Data has become one of the most consequential assets within the modern enterprise. Yet, many organizations still manage it primarily as a technology concern rather than as a business asset with identifiable ownership, obligations, risks, and economic value. Realizing the value of the data estate begins with a simple but often difficult premise: know thy data — understand what data the organization holds, where it resides, how it moves, who is accountable for it, how it must be protected, and what legal, regulatory, and business requirements apply to it.
Data governance is not the end state. It is the enabling layer that turns an unmanaged collection of information into a governed data estate capable of producing measurable business and economic value.
If data is treated as an enterprise asset, that treatment should also extend beyond traditional stewardship and governance into the organization’s financial management, with Finance providing appropriate oversight of how the data estate is valued, measured, and reported. This oversight should, over time, include the development of defensible methods for estimating and tracking the enterprise value of the data estate, including a management view of its net economic value. That foundation allows organizations to establish effective governance, assign ownership and stewardship, apply appropriate security and compliance controls, assess the value of their information assets, and ultimately use trusted, well-governed data to enable analytics, AI, new products, and other forms of enterprise value creation and monetization.
The graphic serves as a roadmap for the sections that follow, which describe the principal areas of responsibility and the activities required to manage the data estate as an enterprise asset. Each layer, starting with data at the center, builds on the one before it: understanding the data, defining legal and regulatory obligations, protecting it appropriately, assigning ownership and stewardship, establishing governance, determining value, and creating monetization opportunities.
These responsibilities are distributed across Legal, Risk, Compliance, Privacy, Information Security, business and data owners, stewards, Data Governance, and Finance, with each function contributing a distinct element of accountability and control. Collectively, they create the operating model necessary to move data from an unmanaged or under-managed resource to a governed, measurable, and value-generating enterprise asset. The central point follows from that sequence: Data governance is not the end state. It is the enabling layer that allows the enterprise to know, control, and value its data, and ultimately to convert it into measurable enterprise value. Finance belongs in that model alongside the control functions.
1. Data at the Center: ‘Know Thy Data’
Call it the “11th Commandment” of data governance: Everything begins with knowing what data the organization has, where it resides, who owns it, how it is used, where it moves, and how important or sensitive it is. A comprehensive, sustainable data inventory supported by classification, metadata, lineage, ownership, and usage information is foundational. Without it, Legal, Risk, Compliance, Privacy, Information Security, and the business are all making decisions with an incomplete view of the data estate. A sustained inventory replaces that partial view with decision-grade evidence for every choice that follows.
2. Legal, Risk, Compliance, and Privacy: ‘What Obligations Must We Fulfill?’
Legal, Risk, Compliance, and Privacy translate laws, regulations, contractual commitments, regulatory expectations, and enterprise risk appetite into requirements governing how data may be collected, used, shared, retained, transferred, and disposed of. Their responsibility is to identify applicable obligations, assess and communicate risk, establish or interpret required controls, and provide appropriate challenge and oversight so the organization can demonstrate that its treatment of data is legally permissible, compliant, and within established risk tolerances.
3. Information Security: ‘How Must the Data Be Protected?’
Information Security determines and implements the safeguards necessary to protect data based on its sensitivity, criticality, location, users, and threat environment. This includes appropriate access controls, encryption, monitoring, identity management, loss prevention, resilience, incident response, and other preventive and detective controls — with the level of protection driven by an informed understanding of the data being protected rather than by technology alone.
4. Business Objectives, Data Ownership, and Stewardship: ‘Why Do We Need It, and Who Is Accountable for It?’
The business establishes the purpose and value of collecting, creating, and retaining the data: why it is created or acquired, how it supports processes and decisions, and what level of quality and availability is required. Data owners remain accountable for the data within their domain, while data stewards operationalize that accountability by maintaining definitions, metadata, quality requirements, issue resolution, lineage, appropriate use, and adherence to governance standards throughout the data lifecycle.
5. Data Governance: Establishing the Operating Model
Data Governance brings these perspectives together through an enterprise operating model that establishes decision rights, accountability, policies, standards, processes, controls, and escalation mechanisms for the data estate. Governance does not assume the responsibilities of the business, Legal, Risk, Compliance, Privacy, or Information Security; rather, it establishes the framework through which those responsibilities are coordinated, executed, evidenced, and overseen. It requires active participation from the business, Legal, Risk, Compliance, Privacy, and Information Security, and depends fundamentally on “know thy data”: a reliable inventory, clear ownership, common definitions, classification, quality, lineage, and lifecycle understanding from which governance decisions can be made and evidenced.
6. Data Valuation: Treating Data as an Enterprise Asset
Once data is known and governed, the organization can begin managing the data estate as an asset, rather than merely as an operational by-product or technology expense. Valuation considers not only potential revenue, but also business criticality, decision-making value, uniqueness, replacement cost, regulatory importance, quality, usability, the cost of maintaining and governing the asset, and the economic or operational liability created if the data were unavailable, corrupted, compromised, or misused. Finance should have an active role in developing and overseeing the methodologies used to assess, measure, and report the economic value of the data estate. This management valuation need not imply formal balance-sheet recognition; rather, it provides enterprise leadership with a disciplined means of understanding the value, cost, risk, and return associated with data as an asset.
7. Data Monetization: Turning Governed Data Into Economic Value
Organizations with mature governance can use known, trusted, well-governed data to create new economic value through improved products, analytics, customer insights, operational efficiencies, data-enabled services, and externally or internally monetizable information assets. Increasingly, this includes AI and advanced analytics, where governed, high-quality, well-understood data becomes the raw material for models, agents, intellectual property, decision products, and other scalable capabilities that can generate revenue or materially improve enterprise performance.
Why the Sequence Matters: From Knowledge to Control to Economic Value
Ultimately, an organization cannot effectively govern, protect, value, or monetize data that it does not know and understand. The enterprise must understand the composition, characteristics, ownership, use, movement, obligations, risks, and quality of the data estate before it can credibly manage that estate as an asset. The foundation of the entire model is therefore the ability to know thy data through a sustainable inventory of the data estate, supported by clear ownership, classification, metadata, lineage, quality, usage, and lifecycle information.
That foundation allows Legal, Risk, Compliance, Privacy, Information Security, business owners, stewards, and Data Governance to each fulfill their respective responsibilities within a coordinated operating model. The objective is not governance for governance’s sake, but the establishment of sufficient accountability, control, and transparency to allow the enterprise to manage data with the same discipline applied to other strategically important assets.
As that maturity develops, the conversation should expand from control and compliance to enterprise value. Once Finance participates in the valuation and oversight of the data estate, a well-understood and well-governed data estate can become a platform for value creation that supports better decision-making, operational efficiency, advanced analytics, new products and services, and increasingly AI-enabled capabilities. Governance, in this sense, is not the endpoint; it is the mechanism that allows the organization to move from simply possessing data to managing it as an asset and ultimately converting that asset into measurable enterprise value.
The model can therefore be distilled into a progression from knowledge to control to economic utility. Each stage creates the foundation for the next, ultimately allowing the enterprise not simply to possess data, but to deliberately put a known, governed, protected, and valued asset to work for business benefit.
3 Things Chief Data Officers Should Do Now
1. Know It – Establish a defensible view of the data estate: Create or refresh the enterprise data inventory so the organization can identify what data it has, where it resides, who owns it, how it moves, how sensitive or critical it is, and how it is being used. This is the foundational “know thy data” requirement; without it, governance, security, compliance, valuation, and AI initiatives are all operating with incomplete information.
2. Control It – Make accountability and governance executable: Clarify decision rights across data owners, stewards, Legal, Risk, Compliance, Privacy, Information Security, Technology, and Data Governance, and ensure that obligations are translated into operational standards, controls, evidence, escalation paths, and measures. The objective is to move beyond policies and committees to a governance operating model that can demonstrate who is accountable, what they must do, and whether it is being done.
3. Create Value From It – Put an economic lens on the data estate: Partner with Finance and the business to identify which data assets create the most value, which impose the greatest cost or liability, and where governed data can be used to improve performance, create new products and services, or enable differentiated AI capabilities. The immediate goal is not formal accounting recognition, but a disciplined management view of the value, cost, risk, and return associated with enterprise data.
Conclusion
The next evolution of data governance is not more governance.
It is the transition from governing data as something that must be controlled to governing data as an enterprise asset that must be understood, protected, measured, and deliberately used to create value.
Organizations that continue to treat data primarily as a technology by-product, compliance obligation, or storage problem will struggle to realize the economic return available from the information they already possess.
A Governed Data Estate changes that equation. It begins with the discipline to know thy data, extends through clearly defined obligations, protection, ownership, and accountability, and creates the foundation for meaningful valuation and responsible use. The purpose of governance is therefore not simply to reduce risk; it is to create sufficient trust, transparency, and control that the enterprise can confidently turn data into better decisions, differentiated capabilities, new products, intellectual property, and AI-enabled sources of economic value.
The chief data officer’s mandate is consequently broader than building a governance program or implementing a data platform. The mandate is to help the enterprise understand, control, value, and use its data estate as a strategic asset — and to demonstrate that the asset is producing measurable business and economic value. Success should ultimately be judged not by the number of policies written, data elements cataloged, or governance committees established, but by whether the organization can responsibly convert its data into sustained enterprise advantage.
© Copyright 2026. The views expressed herein are those of the author(s) and not necessarily the views of Ankura Consulting Group, LLC, its management, its subsidiaries, its affiliates, or its other professionals. Ankura is not a law firm and cannot provide legal advice.
