Data Governance Institute Frameworks, case studies and UK regulatory briefings

Data Governance Institute

Frameworks, case studies and UK regulatory briefings

Latest Articles

The Responsibility Ledger: Six Tests for Joint Controller Arrangements in UK Data Governance
Framework

The Responsibility Ledger: Six Tests for Joint Controller Arrangements in UK Data Governance

UK organisations frequently inherit joint controllership through shared services, research partnerships and integrated platforms, yet the Article 26 arrangement is often treated as a signature rather than a live control. This framework sets out six tests for mapping purpose, decision rights, evidence custody, incident roles, review triggers and exit, so that responsibility can be demonstrated when it is tested.
The Shutdown Brief: Five Gates Between a Retired System and an Evidence Gap
Framework

The Shutdown Brief: Five Gates Between a Retired System and an Evidence Gap

Decommissioning is too often treated as an infrastructure milestone with a records footnote. This framework sets out five evidence gates that should stand between a retirement decision and the final shutdown, so that retention obligations, legal holds and deletion can be accounted for after the system is gone.
The Living Register: A Quarterly Discipline for Keeping Processing Records Decision-Ready
Framework

The Living Register: A Quarterly Discipline for Keeping Processing Records Decision-Ready

A record of processing activities is only useful if it can answer a question before the question becomes urgent. This framework sets out a quarterly refresh discipline that ties each entry to a named owner, a change trigger, and the evidence an ICO enquiry would expect.
Release Readiness for the National Data Library: Six Checks Before a Public Dataset Leaves the Estate
Framework

Release Readiness for the National Data Library: Six Checks Before a Public Dataset Leaves the Estate

The National Data Library will be judged less by its launch page than by the quality of the datasets that enter it. This framework sets out six release-readiness checks for UK public bodies, covering metadata, lawful basis, sensitive-data controls, access tiers, commercial confidentiality and accountable release decisions.
The Record After the Repair: A Governance Debrief Protocol for UK Data Incidents
Framework

The Record After the Repair: A Governance Debrief Protocol for UK Data Incidents

Most post-incident reviews close with root cause and remediation tickets, but leave the governance decisions that shaped the response undocumented. This framework sets out a 90-minute debrief protocol for UK data teams to capture trigger decisions, escalation choices, evidence gaps and board-ready lessons while memory is fresh. It includes a one-page agenda, a decision-log template and tests for whether the record would withstand an ICO request.
Silence Is Not Compliance: Field-Testing Retention Automation Before the Regulator Does
Framework

Silence Is Not Compliance: Field-Testing Retention Automation Before the Regulator Does

Retention rules are frequently evidenced by configuration screens rather than by actual disposal outcomes. This framework sets out a sample-based field audit for UK data estates, covering common silent failures in Microsoft 365 and shared drives, and a remediation log designed to withstand ICO scrutiny.
Release Is a Control Too: Reconciling Legal Holds with UK Retention Schedules
Framework

Release Is a Control Too: Reconciling Legal Holds with UK Retention Schedules

Legal holds are designed to suspend disposal, but without an evidenced release they can suspend retention schedules indefinitely. This framework sets out a reconciliation protocol linking hold registers, owner attestations, release tests and audit evidence so UK organisations can prove holds are active, scoped and lifted.
Before the Answer: Governing Generative AI Inputs as Controlled Data Ingress
Framework

Before the Answer: Governing Generative AI Inputs as Controlled Data Ingress

AI inventories record which generative tools are in use; they do not record what staff type into them. This framework treats the prompt box as a governed data ingress point, setting out prohibited inputs, logging triggers, retention rules and the evidence needed when an ICO or internal audit request arrives.
The Request File That Answers First: Governing UK Subject Access Requests as Standing Evidence
Regulatory Briefing

The Request File That Answers First: Governing UK Subject Access Requests as Standing Evidence

Subject access requests are often handled as deadline-driven legal events. This briefing sets out a standing evidence pack that records search scope, redaction reasoning, reviewer approval and timeliness, so UK data governance teams can demonstrate control before the ICO asks.
The Stop Signal: Evidencing Consent Revocation Across a UK Data Estate
Regulatory Briefing

The Stop Signal: Evidencing Consent Revocation Across a UK Data Estate

Consent withdrawal is frequently reduced to a front-end preference toggle, yet UK GDPR requires the controller to demonstrate that revocation has taken effect across live systems, downstream processors and re-used data. This briefing proposes a 72-hour evidencing test that treats revocation as an operating-model control rather than a dashboard metric.
The Rationale Vault: Keeping Data Governance Decisions Auditable After the People Leave
Framework

The Rationale Vault: Keeping Data Governance Decisions Auditable After the People Leave

Data governance records often capture what was decided but not why. This framework sets out a lightweight decision locker, a handover checklist and a six-month rationale test so UK organisations can preserve the reasoning behind lawful basis choices, retention exceptions, vendor approvals and DPIA outcomes through reorganisations and resignations.
Absence as a Control: A Half-Day Resilience Drill for UK Data Governance
Framework

Absence as a Control: A Half-Day Resilience Drill for UK Data Governance

Most UK data governance arrangements are tested with the usual cast present. This framework sets out a repeatable half-day drill in which the DPO, SIRO or senior data owner is deliberately unavailable, exposing whether decision rights, records access and regulator-facing evidence still hold under pressure.
Census Before Control: Governing the UK Shadow Data Estate Without Halting Operations
Framework

Census Before Control: Governing the UK Shadow Data Estate Without Halting Operations

Official system maps rarely capture the spreadsheets, local databases and end-user workarounds that keep critical UK processes running. This framework sets out a census-led method for discovering shadow data, assigning accountable ownership and applying proportionate access, retention and remediation controls.
Trigger, Decide, Evidence: A DPIA Reassessment Matrix for UK Change Control
Framework

Trigger, Decide, Evidence: A DPIA Reassessment Matrix for UK Change Control

DPIAs lose their value when they are treated as one-off project artefacts. This framework links common UK change events to clear reassessment decisions, sign-off routes and evidence requirements, so that data protection impact assessments remain live governance instruments.
Statute to Operating Model: A Readiness Review for the UK Data (Use and Access) Act
Regulatory Briefing

Statute to Operating Model: A Readiness Review for the UK Data (Use and Access) Act

The Data (Use and Access) Act 2025 has moved from parliamentary debate into the operating environment of UK data teams. This briefing sets out a practical readiness review covering records, notices, assessments, oversight and subject-access workflows, with an emphasis on the evidence an organisation should be able to produce.
Twelve Months of Letting Go: An Evidenced Disposal Calendar for UK Data Teams
Framework

Twelve Months of Letting Go: An Evidenced Disposal Calendar for UK Data Teams

Retention policies fail quietly when disposal is nobody's monthly job. This framework sets out a twelve-month operating calendar for UK data governance teams, with legal-hold checks, owner attestations, deletion sign-off and board-ready evidence that records are actually leaving the estate.
Clause by Clause: Treating Processor Contracts as Live Governance Controls
Regulatory Briefing

Clause by Clause: Treating Processor Contracts as Live Governance Controls

Processor contracts are often filed at signature and revisited only at renewal. This briefing argues that Article 28 terms are live governance controls and sets out the clause review, handover lessons and pre-renewal questions a UK data governance committee should ask.
Regulatory Briefing

After the Signing: A Thirty-Day Data Governance Review for UK Acquisitions

Completion is not the end of diligence. The first thirty days determine whether inherited privacy liabilities, incomplete processing records and dormant data-sharing agreements become integration risks or managed workstreams. This briefing sets out a day-by-day checklist for UK buyers.
The Inherited Estate: A Six-Stage Audit of Data Governance Debt
Framework

The Inherited Estate: A Six-Stage Audit of Data Governance Debt

Inherited spreadsheets, undocumented flows and orphaned retention rules create a form of governance debt that is rarely visible until an ICO enquiry or migration forces the issue. This framework sets out six stages for quantifying that debt, ranking remediation and giving the board a defensible plan.
Reconfirming the Record: An Eighteen-Month Audit for Lawful Basis Drift
Regulatory Briefing

Reconfirming the Record: An Eighteen-Month Audit for Lawful Basis Drift

Data maps and ROPA entries rarely fail loudly; they drift. This briefing sets out an eighteen-month audit cycle that uses change triggers, targeted sampling and purpose-level interviews to reconfirm lawful basis and retention assumptions without rewriting the entire record.