One Page, Six Questions: A Board-Level Data Governance Scorecard for UK Organisations
Photo: UK board meeting reviewing one-page data governance scorecard, via upload.wikimedia.org
Most data-governance board packs are diligent documents that answer the wrong question. They describe what the function has done: policies refreshed, training completed, a register updated, a forum held. Those facts matter to the team producing them, but they rarely help a board decide where to intervene. The result is a familiar pattern in UK organisations: directors receive reassurance, not evidence, and the most important weaknesses remain below the waterline.
A better board pack does not require more pages. It requires fewer measures, chosen because they can be challenged. The test is simple: if a metric moves, can the board ask a sensible question about cause, consequence and ownership? If not, it belongs in an operational report, not the board pack.
The test of a board metric
A board-level data governance measure should satisfy three conditions. It should relate to a decision the board can actually take or direct. Its movement should be explainable without a technical tutorial. And it should have a named owner who can speak to the evidence behind it.
Activity metrics usually fail at least two of those tests. The number of data protection training completions may be useful for management, but it says little about whether staff recognise a data subject access request or whether a product team has changed a purpose without telling anyone. The board needs measures that expose the gap between the organisation's stated position and its operating reality.
Six measures for a single page
The following scorecard is deliberately narrow. It is not a complete data governance dashboard. It is a set of six measures that a UK board can use to test whether the control environment is holding, and where it is not.
1. Ownership coverage. This is the percentage of critical data assets and processing purposes with a named accountable owner and a named deputy, both accepted in role. The board question is not 'do we have a register?' but 'which critical assets have no accountable owner, and what decision is needed?' Coverage can rise while accountability weakens if owners are nominal. Pair the percentage with a short attestation from owners that they understand their responsibilities.
2. Retention adherence. This measures the percentage of in-scope records covered by an approved retention schedule and supported by evidence that deletion occurs at the trigger point. The board question is: where are we retaining data beyond schedule, and what is the exposure? A fall in adherence after a merger, a system migration or a new supplier arrangement is a signal worth discussing. A rise based on policy updates alone is not.
3. DSAR timeliness. Report the percentage of data subject access requests completed within the statutory one-month period, with extensions and their reasons shown separately. The board question is whether delays are concentrated in a business unit, a system or a request type. Seasonal spikes are less interesting than a persistent tail caused by poor records management.
4. Repeat incidents. This is the number of data protection or data governance incidents in the period that share a root cause with an incident from the previous twelve months. Total incident counts can fall while repeat rates rise. The board should ask which root causes recur, who owns the fix and why the previous action did not hold.
5. Third-party evidence. This measures the percentage of material processors for which the organisation holds current evidence of security controls, data protection terms and relevant assurance, rather than a completed questionnaire alone. The board question is which suppliers lack evidence and what data is exposed. New vendors can dilute coverage quickly, even when the procurement process looks robust on paper.
6. AI oversight. This is the percentage of AI use cases in the organisation's inventory with a named owner, documented purpose, lawful basis, risk assessment and human oversight. The board question is which use cases bypassed review and whether the inventory is complete. As use cases multiply, coverage may fall even when governance activity increases.
Making movement legible
A single percentage without context invites false precision. Each measure should be presented with a baseline, a target, a trend and a short commentary that answers three questions: what changed, why, and what decision is required. Red, amber and green ratings are useful only if the narrative explains the rating.
Put the six measures on one page. Attach an exception list on the reverse, limited to items that need board attention or direction. Resist the temptation to include every register, policy and project update. A board that receives a forty-page appendix will focus on the wrong details, usually the ones that are easiest to explain.
What a non-executive director should ask
A non-executive director does not need to become a data protection specialist. They need to ask questions that test the evidence. Which decision would change if this metric moved? Who owns the number and when did they last verify it? What is excluded from the measure? Are we rewarding documentation rather than behaviour? What has deteriorated since the last report, and why?
Those questions keep the board at the right altitude. They also protect against the drift towards a compliance committee, where directors spend their time approving policies and reviewing incident logs rather than governing risk and resource allocation.
The board pack problem is not solved by better formatting. It is solved by choosing measures that invite scrutiny. Six well-chosen metrics, honestly explained, will tell a UK board more about its data governance than a hundred pages of activity reporting.
