processes, which are then built into software.
For businesses in Vietnam, data governance is also the practical way to meet the 2025 Personal Data Protection Law (Law No. 91/2025/QH15, in force from 1 January 2026) and Decree 356/2025/ND-CP: the law requires processing for a defined purpose, consent for each purpose, retention only as long as appropriate, and deletion when the data is no longer needed.
Reference framework: DAMA-DMBOK puts governance at the centre
A widely used reference is DAMA-DMBOK (Data Management Body of Knowledge) from the professional association DAMA International. DMBOK divides data management into 11 knowledge areas, with data governance at the centre of the "DAMA wheel". The ten areas around it are data architecture, modelling and design, storage and operations, data security, integration and interoperability, document and content management, reference and master data, data warehousing and BI, metadata, and data quality.
DAMA describes DMBOK as principles and good practice that do not prescribe tools or technologies, and not a legal mandate. Version 2 is current; DAMA started the DMBOK 3.0 project in 2025. The practical lesson: small and medium businesses do not need all 11 areas at once. Start with governance (roles, policies) and extend to metadata, quality and security as needs grow.
Four core roles: owner, steward, custodian, user
The most common mistake is "data belongs to IT". IT runs the systems, but the business function understands what the data means and what it is for. The table below shows a common split of roles in data governance programmes. Names differ between organisations; what matters is that each responsibility has a named person.
| Role | Usually who | Accountable for | Example |
|---|---|---|---|
| Data owner | Head of a business function | Deciding purpose, access and retention; approving exceptions | HR manager for employee data |
| Data steward | Business specialist | Field definitions, quality rules, fixing errors, maintaining the data catalog | Payroll specialist maintaining the definition of "start date" |
| Data custodian | IT, system administrators, vendors | Running storage, backup, technical permissions and logging as the owner requires | HRM system administrator |
| Data user | Employees, partners, AI Agents | Using data only for the stated purpose and within granted access; reporting incidents | Line manager viewing records of their own team |
How this maps to roles in Law 91/2025
The law uses different terms: the personal data controller (decides the purposes and means of processing), the processor (processes on the controller's behalf under a contract) and the controller-processor. A business is usually the controller; the data owner is the person inside the business who carries out those decisions. Software and cloud vendors are usually processors, so contracts should set out rights and obligations clearly.
The minimum set of data policies
Policies do not need to be long. A minimum set, one or two pages each, is usually enough to start:
- Classification policy: levels (for example public, internal, confidential, sensitive personal data) and handling rules for each.
- Access policy: role-based access, who approves, periodic access reviews, revocation on role change or exit.
- Retention and deletion policy: retention period per data type, the basis (sector law, contract, purpose) and secure deletion.
- Quality policy: mandatory fields, validation rules, who fixes errors.
- Procedures for data subject requests and data incidents.
Data catalog and classification: know what you hold
You cannot govern what you do not know you have. A data catalog lists datasets: which system, who the owner is, which fields, whether it contains personal data, the purpose and the retention period. For a small business, a well-maintained spreadsheet is enough to start; a dedicated catalog tool is only needed as the number of systems grows.
Classification lets you apply the right level of protection. Under Law 91/2025, personal data is either basic or sensitive, according to lists issued by the Government, currently Articles 3 and 4 of Decree 356/2025/ND-CP. Tag fields that hold sensitive personal data in the catalog so stricter rules apply.
| Field | Sample value |
|---|---|
| Dataset | Candidate records |
| System | Applicant tracking system (ATS) |
| Owner / Steward | HR manager / Recruiter |
| Contains personal data | Yes; no sensitive data collected |
| Purpose | Recruitment for the open position |
| Basis | Candidate consent |
| Retention | Delete if the candidate is not hired, unless otherwise agreed (Article 25(1), Law 91/2025) |
| Who can access | Recruitment team and the interview panel for the role |
Mapping governance rules to Law 91/2025 and Decree 356/2025
The four original rules of this article (an accountable owner, purpose, retention, role-based access) line up with the law's main obligations:
| Rule | What the law requires | What to do |
|---|---|---|
| Every dataset has an accountable owner | The controller decides purposes and means and is accountable to data subjects; businesses designate a data protection unit or person, or use a service provider | Name an owner in the catalog; designate a data protection contact |
| Record the purpose at collection | Article 3: collect and process only within a specific, clear scope and purpose | Every field has a purpose; no purpose, no collection |
| Consent for each purpose | Article 9(4): consent per purpose, no forced consent to other purposes, silence is not consent | Separate consent boxes by purpose; keep proof; offer withdrawal |
| Retention is a decision | Article 3: keep only as long as suits the purpose; Article 14: delete when the purpose is fulfilled or the retention period ends, using secure methods | Retention matrix; automatic deletion schedule; deletion records |
| Role-based access | Article 3: apply institutional, technical and human measures together to protect data | Role-based permissions, periodic review, access logs |
Build governance into software, not just documents
Policies only work when built into everyday tools: mandatory fields and format checks at entry, role-based permissions instead of shared accounts, automatic deletion on retention schedules, searchable access logs, and consent boxes separated by purpose on every form.
This matters even more when AI enters operations. An AI Agent is also a "data user": it needs least-privilege access, an action log, and should read data only for its stated purpose. Before deploying AI, see the data readiness for AI checklist and access control and audit logs for AI Agents.
A five-step starting plan
EYC designs cloud and data infrastructure with access control, logging and data lifecycle built into the system. If you need a specific system reviewed, contact EYC.
- Step 1: List the main systems and datasets; assign an owner to each.
- Step 2: Build a minimum data catalog: purpose, personal data or not, retention, who has access.
- Step 3: Review collection forms: remove fields without a purpose, separate consent by purpose.
- Step 4: Set up role-based access and deletion schedules; turn on access logging.
- Step 5: Check documentation duties under Law 91/2025 and Decree 356/2025, such as the personal data processing impact assessment; see Vietnam's Personal Data Protection Law 2025 and Decree 356/2025.
Frequently asked questions
How is data governance different from data management?
In the DAMA-DMBOK view, data management covers many areas such as architecture, storage, integration, quality and security. Data governance is the central part that sets roles, policies and accountability so those areas work consistently.
Does a small business need data governance?
Yes, at a minimum level. Law 91/2025 applies to every organisation that processes personal data. A spreadsheet data catalog, one owner per dataset, purpose-based consent forms and a deletion schedule are a reasonable starting point.
What is the difference between a data owner and a data steward?
The owner makes decisions and is accountable (usually a business head). The steward does the daily work: defining fields, maintaining quality, updating the catalog. The custodian (usually IT) runs the systems as the owner requires.
Can one consent cover several purposes?
It should not. Article 9(4) of Law 91/2025 requires consent to be given for each purpose, without conditions forcing consent to other purposes, and silence is not consent.
How long should personal data be kept?
There is no single number. The law requires keeping data only as long as suits the purpose, unless another law sets a specific period (for example accounting records). Each data type needs a retention period and basis recorded in the catalog.