Data governance for organisations without a data team

Data governance sounds like something only large organisations do. For a small organisation, it means answering four questions and writing the answers down:

1. Who is responsible for each set of information?
2. Who decides who can see it, use it or share it?
3. What rules apply to it?
4. How do we know the rules are being followed?

Without answers, privacy depends on whoever happens to care. With them, it survives staff turnover.

The roles

You don’t need new staff. You need names next to responsibilities.

The most common gap is the information owner. When nobody owns a dataset, access creeps, retention never happens, and new uses get approved by whoever asks.

The decisions to write down

For each significant set of personal information, record in your personal information inventory:

• the owner
• the purpose it’s held for
• who can access it, by role
• how long it’s kept, and how it’s destroyed
• whether it can be shared, with whom, and on what basis
• where it’s stored, including overseas

The routines that keep it working

• New things get checked. Any new system, supplier, AI tool, data-sharing arrangement or significant change of use goes through a privacy impact assessment threshold check before it’s approved.
• Access is reviewed. Owners confirm who has access to their systems twice a year. Leavers lose access on their last day.
• Retention actually runs. Someone deletes or destroys information on schedule, and records that they did.
• Leadership hears about it. A short report twice a year covers requests, breaches and near misses, risks, and progress on the plan. Use our board privacy report.
• The framework gets checked. Once a year, repeat the privacy self-check and compare.

Data quality is part of governance

IPP 8 requires you to check information is accurate, up to date, complete and relevant before you use it. Good governance improves quality as a side effect, because when someone owns a dataset, errors get fixed. The Privacy Commissioner makes the same point about Poupou Matatapu, which it says helps improve data quality as well as privacy.

Sharing data with others

Before sharing personal information with another organisation, the owner should be able to say what the purpose is and what the legal basis is (an IPP 11 exception, a law, the person’s authorisation, or an approved information sharing agreement). They should also know exactly what will be shared, how it will be protected, and when it will be deleted. Write it into a data sharing agreement.

Customer data rights in regulated sectors

The Customer and Product Data Act 2025 creates a consumer data right in sectors the Government designates. Banking was designated first, with the largest banks required to share designated data with accredited requestors, at the customer’s request, from 1 December 2025. The Government has decided to designate the electricity sector next. If you’re in a designated sector, your data governance needs to cover these sharing obligations alongside the Privacy Act.

For public sector agencies

Public sector agencies have additional expectations, including the Government Chief Privacy Officer’s Privacy Maturity Assessment Framework and the Government Chief Data Steward’s standards. The roles and routines above still apply.