Mandate
Agree the scope, the sponsor and the decisions the council is actually allowed to take.
Done when: The council has written authority to block a release.
Data Governance Operating Model (DGOV)
Data Governance Operating Model
Roles, cadence and enforceable policy, governance that runs weekly rather than a charter that sits in a folder.
The business problem
Governance on paper. Chaos in practice.
Policies are approved, committees meet, yet nobody knows who decides when data is wrong or shared.
What you hear inside the organisation
The policy exists, nobody follows it.
Who approves sharing this data?
Stewards are named but have no time.
PDPL requests take too long to answer.
Who it serves and what changes
Your teams, before and after the Data Governance Operating Model
Client teams and what they need
Data governance office
A model that runs every day
Business data owners
Decision rights that fit their role
Privacy and legal
Fast, traceable responses
IT
Policies enforced in tools
The outcome you get
- Decision rights per data domain
- Steward routines that fit real workloads
- Policies enforced through catalogue and access tools
- NDMO and PDPL evidence produced as work happens
A worked example
A health cluster handling patient data requests
The problem we saw
Policies were approved, but nobody knew who could approve data sharing. Requests waited in email.
How the framework solved it
We set decision rights per domain, gave stewards a realistic routine, and enforced policy through catalogue and access tools.
The business result
Requests reach the right owner, decisions are recorded, and PDPL evidence is produced as work happens.
Illustrative example based on common client situations.
In short
What is the Data Governance Operating Model?
Data Governance Operating Model (DGOV): Roles, cadence and enforceable policy, governance that runs weekly rather than a charter that sits in a folder.
Governance fails when it is written as policy and never wired into a system.
- How it moves
- Each step closes with a check before the next begins
- Owned by
- Run by the data governance office; chaired by the data governance council with executive sponsorship.
- You keep
- Operating model, Enforced policy set, Exception register
How it works
How the Data Governance Operating Model works
The test of governance is not the policy count. It is whether an unapproved dataset can reach production, and whether anyone would notice.
Roles
Name the owner, steward and custodian for each domain, with the time commitment stated.
Done when: No domain is left with a role held by a committee.
Policy
Write the minimum policy set: classification, lawful basis, retention, sharing, access, quality.
Done when: Each policy names the control that enforces it and the system it lives in.
Enforce
Wire the controls into pipelines and platforms so a breach fails a job or blocks access.
Done when: At least one policy is demonstrably enforced without human review.
Run
Hold the cadence: exceptions, incidents, new domains, and a quarterly report to the sponsor.
Done when: Every exception has an expiry date and a named approver.
Is it right for you?
Is the Data Governance Operating Model right for you?
A strong fit if
- Governance exists mainly as documents
- Data sharing decisions are slow or unclear
- You must evidence NDMO or PDPL compliance
Probably not yet if
- Your organisation is small with one data owner
- You want a policy template only
Free assessment
Discuss the Data Governance Operating Model with our team
A working session with our senior team. We review what fits your situation, what does not, and where to start.
A focused conversation
We listen to your situation and goals.
Fit review
Which parts of this framework apply to you, and which do not.
A written view
Clear next steps, whether or not you work with us.
Go deeper
Applying the Data Governance Operating Model in practice
Open only the part you need: how it starts, what your team keeps, maturity levels, sector rules and the evidence a reviewer will ask for.
Governance fails when it is written as policy and never wired into a system. DGOV assigns owners, stewards and custodians, fixes the council cadence, and makes each policy resolve to a control that a pipeline or platform enforces.
Version
v1.0
Last reviewed
August 2026
Family
Data & Analytics Operating System
How this was developed: Built from delivery practice on Saudi and international engagements, then reconciled clause by clause against the published standards below. Revised when a standard is updated or a gate proves unworkable in the field.
Operating model
Roles, council cadence and decision rights in one document.
Enforced policy set
Each policy mapped to the control and system that enforces it.
Exception register
Dated, approved, and reviewed at every council meeting.
Banking & finance
Council decisions must be traceable for supervisory review; minutes are evidence, not notes.
- Who reviews it
- SAMA, plus PDPL and NCA controls
- Systems in scope
- Core banking, cards, KYC and AML systems, credit bureau feeds, the general ledger
- Where it lands first
- KYC and AML review, credit decisioning support, complaint and dispute handling
1
Mandate
- Council charter
- Decision rights matrix
2
Roles
- Role register
- RACI per domain
3
Policy
- Policy set
- Control mapping
4
Enforce
- Enforced control list
- Exception register
5
Run
- Council minutes
- Quarterly governance report
The test of governance is not the policy count. It is whether an unapproved dataset can reach production, and whether anyone would notice.
Stage
Exit gate
Artefacts
1
Mandate
Agree the scope, the sponsor and the decisions the council is actually allowed to take.
Exit gate
The council has written authority to block a release.
Artefacts
- Council charter
- Decision rights matrix
2
Roles
Name the owner, steward and custodian for each domain, with the time commitment stated.
Exit gate
No domain is left with a role held by a committee.
Artefacts
- Role register
- RACI per domain
3
Policy
Write the minimum policy set: classification, lawful basis, retention, sharing, access, quality.
Exit gate
Each policy names the control that enforces it and the system it lives in.
Artefacts
- Policy set
- Control mapping
4
Enforce
Wire the controls into pipelines and platforms so a breach fails a job or blocks access.
Exit gate
At least one policy is demonstrably enforced without human review.
Artefacts
- Enforced control list
- Exception register
5
Run
Hold the cadence: exceptions, incidents, new domains, and a quarterly report to the sponsor.
Exit gate
Every exception has an expiry date and a named approver.
Artefacts
- Council minutes
- Quarterly governance report
Standard
What this framework satisfies
DAMA / DCAM
Governance, stewardship and policy knowledge areas, made operational.
NDMO
Data governance and personal data protection domains with named accountable roles.
PDPL
Lawful basis, retention, sharing and subject-rights handling assigned to owners.
ISO/IEC 42001
Management-system roles, responsibilities and review cadence.
NCA
Access control and data-handling controls evidenced in the enforced control list.
Policy without a control
A written rule nobody can enforce trains the organisation to ignore governance.
Stewards with no time
Naming a steward without protected hours produces a role that exists only on the chart.
Permanent exceptions
An exception with no expiry becomes the new standard within two quarters.
Built on
- 1
DAMA-DMBOK and EDM Council DCAM
Data management knowledge areas and capability assessment.
- 2
NDMO data management and personal data protection standards
National Data Management Office specifications and domains.
- 3
Personal Data Protection Law (PDPL) and its implementing regulations
Lawful basis, subject rights, transfer and retention.
- 4
ISO/IEC 42001: AI management systems
International Organization for Standardization, management system requirements for AI.
- 5
NCA Essential and Cloud Cybersecurity Controls
National Cybersecurity Authority control catalogues.
Citations describe the parts of each standard the framework answers. Bilytica is not an accreditation or certification body.
In Saudi Arabia
The data layer, as NDMO reads it
Most AI programmes in Saudi Arabia stall underneath the model. These frameworks work on that layer, against the control set the national office actually assesses.
AuthorityWhat it requiresWhat we buildWhat you keep
NDMO data management controls
Owners, policies and measurable maturity across every data management domain.
Baseline assessment, then control-by-control remediation with dates and owners.
Maturity baseline and a re-assessment on the same control set.
SDAIA, PDPL
Classification and retention applied to personal data wherever it is copied.
Classification enforced in the platform, so a copy inherits the rules of its source.
Lineage view showing classification travelling with the data.
ZATCA, for invoicing and transactional data
Invoice and transaction records reconcile to the filed position.
Reconciliation checks run as data quality rules, with exceptions routed to an owner.
Reconciliation report and an exception log with resolution times.
Where it runs
Registers, lineage and quality evidence live in your environment inside Saudi Arabia and stay yours.
Arabic, as it is spoken here
Business glossaries are maintained in Arabic and English together, with Arabic as the governing definition.
FAQ
Frequently Asked Questions
How large should the council be?
Small enough to meet fortnightly and decide. Domain owners attend for their domain rather than sitting permanently.
Where does it overlap with security?
Access and protection controls are shared with the security function; governance owns classification, lawful basis and retention.
Do we need this before AI work starts?
A minimum set does have to exist: classification, lawful basis and access. The rest can mature alongside delivery.
Where this connects
Rest of the library
DFFData Foundation FrameworkAIRMAI Readiness ModelVALUEAI Value FrameworkTRUSTAI Assurance FrameworkDELIVERAI Delivery FrameworkAGENTAgent Operations FrameworkSOVEREIGNSovereign AI FrameworkDMMData Management Maturity ModelDPAData Platform Architecture FrameworkDQFData Quality & Observability FrameworkDECIDEAnalytics & Decision FrameworkSDCFSaudi Data Compliance FrameworkAQSArabic Quality StandardKSA-READYIn-country Deployment Framework
Topic cluster
Explore the topic cluster
Curated links across our Saudi hubs, sector pages and long-form blog research.