The Data Owner Who Isn't

Most data governance frameworks have a data owner for every domain. Far fewer have data owners who actually decide anything. The register is full, the role is empty, and the data office quietly does the work. This briefing looks at why that happens and what a CDO can change.

The Name on the Slide

Data owners are usually appointed in one of three ways. The first is by organisation chart: the head of the business line that produces the data becomes its owner by default. The second is by seniority: the role goes to the most senior person who will not refuse it. The third is by deadline: a programme or an audit needs a completed RACI, so names are filled in before the role is defined.

All three produce the same result. A senior person holds a title for a domain they do not manage day to day, with no description of what the title obliges them to do. The symptoms are familiar to anyone who has run a data office:

• Access requests are approved by the data team or by IT, because the owner never answers or answers "whatever you think".
• Business definitions are settled by data stewards, who then struggle to enforce them because they lack the authority.
• Data quality issues escalate to the data office, not to the owner, because everyone knows where the work actually gets done.
• The owner first hears of their role in a governance forum, or during an audit.

None of this means the people involved are negligent. It means the organisation created a role and gave it nothing to do.

Why the Role Stays Empty

No decisions are assigned

Most role descriptions say the owner is "accountable for the data". Accountable for what, exactly? If no decision is written down as belonging to the owner, every decision ends up with whoever is closest to the problem.

No time is allocated

Ownership is added to an existing job, often a demanding one, with no reduction elsewhere. Data decisions then compete with revenue, clients and headcount. They lose.

Nothing happens when the role is not exercised

Ownership rarely appears in objectives or performance reviews. An owner who never decides suffers no consequence, so the rational choice is to delegate everything informally.

The data office fills the gap

This is the cause CDOs like least, because it is their own. When the owner does not decide, the data team decides instead to keep things moving. Each time it does, it confirms that the owner is not needed. The gap becomes permanent.

What FINMA Actually Asks For

For Swiss banks and securities firms, the question is no longer only one of good practice. FINMA Circular 2023/1 "Operational risks and resilience – banks", in force since 1 January 2024, contains a dedicated section on critical data risk management (chapter IV, letter D).¹ Three provisions matter for ownership:

• Margin no. 72: the executive board must define clear tasks, competencies and responsibilities for dealing with the data identified as critical, and appoint a unit to establish and monitor the framework for its confidentiality, integrity and availability.
• Margin no. 73: the institution must identify its critical data in a systematic and comprehensive way, categorise it by criticality, and define clear responsibilities.
• Margin no. 74: critical data must be managed throughout its entire lifecycle.

Above that, margin no. 24 requires the board of directors to regularly approve strategies for dealing with critical data and to monitor their application.

Proportionality applies. Banks and securities firms in FINMA supervisory categories 4 and 5 are exempt from margin nos. 73 and 74, among others.¹ For everyone else, a register of names is weak evidence. A record of decisions is strong evidence.

The Ownership Ladder

A simple way to assess where you stand is to place each owner on a five-step ladder. Each step has an observable test, so the assessment does not rely on self-declaration.

1. Unnamed.

   No one is designated for the domain. Test: the register has a blank, or a team name instead of a person.

   Level 0
2. Named.

   A person is designated but has not been briefed on the role. Test: the owner cannot say what the role requires of them.

   Level 1
3. Informed.

   The owner knows the role and receives reports, but decisions are taken elsewhere. Test: the owner is in copy, not in the approval path.

   Level 2
4. Deciding.

   The owner takes a defined set of decisions, on time. Test: approvals, definitions and quality thresholds carry the owner's sign-off.

   Level 3
5. Accountable.

   The owner answers for the outcome, and it shows in their objectives and in risk reporting. Test: data issues in the domain are escalated to the owner and reviewed with them.

   Level 4

For critical data domains, level 3 is the minimum worth aiming for.

Making the Role Real

Write down the decisions

Define three to five decisions that belong to the owner and to no one else. Typical candidates are approving access to the domain's data, approving business definitions, setting data quality thresholds, accepting a known data risk, and approving new uses of the data. Fewer decisions, clearly written, beat a long list of responsibilities.

Separate deciding from doing

Data stewards prepare, analyse and execute. The owner decides. This keeps the owner's time demand small, which is the only way a senior business leader will accept the role.

Route decisions through existing forums

Do not create another committee. Put data decisions on the agenda of meetings the owner already attends, such as the business line's risk or management committee.

Stop deciding on the owner's behalf

When an owner does not decide, the data office should escalate, not substitute. This is uncomfortable and slows things down at first. It is also the only way to make the gap visible instead of hiding it.

Measure decisions, not names

Track how many defined decisions each owner took, and how long they took. A complete register with no decision log tells you nothing.

A Checklist for the CDO

Owners Decide. Registers Do Not.

A data owner is not a name in a register. It is a person who takes specific decisions about specific data, and answers for them. Until those decisions are written down and routed to that person, the role exists on paper only, and the data office will keep doing the job by default.

Sources & references

1. FINMA, Circular 2023/1 "Operational risks and resilience – banks", 7 December 2022, in force 1 January 2024. Chapter IV.D on critical data risk management (margin nos. 71 to 82), in particular margin nos. 72, 73 and 74; board approval of strategies for critical data (margin no. 24); exemptions for FINMA categories 4 and 5 (chapter III). finma.ch