As data volumes expand exponentially, the need for robust, standardised governance frameworks has become pressing. To address this, international standards such as ISO/IEC 38505-1 (data governance) and ISO/IEC 19944 (data flows, categorisation and use in cloud computing) provide structured methodologies that help organisations demonstrate responsible and effective data management.
ISO/IEC 38505-1, which supplements ISO/IEC 38500 on IT governance, establishes a framework for data accountability across the lifecycle. It requires organisations to evaluate data activities in terms of their value, risk and constraints, ensuring alignment between data strategy and business objectives. The standard sets out six principles: (i) responsibility; (ii) strategy; (iii) data acquisition; (iv) performance; (vi) conformance; and (vi) human behaviour, each reinforcing the idea that governance is continuous. See graphic illustrating how data activities are continually evaluated, directed and monitored within a comprehensive governance framework.
In contrast, ISO/IEC 19944 focuses on the practicalities of data management, particularly in cloud environments. It introduces the concept of data use statements, which describe how data will be collected, categorised, processed and shared. These statements help define scope and responsibility across the data lifecycle, supporting transparency and interoperability.
Adopting these standards delivers multiple benefits:
- It provides a common language between technical, legal and business stakeholders.
- It allows data practices to be audited and benchmarked.
- It enables trust and accountability in contractual and regulatory relationships.
Ultimately, technical standards transform data governance from a compliance burden into a mechanism for continuous improvement, risk mitigation and strategic advantage.
This article was compiled using insights from our recent white paper: Legal Aspects Data – Governance and Management.
