Do we need to buy a data catalogue tool for this?

Usually not at the start. Catalogue platforms like DataHub, Atlan and Collibra earn their place once the estate is large enough that nobody can hold it in their head. The work that changes behaviour is the mapping, the ownership decisions and the definitions, and that lands in documents and meetings. Tooling without those is an expensive index of a mess.

Can we start with something smaller?

Yes, and it is often the right move. The usual first slice is a data dictionary — the definitions of the metrics your teams argue about, resolved and signed off. It is short, it is the cheapest end of the range, and it treats the pain that shows up in every board meeting rather than the abstract problem.

What do we have to provide from our side?

One sponsor whose word carries inside the business, and one person per system who can answer what is in it and who has access. The sponsor matters more than the systems. Governance is a set of habits, and habits change when somebody with standing says they change.

Will this pass our enterprise client's security questionnaire?

We cannot promise a pass, and anybody who does has not read the questionnaire. What we can do is make the answers true and evidenced — a real retention schedule, a real access model, a documented map of where personal data sits. Most failures are not caused by bad policy, they are caused by answers nobody can support.

What happens to the data we already hold?

Retention and access decisions apply from the day they are switched on. Historical records get classified and, where the policy says so, deleted on a schedule. What we will not claim is that badly recorded history becomes accurate — wrong data stays wrong, and the honest deliverable is a written note on how far back each source can be trusted.

How do we know three months later whether it worked?

Three signs. The agreed definition is visible on the dashboard where the metric appears. The document is handed to new joiners as a matter of course. And somebody has used it in the last month to end an argument. If none of those are true, you have a document rather than governance, whatever the document says.

Data & Analytics

Data strategy and governance

Named owners, agreed definitions, an access model and a retention policy that actually deletes things — written to be enforced, not filed.

From: $2,000–$20,000
Typical time: 3–10 weeks
Usually bought by: Mid and large firms

What this actually solves

Three situations bring companies to this, and all three arrive under pressure.

The first is that the business grew and every department now has its own version of the truth. Finance reports one revenue figure, marketing reports another, both are calculated correctly by their own logic, and the board meeting turns into a discussion about arithmetic instead of a discussion about the business. Nobody is lying. There simply was never a moment when somebody decided what the word means, so two reasonable definitions grew up side by side and both got embedded in systems.

The second is external. An audit, a regulation, or a large customer's security questionnaire. Somebody is asking how long you keep customer records, who can see them, and what happens when a person asks to be forgotten — and the honest answer inside the company is that nobody knows. The third is that something already happened. A leak, a customer list deleted by accident, a departing employee who left with a spreadsheet. After that one, the work is no longer theoretical to anyone.

Underneath all three is the same gap. Data has been accumulating for years and nobody was ever made responsible for it. Governance is not a document — it is a set of habits with names attached. That distinction sets how this work is scoped, and it is why the first conversation is about who inside the business can say how things will be done from now on and be believed. Where that person does not exist, the sensible purchase is a narrower one, and we will say so rather than sell a policy that has nothing to enforce it.

What we do, and in what order

Map what exists. Every system holding data of consequence, what is in it, who has access today, where it flows onward and which of it counts as personal data. This is the step that reliably surprises people — the spreadsheet on somebody's laptop, the export pipeline nobody remembers building, the shared login. Three to five days.
Assign named owners. One person accountable for each significant dataset. This is the hardest part of the entire engagement and it is not technical, because ownership means being the one who answers when the number is wrong. Expect meetings, not configuration. Two to four days spread across the calendar.
Write the data dictionary and get the arguments settled. Each metric that matters gets one definition, in writing, decided rather than described. Does revenue include tax, refunds, shipping, deferred contracts? Somebody has to choose, and the choice needs the sponsor's signature on it. One to two weeks.
Build the access model, the quality rules and the retention policy. Who sees what, by role. Automated checks that fail loudly when a table stops loading or a value goes out of range — dbt tests are the usual home for these. Retention by data class, with the deletion actually scheduled. And a personal-data map that says where it lives and under which regulation. One to two weeks.
Train, then watch a cycle. The policy is walked through with the people who have to live inside it, and then observed. Writing a rule and running a rule are different events, and the second one is the deliverable. Two to three days, then a review.

One rule holds throughout, and it is not negotiable in either direction. Personal data never goes into analytics or advertising tools — no email addresses, phone numbers or national ID numbers in event parameters. It breaches platform policy and the account that gets suspended for it is yours, not ours.

What moves the price

The range is $2,000–$20,000, running 3–10 weeks, and three things decide where you land.

Size and number of departments. Every additional department is another set of systems, another owner to identify and another definition to reconcile. The mapping grows roughly with headcount; the negotiation grows faster.

Whether a regulator or a contract is involved. Compliance-driven work costs more than the equivalent internal tidy-up, because liability attaches to the answers. Evidence has to be produced and defensible, not merely sensible.

Whether we are writing the policy or implementing it too. Documents are the cheap half. Building the access changes, wiring the quality tests and scheduling the deletion jobs is where the hours are, and it is also where the policy stops being aspirational.

What usually goes wrong

A beautiful document that nobody opens twice. The engagement ends, the PDF is circulated, everyone agrees it is thorough, and three months later people are working exactly as they did before. The document was never the point. Test it by looking for the three signs of life — the definition visible on the dashboard, the document given to new joiners, and at least one argument ended by citing it in the last month. If none of those happened, the work did not land, however good the writing was.

Definitions written before the argument is settled. A definition can be drafted in an afternoon; getting finance and marketing to abandon the version each of them has defended for three years is the actual job, and it cannot be delegated to a template or a language model. The deliverable is the decision, minuted with the sponsor's name on it. A dictionary assembled without that decision just adds a third definition to the two already in play.

A retention policy that never deletes anything. This one is quietly dangerous. The policy is written, approved and cited in the security questionnaire — and no deletion job was ever built, so records that were supposed to expire two years ago are still sitting in a backup and an old CRM. The company is now on record making a statement that is not true, which is a worse position than having had no policy at all. Retention is only finished when something has actually been deleted on schedule and somebody has checked that it was.

See where the site stands before you brief anyone.

If the site is already live, start from what it scores rather than from a guess. The audit reports what it checked, what it found, and — the part most tools leave out — what it could not check, and why.

See the website audit Talk about this work

Questions people ask before they commit.

Do we need to buy a data catalogue tool for this?: Usually not at the start. Catalogue platforms like DataHub, Atlan and Collibra earn their place once the estate is large enough that nobody can hold it in their head. The work that changes behaviour is the mapping, the ownership decisions and the definitions, and that lands in documents and meetings. Tooling without those is an expensive index of a mess.
Can we start with something smaller?: Yes, and it is often the right move. The usual first slice is a data dictionary — the definitions of the metrics your teams argue about, resolved and signed off. It is short, it is the cheapest end of the range, and it treats the pain that shows up in every board meeting rather than the abstract problem.
What do we have to provide from our side?: One sponsor whose word carries inside the business, and one person per system who can answer what is in it and who has access. The sponsor matters more than the systems. Governance is a set of habits, and habits change when somebody with standing says they change.
Will this pass our enterprise client's security questionnaire?: We cannot promise a pass, and anybody who does has not read the questionnaire. What we can do is make the answers true and evidenced — a real retention schedule, a real access model, a documented map of where personal data sits. Most failures are not caused by bad policy, they are caused by answers nobody can support.
What happens to the data we already hold?: Retention and access decisions apply from the day they are switched on. Historical records get classified and, where the policy says so, deleted on a schedule. What we will not claim is that badly recorded history becomes accurate — wrong data stays wrong, and the honest deliverable is a written note on how far back each source can be trusted.
How do we know three months later whether it worked?: Three signs. The agreed definition is visible on the dashboard where the metric appears. The document is handed to new joiners as a matter of course. And somebody has used it in the last month to end an argument. If none of those are true, you have a document rather than governance, whatever the document says.

Often taken together.

Start with the brief, not the invoice.

Send what you are trying to achieve. You get a written scope, a price and a date — or an honest “this is not the right service for that”.

Talk about Data strategy & governance All Data & Analytics services