In One Minute
A data governance framework is the set of roles, decision rights, controls and measures that decides who owns each dataset, who may use it and how you know it is right. For a 400-person company, that means a handful of named owners, one monthly forum, controls enforced in the platform, and five metrics tracked like any other process.
- Headcount: no new department; one part-time lead and stewards who already know the data.
- Controls: ownership, classification, access, lineage and quality, enforced in the catalog rather than in a document.
- Effort: start with the five to ten datasets that feed revenue, finance and customer reporting.
- Proof: a monthly scorecard with a baseline, not a policy signed once and filed.
Most data governance programs do not fail on design. They fail on attention. Gartner predicts that 80% of data and analytics governance initiatives will fail by 2027, and puts the cause in the release title itself: a lack of a real or manufactured crisis. Governance that is not tied to a business outcome gets deprioritized the first quarter it competes with one.
The frameworks you find online make that worse for a mid-market company. They come from enterprise programs with a chief data officer, a governance office and a council of twenty. A 400-person manufacturer, distributor or services firm has a head of data, three to eight engineers and analysts, and business leaders who already have full-time jobs.
What follows is a framework at that size. It is deliberately about data governance, meaning ownership, quality, access and lineage of the data itself. AI governance builds on top of it, but it cannot stand without it.
What Does a Data Governance Framework Actually Contain?
Strip away the vocabulary and every working framework answers five questions. Who owns this data? What is it, and how sensitive is it? Who can use it, and how do they get access? Where did it come from, and where does it go? Is it good enough for the decision it drives?
Each question becomes a component: ownership, classification, access, lineage and quality. Each component needs three things to be real: a named role who decides, a control that enforces the decision without someone remembering to, and a measure that shows whether it is working. A framework that has the first and skips the other two is a policy binder. That is the gap this article is about. If you need the clause wording itself, our separate policy template covers it; if you want help designing the program, see our guide to data governance consulting.
Who Owns What in a 400-Person Company?
Keep roles few, named and part-time. The table sizes them for a company with roughly five to eight business domains (finance, sales, operations, supply chain, people, customer service) and a small central data team.
| Role | Who it usually is | Time it takes | Decides | Platform control they own |
|---|---|---|---|---|
| Executive sponsor | CFO or COO | One hour a month | Priorities, escalations, funding | None directly; signs off the scorecard |
| Governance lead | Head of data or analytics | A few hours a week | Standards, forum agenda, metric targets | Catalog structure, tag taxonomy |
| Domain owner | A business leader per domain | A few hours a month | Who may access the domain’s data, what it means | Ownership of the domain’s catalog or schema |
| Data steward | An analyst or power user in each domain | Part of their existing role | Definitions, quality rules, classification calls | Tags, comments, quality expectations |
| Platform owner | Lead data engineer | Part of the platform role | How controls are implemented | Grants, policies, pipelines, monitoring |
| Security and privacy | IT security lead, or outside counsel for privacy questions | As needed | Sensitivity levels, masking requirements | Review of access policies and audit logs |
Two rules keep this from decaying. Owners are groups in the platform, not individuals, so a resignation does not orphan a table. And the forum is one meeting: a monthly governance review of 45 minutes, chaired by the governance lead, that walks the scorecard, approves exceptions and escalates the one or two decisions that need the sponsor.
How Does Unity Catalog Enforce the Framework?
A lakehouse changes governance because the controls stop being promises. On Databricks, Unity Catalog turns each component into something you configure and can query.
Ownership. Every catalog, schema and table has an owner. Map one catalog or schema per domain, assign the domain owner’s group, and the access request route follows automatically.
Classification and access. Databricks announced that attribute-based access control policies for row filtering and column masking, governed tags and automated data classification reached general availability on 13 May 2026. In practice, stewards tag sensitive columns, classification flags candidates they missed, and one masking policy applies to every column with that tag. New tables inherit protection the moment they are tagged.
Lineage. Unity Catalog captures lineage automatically for queries run on Databricks, down to the column level. The documented gaps matter: column-level lineage is not captured through UDFs or for tables referenced by path, so standardize on table names. Our Unity Catalog guide covers the grant and lineage model in detail.
Audit. Access is logged to the audit log system table, which the documentation labels Public Preview, with 365 days of retention by default. Treat it as a strong evidence source and record its status honestly in your framework.
Quality. Declarative pipeline expectations let a steward’s rule (“order date is never in the future”) become a check that runs on every load, with failures counted rather than discovered. Our data quality framework walks through choosing those rules.
How Do You Measure Governance With DMAIC?
If governance cannot show a trend, it loses the budget argument to anything that can. Run it as a Lean Six Sigma improvement project and the scorecard writes itself.
Define the scope as the critical data: the five to ten gold tables behind revenue, margin, inventory and customer reporting. Measure a baseline in the first two weeks using queries against the catalog, not surveys. Analyze where the gaps cluster: usually one or two domains with no steward, or one source system that lands data outside the catalog. Improve by fixing the cause, not the symptom. Control by putting the metrics on the monthly scorecard with targets and an owner for each.
Five metrics cover a mid-market program, and every one comes from the platform:
- Percentage of critical tables with a group owner and a description.
- Percentage of columns flagged as sensitive that carry a governed tag and a masking policy.
- Percentage of critical gold tables with complete lineage to a registered source.
- Median days from access request to decision.
- Quality expectation failures per week on critical tables, and how many reached a report.
Where Does a Mid-Market Framework Break?
Governance written before the data is in one place
If finance data lives in the ERP, sales data in the CRM export and operations data in spreadsheets, no framework can enforce anything. Ownership and access rules apply only to data the catalog can see. The first governance milestone is often an ingestion milestone: get the critical sources landing in bronze, conformed in silver and served from gold.
Roles assigned to people who never agreed to them
A steward named in a slide deck is not a steward. The person needs the role in their objectives, a few hours a month protected for it, and a clear list of the decisions they own. Otherwise every definition question routes back to the data team, which becomes the bottleneck the framework was meant to remove.
A council that discusses instead of decides
Large committees debate definitions for months. At 400 people, a short monthly review with a fixed agenda works better: scorecard, exceptions, two escalations, done. Anything that needs longer discussion goes to the domain owner with a deadline.
Controls bolted on after go-live
Tagging and masking added a year after a table ships means a year of unprotected access in the audit log. Make ownership, a description and classification part of the definition of done for every new gold table, enforced in code review.
No baseline, so no proof
Programs that skip the Measure step cannot show improvement, so they cannot defend their time. A baseline taken in week two is worth more than a perfect framework document taken in week ten.
If Your Company Looks Like This, Where Do You Start?
Pick the profile closest to yours. Each one starts in a different place, because the binding constraint is different.
- If your data still lives in source systems and spreadsheets, start with ingestion of the five critical sources into the lakehouse, with ownership assigned as each table lands. Governance and migration are the same project for you.
- If you are on Databricks but everything sits in one catalog with broad grants, restructure catalogs by domain, assign group owners, and replace individual grants with a tag-based masking policy for sensitive columns.
- If controls exist but nobody trusts the numbers, your gap is quality, not access. Name a steward per domain, write expectations for the critical gold tables, and put failure counts on the scorecard.
- If an auditor or a large customer is asking for evidence, build the scorecard first from catalog and audit queries, so you can show the current state honestly, then close the gaps in the order the questionnaire weights them.
Whichever profile fits, and however far along your lakehouse is, the sequence is the same: fix the process, then automate it, then measure it. If you want a team that designs the framework and builds the controls in the same engagement, see our Databricks consulting work.
Frequently Asked Questions (FAQs)
What is a data governance framework?
It is the combination of roles, decision rights, enforced controls and measures that governs how data is owned, classified, accessed, traced and checked for quality. A policy document is one output of a framework, not the framework itself.
How many people does data governance need at a 400-person company?
Usually no new hires to start. A governance lead spends a few hours a week, each domain has an owner and a steward working inside existing roles, and the platform team implements controls. Add a dedicated role only when the scorecard shows the part-time model cannot keep up.
How is data governance different from AI governance?
Data governance covers the data itself: ownership, quality, access and lineage. AI governance adds controls on models and agents, such as inventories, evaluation and use policies. AI governance depends on data governance, because a model is only as trustworthy as the data it reads.
Which data should we govern first?
The five to ten gold tables that feed revenue, finance, inventory and customer reporting. They carry the most decision risk, they get the most scrutiny from auditors, and fixing them produces the most visible improvement on the scorecard.
Can Unity Catalog replace a dedicated governance tool?
For data on Databricks, it covers ownership, tagging, attribute-based access, lineage and audit logging natively. A separate catalog tool earns its place when much of your governed data lives on platforms Unity Catalog does not reach, or when business users need a glossary experience beyond what the platform offers.
How long does it take to stand up?
The roles, forum and baseline scorecard take a few weeks for the critical datasets. Extending controls to the rest of the estate is ongoing work, paced by how quickly sources move into the governed lakehouse.