Governance operating model
Data owners, stewards and custodians mapped to named roles with decision rights that are small enough to be used. A governance forum with a standing agenda, not a quarterly slide review.
Governance
Data governance and compliance
Ownership, cataloguing, classification and access evidence, implemented in the tools teams already use.
- A catalogue people actually search before rebuilding something that exists
- Classification and sensitivity labels applied consistently, including on exports
- Access that can be evidenced per dataset, per person, on demand
- Lineage from source system to published report, generated automatically
Governance fails when it arrives as a policy document and a committee. It works when it is built into the tools people already use: the catalogue is where they look things up, the label applies itself, access requests are approved by the person who actually knows, and the lineage diagram is generated rather than drawn.
We implement that version. Ownership and stewardship mapped onto real roles, Microsoft Purview configured and populated rather than installed and abandoned, classification and sensitivity labels aligned to your retention policy, and access controls that reconcile with your directory groups.
Everything is built to produce evidence. When a regulator, auditor or customer asks who can see a dataset, where it came from and how long you keep it, the answer should be a report you can export, not a project.
What we deliver
What the work involves
Catalogue and glossary
Microsoft Purview scanning your estate, with a business glossary that defines terms once and links them to the physical assets and the measures that implement them.
Classification and labelling
Classification scheme aligned to your retention and security policy, sensitivity labels applied in Power BI and Microsoft 365, and encryption or export restrictions where the classification demands it.
Access control design
Role-based access through directory groups rather than individual grants, row-level security patterns, privileged access review, and an access request flow with the right approver in it.
Lineage and impact analysis
End-to-end lineage so you can answer both directions of the question: what feeds this report, and what breaks if this table changes.
Privacy and audit readiness
Records of processing for analytics, lawful-basis mapping, retention schedules enforced in the platform, DSAR support procedures, and an audit evidence pack that can be regenerated on request.
Method
How the engagement runs
Each stage names the artefact it produces, so progress can be checked without a status meeting.
Assess
Current controls, data map, access reality versus policy, and the gaps that carry real regulatory or commercial risk. Ranked, not alphabetised.
Gap assessment with a risk-ranked remediation plan
Define
Operating model, classification scheme, retention rules and access standards agreed with legal and business owners.
Governance framework and standards, signed off
Implement
Purview deployed and scanning, labels published, access rebuilt onto groups, lineage switched on.
Working controls in the live estate
Embed
Steward training, request flows, monitoring of policy drift, and the first quarterly review run with your team.
Trained stewards and a working governance cadence
Evidence
Reporting that produces audit evidence automatically, so compliance is a side effect of operating the platform.
Audit evidence pack and compliance dashboard
Deliverables
Deliverables
- Gap assessment and risk-ranked remediation plan
- Governance operating model with named owners and stewards
- Microsoft Purview deployment, scans and populated catalogue
- Business glossary linked to physical assets and measures
- Classification scheme and published sensitivity labels
- Access control matrix reconciled against the directory
- Automated lineage and impact analysis
- Retention schedule enforced in the platform, plus DSAR procedure
Stack
Technologies
- Microsoft Purview
- Power BI Service admin APIs
- Microsoft Entra ID
- Microsoft 365 compliance
- Azure Policy
- Azure Monitor
- Power Automate
Questions
Governance: common questions
Badly implemented governance does, which is why adoption collapses. Done properly it is faster: a searchable catalogue prevents rebuilding work that already exists, group-based access means a new joiner gets the right permissions on day one instead of raising five tickets, and certified datasets give analysts a sanctioned starting point. We measure time-to-first-answer before and after, so the claim is testable.
A spreadsheet catalogue works at small scale and decays quickly, because nothing updates it. Purview earns its place when you have enough assets that manual maintenance fails. It scans, classifies and maintains lineage automatically. Below roughly a hundred assets with a stable team, a disciplined manual catalogue can be enough, and we will tell you if that is your situation.
Analytics estates touch several obligations directly: records of processing, data minimisation, storage limitation, access control, and the ability to answer subject access and erasure requests. We map your analytics data flows to those obligations, enforce retention in the platform rather than in policy text, and build the evidence reporting. We are not a law firm. Your DPO or counsel owns the legal position, and we build the controls that support it.
Usually the better option. If you have DAMA-aligned policies, an existing data council or an ISO 27001 control set, we implement against those rather than introducing a competing framework. Replacing a working framework is rarely the highest-value thing we could be doing.
This is where most estates leak. Sensitivity labels applied in Power BI travel with the exported file, so encryption and access restrictions persist outside the platform; export can also be blocked for specific labels or audiences. We configure that and then test it from a non-privileged account, because a control nobody has tried is an assumption.
Related
Power BISemantic modelling, DAX and report delivery with one agreed definition per measure.Microsoft FabricLakehouse architecture sized against measured consumption rather than headcount.Managed serviceMonitoring, incident response and change delivery for Power BI, Fabric and Azure platforms.
Sector context: Financial services, Manufacturing, Retail, Healthcare, Logistics.
Next step
Governance: what the next step looks like
A three-week assessment that produces a plan your auditor would accept
Answered within one working day, by the engineer who would do the work