Who owns your company’s data?

The politically correct answer is that the business owns the data and IT manages it for them. That’s nice in theory, but is it really true? Does your company have a data governance group (run by the business) that actually sets data policy? Do you have data stewards that actively work to define usage and improve quality? I hear this exists in large comnpanies, but have you ever seen this in small-to-mid sized companies that you have worked in? How effective was it? Please chime in on this. I’m writing an article on data ownership and I would love to include your feedback.

Legally, the company owns the data.  

However, maintaining control over where it goes is a completely different issue.  Maintaining access controls on file shares and databases is a chore, particularly if you are keeping track of things manually.

Governance programs help make sure everyone who needs access has it and those who don’t need access don’t.  IT rarely knows who has a real need to view fileserversharename, but the business group generally does.  They can tell IT who has transferred out and needs their access removed.  (If they remember to mention it)  Or tell you who is missing access rights.  A good governance program makes sure that a periodic (monthly, quarterly, yearly?) review is done to make sure that these controls are correct.

Trying to do these reviews by manually checking shares, dumping the data into an spreadsheet and getting feedback is a painful process.  This is where tools can be real valuable.  The price can range from REALLY expensive to fairly cheap.  It depends on how far you want to go and how much additional work you are willing to do.  Once you get the data into a document for business to review, getting their feedback hasn’t been too difficult in my experience.  Cleaning up permissions isn’t too bad either.

Then we open Pandora’s Box.  While the company may have an excellent governance program, there’s all that data that gets saved on desktops, laptops, USB drives, iPods and emails.  All of which steps outside of central control and can wander very far in a short period of time.  That’s a scary mess and its far too easy for someone to walk out the door with your most important intellectual property.  Technology tools are starting to get better at controlling access to removable media devices and such, but trying to control what goes out the network is sketchy.  Data leakage prevention software (DLP) hasn’t impressed me too much yet.  But I haven’t seen all the apps out there, so maybe something actually works as well as advertised.

Either way, as we keep coming up with new and interesting ways to share information, the controls to keep proprietary data confidential fall behind.  Governance programs continually get re-adjusted and vendors promise to solve our woes.  The hamster wheel of pain continues to spin and we race along trying to keep control of our data.