What Is Information Governance?

Information only — not legal advice.

Information governance decides who can make decisions about information throughout its life. It connects everyday questions—where to save a file, who may share it, when to delete it—to an accountable owner and an agreed rule.

The purpose is to make information useful and dependable without collecting or restricting more than necessary. A policy that nobody can apply during a normal working day provides little protection.

Start with information that matters

Choose a few important information sets: customer agreements, project deliverables, personnel records, supplier details or operational asset data. For each one, establish:

• Purpose: which activity or decision depends on it?
• Owner: who can decide its use, quality requirements and acceptable risk?
• Steward: who maintains its accuracy, structure and review dates?
• Custodian: who operates the storage and technical controls?
• Users: who needs to create, review, receive or retrieve it?

One person may fill several roles in a small organisation. Naming the roles still helps: the administrator who can technically delete a folder is not necessarily the person authorised to decide its disposal.

Turn a policy into operating rules

A usable rule answers a specific question. Replace “share responsibly” with a procedure stating which information may be sent externally, who approves exceptions, how recipients are checked and where the release is recorded.

For each information set, document its authoritative location, minimum metadata, classification, access rules, retention trigger and disposal process. Keep exceptions visible with a reason, owner and review date. A temporary workaround should not become a permanent hidden process.

Example: one supplier, three conflicting bank details

Suppose procurement, finance and a project team each maintain a supplier spreadsheet. A change arrives by email and only one copy is updated. The issue is not simply poor filing: nobody has defined the authoritative record or the change authority.

A practical response is to designate the finance-maintained supplier record as authoritative for payment, give other teams a controlled way to reference it, and require independent verification through a previously established channel before changing bank details. Keep the request, verification and authorisation together, with sensitive data access restricted.

This example shows how governance, security and quality meet in one business process. Buying another storage tool alone would not settle who may approve the change.

Check whether the rules work

Sample a few real records each month or at a frequency suitable for your risks. Can users locate the current version? Are owners still employed and reachable? Are external permissions justified? Can the team explain why old data is retained? Record the gaps and assign improvements.

Useful indicators include records with missing owners, overdue reviews, duplicate authoritative copies and time needed to retrieve evidence. File count and storage volume reveal little about whether information is dependable.

A small first step

Write a one-page operating agreement for one information set and test it with its actual users. Include a route for questions and exceptions. Expand only after the rules are understood and usable.

ISO 15489-1 provides a records-management foundation; the NIST Cybersecurity Framework provides a complementary approach to governing cybersecurity risk. Neither source supplies a universal retention period or determines your contractual rights. Read next: data ownership in collaboration.

Important information

This article provides general information and does not constitute legal advice or replace a qualified professional's assessment of your circumstances. Laws, official guidance, standards and product features can change. Check current primary sources and the requirements applicable to your jurisdiction, contract and project before making decisions. Examples illustrate the discussion; they are not official rulings or instructions for a particular case. For legal decisions, consult a qualified lawyer; for technical or other specialist matters, consult the responsible professional.