Environmental, Social and Governance (ESG) - Principles and Practice · Data Governance

Concept and Framework of Data Governance

Updated 11 October 2026 · Fact-checked

Data governance is the set of policies, roles, processes and controls a company uses to manage its data as an asset. It decides who owns data, who may use it, how it is kept accurate and secure, and who is accountable. To answer exam questions, define it, state principles, name stakeholders, then link to law and ESG.

Understand Concept and Framework of Data Governance

Data governance is the system by which a company decides how data is collected, stored, used, shared, protected and finally deleted. Think of it as corporate governance applied to data. The board does not run every spreadsheet, but it must make sure someone is accountable for data and that rules exist.

Why does it matter? Boards, regulators, investors and customers rely on data. Poor data leads to wrong decisions, misreported numbers, privacy breaches and legal liability. Good data governance gives you data that is accurate, consistent, secure, available when needed and used only for proper purposes.

A usual framework has four parts. First, policies and principles: accountability, transparency, quality, integrity, security, privacy and lawful use. Second, structure and roles: the board and its committees at the top, a senior officer (often called a chief data officer or similar) in charge, data owners in each function, and data custodians such as the IT team who hold and protect the data. Third, processes: data classification, access control, quality checks, retention and disposal, incident response and audit. Fourth, monitoring and reporting: metrics, internal audit and reporting to the board.

Stakeholders include the board, management, employees, customers and other data subjects, regulators, investors, vendors and auditors. Each has a different interest. Customers want privacy. Regulators want compliance. Investors want reliable information.

In ESG, data governance sits mainly under the G, but it supports the E and S too. Sustainability and BRSR disclosures depend on reliable data, so weak data controls mean weak ESG reports. Privacy and cyber security also form part of the social side, since they protect people.

In India, the Information Technology Act, 2000 supplies several legal anchors. Section 43A makes a body corporate that handles sensitive personal data liable to pay compensation if it is negligent in keeping reasonable security practices and thereby causes wrongful loss or wrongful gain to anyone. Section 70B sets up CERT-In as the national agency for cyber incident response. Section 69B allows authorised government monitoring of traffic data for cyber security. Section 84A lets the Central Government prescribe modes or methods of encryption.

Key rules to remember

Core principles of data governance: Accountability + Transparency + Data quality + Integrity + Security + Privacy + Lawful use; Use these as a checklist when asked for principles. Explain each in one line.
Section 43A liability test: Body corporate + sensitive personal data in its computer resource + negligence in reasonable security practices + wrongful loss or gain = compensation; All elements must be present. The remedy is damages by way of compensation to the person affected.
Reasonable security practices (Section 43A Explanation): As per agreement between parties, else as per law in force, else as prescribed by the Central Government; This is the order of reference for what counts as reasonable.
Section 70B(7) penalty: Failure to give information or comply with CERT-In direction: imprisonment up to 1 year or fine up to ₹1 crore, or both; Applies to service providers, intermediaries, data centres, body corporate and any other person. Cognizance only on complaint by an authorised officer of CERT-In (Section 70B(8)).
Section 69B(4) penalty: Intermediary intentionally or knowingly contravening sub-section (2): imprisonment up to 1 year or fine up to ₹1 crore, or both; Sub-section (2) requires the intermediary to give technical assistance to the authorised agency.
Governance structure: Board → Committee/Senior officer → Data owners → Data custodians → Users; Oversight at the top, accountability in business functions, protection by custodians.

How to solve Concept and Framework of Data Governance questions

Data governance questions are written and case-based. Follow provision, analysis, conclusion, and keep each step tied to the facts given.

1Read the question and mark what is asked: meaning, framework, principles, stakeholders, or a case on a breach or reporting failure.
2Open with a one or two line definition of data governance in your own words.
3State the relevant framework element or principle, for example accountability, quality, security, privacy.
4If facts are given, identify the data involved (personal, sensitive, financial, ESG data) and who handles it.
5Apply the law: name the IT Act provision that fits, such as Section 43A for negligence in protecting sensitive personal data, and state its conditions.
6Analyse the facts against each condition or principle and note any gap in roles, controls or reporting.
7Conclude clearly and add practical points: policy, board oversight, access controls, incident reporting, audit.
8Link to ESG or corporate governance in a closing line, for example reliable BRSR data.

Quickest way: D-F-P-S-L-E answer skeleton

When to use it: Use for theory questions on meaning, framework or principles when time is short.

D: define data governance in one line.
F: give the framework in four parts: policies, structure, processes, monitoring.
P: list principles with a short phrase each.
S: name stakeholders and what each expects.
L: add the legal anchor from the IT Act, 2000 that fits the question.
E: close with the ESG and corporate governance link.

Common mistakes in Concept and Framework of Data Governance

Treating data governance as only IT security.
Students link data with computers and stop at firewalls and passwords.
Fix: Say it covers ownership, quality, privacy, lifecycle and accountability, with security as one part. The board owns oversight.
Applying Section 43A to any company holding any data.
Students remember the section name but not its conditions.
Fix: State all conditions: sensitive personal data, in a computer resource the body corporate owns, controls or operates, negligence in reasonable security practices, and wrongful loss or gain.
Saying Section 43A imposes imprisonment.
Confusion with penal sections such as 70B(7).
Fix: Section 43A gives damages by way of compensation. Imprisonment or fine up to ₹1 crore appears in Sections 70B(7) and 69B(4).
Confusing data owner and data custodian.
Both seem to 'look after' data.
Fix: The owner is accountable for the data and decides its use. The custodian holds and protects it technically.
Ignoring the ESG link in the answer.
The topic seems purely legal or technical.
Fix: Add a line that reliable data underpins BRSR disclosures and that privacy and cyber security are social and governance concerns.
Misstating what Section 69B or 84A does.
Students blur monitoring, encryption and incident response.
Fix: 69B: authorised agency monitors traffic data for cyber security. 84A: Central Government prescribes encryption modes or methods. 70B: CERT-In is the national incident response agency.

Worked examples

Example 1

Explain the concept of data governance and discuss its principles and stakeholders. (Short answer)

Show the solution

Define: data governance is the framework of policies, roles, processes and controls by which a company manages data as an asset through its lifecycle.
Framework: policies and principles; structure and roles (board, senior data officer, owners, custodians); processes (classification, access control, quality, retention, incident response); monitoring and reporting.
Principles: accountability for data; transparency about use; data quality and integrity; security; privacy; lawful and ethical use.
Stakeholders: board and management (oversight, decisions); customers and employees (privacy); regulators (compliance); investors (reliable information); vendors and auditors (controls and assurance).
Link: it is part of corporate governance and supports the quality of ESG and BRSR reporting.

Answer: Data governance is the system of policies, roles and controls that makes data accurate, secure, lawfully used and accountable. Its principles are accountability, transparency, quality, integrity, security, privacy and lawful use. Key stakeholders are the board, management, data subjects, regulators, investors, vendors and auditors.

Example 2

Suraksha Finserv Private Limited, Pune, stores customers' bank account details and passwords on its own servers. It has no access controls, and an employee copies the data. A customer, Mr. Rao, loses ₹2,00,000 from his account. Advise whether the company can be held liable under the IT Act, 2000 and what governance gaps exist.

Show the solution

Provision: Section 43A makes a body corporate liable to pay compensation where it handles sensitive personal data in a computer resource it owns, controls or operates, is negligent in implementing and maintaining reasonable security practices and thereby causes wrongful loss or wrongful gain to any person.
Body corporate: a company is covered by the Explanation to the section.
Data: bank account details and passwords are the kind of information generally treated as sensitive personal data, as prescribed by the Central Government. Confirm this against the prescribed list.
Negligence: the company had no access controls, so it failed to maintain reasonable security practices.
Loss: Mr. Rao lost ₹2,00,000, which is wrongful loss caused by the failure. Causation must be shown by the facts.
Conclusion: the company can be held liable to pay damages by way of compensation to Mr. Rao.
Governance gaps: no data owner or custodian roles, no access control or classification, no board oversight, no incident response. The employee who copied the data may separately fall under Section 43(b), which covers copying data without permission.

Answer: Yes. Suraksha Finserv can be liable to pay compensation to Mr. Rao under Section 43A because it is a body corporate, held sensitive personal data on its own servers, was negligent in security practices and caused wrongful loss. The weak governance structure should be fixed with defined roles, access controls and board oversight.

Exam tips

Write a clear definition first. Examiners reward a crisp opening before the detail.
In case questions, tick off each condition of Section 43A against the facts, then conclude.
Use the four-part framework and the principles list as headings in your answer so marks are easy to find.
Quote the penalty figures only for Sections 70B(7) and 69B(4), and do not attach them to Section 43A.
End with the ESG link and one practical drafting or compliance point, such as a board-approved data policy.

Practice questions from Data Governance

Concept and Framework of Data Governance in other exams

The same ground in other exams, if you are preparing for more than one or want another angle on it.

Concept and Framework of Data Governance: frequently asked questions

What is data governance in simple words?

It is the set of rules and responsibilities that decide how a company handles its data. It covers who owns data, who can use it, how it is kept accurate and safe, and who answers if something goes wrong.

How is data governance related to ESG?

It is mainly part of governance, since the board must oversee data risks. It also supports the environmental and social reporting, as BRSR disclosures rely on reliable data, and privacy protects people.

Which IT Act sections matter most for data governance?

Section 43A on compensation for failure to protect data is the key one. Also know Section 70B on CERT-In, Section 69B on monitoring of traffic data, Section 84A on encryption, and Section 43 on damage to computers and data.

Does Section 43A apply only to companies?

The Explanation defines body corporate as any company and also includes a firm, sole proprietorship or other association of individuals engaged in commercial or professional activities. So it is wider than companies.