Data Governance glossary for SMEs

01 Data Governance foundations

Data Governance

Responsibility, decision rights, rules and processes for data and its use.

For a company with 5-50 people, a useful starting point is a source register, metric glossary, access matrix and review schedule. Expand the scope as systems, risk and the number of data users grow.

Data owner

The business role accountable for decisions about access, definitions and expected quality for specified data.

Record the stable role in the procedure and the current person's name in the working register. The owner makes decisions, while another person may perform checks and corrections.

Data steward

The role that performs operational work on data definitions, quality and documentation.

In a small company, one person may combine steward and data owner responsibilities. Keep decision accountability separate from performing a control or correction.

Data maturity

The extent to which data management practices are defined, used and measured.

The 12-question self-assessment in module 1 shows the current position and the first area to improve. Its score covers this checklist and is not a certified organisational maturity assessment.

Single source of truth

An agreed source, definition and use context for a particular fact or metric.

A company can use different valid numbers for different purposes. The glossary states which definition and source applies in a report, such as financial results from ERP and traffic from GA4.

02 Data sources and flows

Data source register

A table of systems and files used as sources, including scope, responsibility and downstream flow.

Minimum fields are source name, contents, owner, refresh frequency, access and downstream destinations. Check completeness against reports, software invoices and team input.

Data flow or data lineage

The path from data creation to a report through systems, exports and transformations.

For an SME, arrows such as store or ERP to export to Excel to management slide can be enough. Each step can alter the figure. This working map helps diagnose discrepancies but is not automated technical lineage from metadata.

Source of record

The agreed authoritative source that resolves differences for a particular fact or metric.

It need not be the place where the information originated. The metric definition decides the source, such as finance or ERP for paid net revenue and GA4 for site traffic.

Shadow IT

Unofficial copies and tools holding company data, including private sheets, local exports and unapproved accounts.

A temporary CRM export may become a stale personal-data copy outside company control. Find it and decide whether to delete it, move unique data to the official source or register it with an owner and rules.

Data integration

Automated movement of data between systems instead of manual exports and pasting.

A weekly manual export may be reasonable for an SME, but the register should say who performs it, when and where it goes. The risk is undocumented manual work, not manual work itself.

03 Metrics and business definitions

Business glossary

Company definitions for metrics and terms such as conversion, customer and revenue.

Each definition records a name, source, calculation, exceptions, owner and change date. This lets the team state which method a report uses and identify methodology changes.

Metric definition

A precise description of a metric's source, formula, scope, exceptions and owner.

A useful definition settles recurring questions: whether revenue includes VAT, whether orders are placed or paid, how returns work and where the reporting day ends.

Attribution

Rules for assigning conversion credit to traffic sources. Different models divide the same data differently.

GA4 and Google Ads use configured models and reporting scope, while CRM may store a first or last source. Attribution divides credit and is not the same as the conversion window.

Conversion window

The time after an interaction during which it remains eligible for conversion credit.

In Google Ads, a click-through window is often 30 days by default but depends on the action type and configuration. Attribution allocates credit, while the selected report column determines whether results use interaction or conversion time.

GA4 session

A group of interactions that starts when a user opens a site or app without an active session.

A GA4 session ends after 30 minutes of inactivity by default, subject to configuration. Unlike Universal Analytics, it does not restart automatically at midnight or after a campaign source change.

Reporting time zone

The time zone a system uses to divide reporting days. Different zones can change daily figures.

GA4 in UTC and CRM in a local time zone may assign late-night orders to different days. The effect often reduces over longer periods but can mislead in daily reporting.

04 Data quality

Data quality dimensions

The criteria used in the course: completeness, accuracy, consistency, timeliness and uniqueness.

This is not an exhaustive model. A process may also need format or business-rule validity. Score each dimension against a defined use and threshold.

Data completeness

The share of records containing the fields needed for work.

Examples are contacts with email, transactions with a source and SKUs with a category. Decide which fields are required before measuring and enforcing them.

Deduplication

Finding, reviewing and safely merging or deleting records that describe the same entity while preserving required history.

A normalised email or another person identifier can help with contacts. A normalised company tax ID identifies companies, not people. Unreviewed automatic merging can combine different people or lose history.

UTM convention

Agreed naming rules for campaign parameters such as utm_source, utm_medium and utm_campaign.

Without a convention, one source appears as facebook, Facebook and fb. Prefer platform auto-tagging where supported. For manually tagged links, use approved values and a link builder.

Data quality review

A short, regular audit of important datasets using a repeatable checklist.

A quarterly 60-minute review is a practical starting point for a small team. Set frequency by risk and pace of change, and review sooner after incidents or important system, definition or access changes.

05 Access and security

Access matrix

A table with systems in columns, people in rows, and an access level and reason in each cell.

Compare actual accounts with access required by each role. Every mismatch receives a decision, owner and correction date.

Least privilege

Each person receives only the access needed for their work, not administrator rights for convenience.

Administrator access should have a documented reason. Limiting permissions reduces the effect of mistakes, departures and account compromise.

Access offboarding

The procedure for removing access when an employee, freelancer or agency finishes work.

Review all accounts in the access matrix, shared passwords, file ownership and external access. Confirm completion instead of merely assigning the checklist.

Data retention

Rules for how long each type of data is kept and when it is deleted.

Tool defaults are not policy. A standard GA4 property defaults to two months for user and event data used in features such as Explorations, while aggregated standard reports are not shortened to two months. Record data type, period, purpose or basis, deletion method and owner.

Backup

A regularly created and tested copy from which important work can be restored.

Design follows the risk and architecture. At minimum, separate the copy from the original, control access and record the result of a regular restore test.

06 Compliance: GDPR, consent and AI

GDPR

The EU legal framework for processing personal data relating to natural persons.

The course covers operational basics for SMEs: ROPA, retention, supplier relationships and access hygiene. During a breach, the company must contain, document and assess it. DPO or legal support helps but does not replace the procedure or any required notification.

Record of processing activities

The GDPR Article 30 record of purposes, people and data categories, recipients, relevant transfers, deletion periods and security measures.

Legal basis is useful to add although it is not listed in Article 30(1). As at 25 August 2026, the exception for organisations below 250 people does not cover non-occasional or risky processing or Article 9 and 10 data. Check the current text because legislation was under change.

Consent mode

Google's mechanism for communicating consent state to tags. It is not a banner or an independent legal basis.

Basic mode blocks tags after refusal. Advanced mode may send cookieless pings. GA4 modelling requires configuration and volume and is not guaranteed. A technical audit does not replace legal review of the consent design.

AI use policy

Rules for data, use approval, output review, transparency and change reporting.

Do not send customer or special-category data to an AI tool without assessing the specific use, supplier role, purpose, legal basis, minimisation, retention, transfers, configuration and security. A DPA is necessary for a processor but is not sufficient on its own.

AI use-case register

An inventory of AI uses covering purpose, data, roles, risk, duties, accountability and status.

It is the entry point for GDPR, AI Act, security and cost assessments, not proof of compliance. Each use needs an owner, review date and output verification method.

AI literacy

Knowledge and skills needed to use AI safely in a specific context and recognise output limitations.

As at 25 August 2026, AI Act Article 4 requires providers and deployers to take measures that support AI literacy for people using systems on their behalf. Match instruction or training to the data, effects of error, user experience and affected people.

Data processing agreement

The GDPR Article 28 agreement required when a supplier processes personal data on a controller's behalf.

First identify the supplier's role: processor, separate controller or mixed roles. A processor needs a DPA, but the agreement does not replace assessment of purpose, data scope, subprocessors, retention, security and third-country transfers.