Data governance is the set of policies, processes, roles, and standards that ensure data is managed as a strategic asset, accurately, securely, and in compliance with applicable law. For South African organisations, data governance has taken on regulatory urgency since the Protection of Personal Information Act (POPIA) became fully enforceable. But beyond compliance, organisations with mature data governance make better decisions faster, with fewer data quality errors and lower data breach risk. This guide explains how to build a data governance framework that works in the South African context. Organisations managing data governance alongside broader GRC obligations can explore GRC software built for South Africa.
What Is Data Governance and Why Does It Matter?
Data governance defines who can take what action with which data, when, and under what circumstances, a formulation drawn from the Data Governance Institute. It is distinct from data management (the technical practice of storing and processing data) and data security (protecting data from unauthorised access), though it draws on both.
Organisations with effective data governance:
- Comply with POPIA, FICA, and sectoral data requirements
- Reduce data breach exposure and POPIA liability
- Improve data quality for analytics and reporting
- Accelerate regulatory responses (data subject requests, regulator inquiries)
- Enable trustworthy AI and advanced analytics
POPIA and Data Governance
POPIA's eight conditions for lawful processing (accountability, processing limitation, purpose specification, further processing limitation, information quality, openness, security safeguards, and data subject participation) set out much of what a data governance framework needs to cover for personal information. POPIA only reaches personal information, though, so a POPIA-compliant organisation will have many of the building blocks of data governance in place, while data governance also covers non-personal data such as operational, financial, and product data.
Data Governance Framework Components
A complete data governance framework contains five interdependent components:
| Component | Description | POPIA Alignment |
|---|---|---|
| Governance Structure | Roles, responsibilities, and accountabilities for data | Accountability condition, responsible party obligations |
| Data Policies | Rules for data collection, use, retention, and deletion | Purpose specification, further processing limitation, retention |
| Data Inventory | Register of what data is held, where, and why | Processing limitation, only collect what is necessary |
| Data Quality Management | Processes to ensure data is accurate, complete, and current | Information quality condition |
| Security Safeguards | Technical and organisational controls protecting personal information | Security safeguards condition |
Key Data Governance Roles
Information Officer
POPIA requires every responsible party to have an Information Officer registered with the Information Regulator. The Information Officer (typically a senior executive) is accountable for POPIA compliance and data governance. In larger organisations, a Deputy Information Officer handles day-to-day execution.
Data Owners
Business unit leaders who are accountable for specific data domains (e.g., customer data, employee records, financial data). Data owners approve policies for their domain, resolve data quality issues, and authorise access.
Data Stewards
Subject-matter experts within business units who manage data quality, maintain data dictionaries, and act as the day-to-day point of contact for data governance questions in their domain.
Data Governance Council
A cross-functional body that sets data governance strategy, resolves conflicts between business units, and maintains alignment between data governance and organisational objectives. Typically chaired by the Information Officer or Chief Data Officer.
Implementing Data Governance: 5 Steps
Step 1: Conduct a Data Inventory
Before you can govern data, you must know what data you have. Map all personal information flows: what personal information is collected, from whom, why, where it is stored, who has access, and how long it is retained. This data map is the foundation of POPIA compliance and data governance.
Step 2: Define Data Policies
Develop and document policies for: data collection and consent, data retention and deletion, data subject access requests, data breach notification, cross-border data transfers, and operator (third party) agreements. Policies must be approved at an appropriate governance level and kept current.
Step 3: Establish Data Quality Standards
Define what "good quality" means for each critical data domain. Implement controls to prevent, detect, and correct data quality failures, including validation at entry points, deduplication processes, and regular data quality audits.
Step 4: Build a Data Breach Response Capability
POPIA requires notification to the Information Regulator and affected data subjects within reasonable time of discovering a security compromise. Organisations must have a breach response plan, defined escalation paths, and the ability to identify what personal information was affected.
Step 5: Monitor and Mature
Data governance is not a one-off project. It is an ongoing programme. Measure data quality scores, POPIA compliance indicators, data subject request response times, and breach occurrence rates, and use these metrics to drive continuous improvement.
Information Regulator Enforcement
The Information Regulator has become increasingly active, with complaints, investigations, and enforcement notices rising in recent years. POPIA provides for administrative fines of up to R10 million for a responsible party, and separate criminal offences that can, in the most serious cases, carry imprisonment of up to 10 years. In our view, this makes data governance a genuine legal and operational priority rather than a "nice to have".
Summary
- Data governance defines who can take what action with which data, and it is both a compliance requirement and a business capability
- POPIA's eight conditions for lawful processing map directly to data governance components
- Every responsible party must register an Information Officer with the Information Regulator
- A data inventory is the essential foundation, you cannot govern data you do not know you have
- Data breach response capability is legally required and must be tested, not just documented
- Information Regulator enforcement is increasing, so data governance needs to be operational, not just theoretical
Frequently Asked Questions
What is the difference between data governance and data management?
Data governance defines the rules, roles, and accountabilities for data, the "what" and "who." Data management is the technical execution of those rules, the "how." Data governance supports consistent, compliant data management across the organisation by establishing clear policies and accountabilities.
Does POPIA require a formal data governance framework?
POPIA does not prescribe a specific framework, but its eight conditions for lawful processing require policies, controls, roles, and accountability structures that collectively constitute a data governance framework. The Information Regulator expects evidence of governance in place, not just documentation, but operational processes.
What is a PAIA/POPIA manual and do I need one?
In most cases yes. Under the Promotion of Access to Information Act (PAIA), every private and public body must compile a PAIA manual describing the records it holds and how to request access to them. This covers records generally, not only personal information. The small private body exemption that previously applied ended on 31 December 2021, so most organisations now need a manual. Responsibility for PAIA moved from the South African Human Rights Commission to the Information Regulator in 2021, and the manual is published (for example on your website and at your premises) rather than lodged with the Commission. Many organisations combine their PAIA manual with their POPIA compliance documentation. We would suggest confirming the current position on the Information Regulator's website before finalising your manual.
How long must personal information be retained under POPIA?
POPIA does not set a single retention period. Personal information may only be retained for as long as necessary to achieve the purpose for which it was collected, or as required by law. Organisations must document retention periods for each data category and implement deletion or anonymisation processes when the retention period expires.
References
1. Protection of Personal Information Act 4 of 2013 (POPIA).
2. Promotion of Access to Information Act 2 of 2000 (PAIA).
3. Information Regulator South Africa. Annual Report 2024/25.
4. DAMA International. DAMA-DMBOK: Data Management Body of Knowledge, 2nd ed (revised 2024). dama.org.
5. ISO/IEC 38505-1:2017. Information Technology, Governance of IT, Governance of Data.
6. Information Regulator (South Africa). PAIA guidance and manuals. inforegulator.org.za.
7. Data Governance Institute. The DGI Data Governance Framework. datagovernance.com.
This guide is provided for educational purposes only. It draws on a combination of Dimeri's project and advisory work, interviews with practitioners, our own research, academic literature, and publications from standard-setters, regulators, and professional bodies. It reflects our view of good practice at the date of publication and is not legal, regulatory, audit, or financial advice.
Laws, codes, and standards change, and how they apply depends on your organisation's circumstances. Please consult the primary sources and obtain professional advice before acting. Last reviewed: September 2026.
