By Maria Villar

Enterprise data management is about breaking down the silos that can constrain the success of an organization’s overall data governance efforts. Maria Villar explains the role of the privacy professional in the emerging trend toward EDM.

The enterprise data management program

The effective management of sensitive customer and employee data is at the heart of an effective privacy program. Programs that identify, store, process, and safeguard this data, in compliance with company and government privacy requirements, becomes the responsibility of the chief privacy officer, working in partnership with the company’s business and IT functions. Typically, the data management programs to comply with the company’s privacy policies are separate and unique from the company’s other data management programs that manage the data requirements for Sarbanes-Oxley compliance, risk management, customer relationship management, and human resource management. However, a new data management trend is emerging. Leading companies are consolidating these silo data management programs into one Enterprise Data Management (EDM) program and appointing a chief data officer.

Consolidating silo data management programs has many benefits but comes with implementation challenges. Benefits include increased efficiency and cost savings by using common technologies, processes, and organizational structures. Just as important is the coordination of activities on the same data. Customer and employee data are important to the company’s marketing, sales, financial, customer service, and supply chain processes. Coordinating how sensitive data is created, stored, and safeguarded for the good of all the data users ensures that one division’s requirements don’t override the needs of another. Additionally, a company-wide EDM program focuses senior executive attention to business data. Business data is handled as a “company asset,” similar to other assets like products, people, and capital.

With significant benefits, come implementation challenges. An EDM program requires cross-division and cross-process coordination. As in any other cross-company program, an effective leader must be chosen—one who can bring various, conflicting requirements together—and governance must be established to prioritize the data activities across the company. The appropriate funding and metrics must be established to ensure the company’s return on investment. While all groups participate, at times the needs of the enterprise may override the needs of the few. Strong senior executive support is essential. The chief privacy officer, as well as other key business leaders—the chief finance officer, the chief risk officer and chief information officer—will all need to actively participate to ensure their data requirements are addressed.

Leading companies in industries such as technology, finance, and B2B are implementing EDM programs. For privacy professionals, the new emerging data management program should be incorporated into the privacy program and leveraged in the following ways:

   1. Use the corporate EDM resources in the privacy program.
   2. Participate in the data governance program.
   3. Partner with the EDM leaders (chief data officer) to champion business data as a company asset. Lead by example in the privacy organization.

 Use the corporate EDM resources in a privacy program

An enterprise data management program offers corporate resources that can be used to implement an effective privacy program:

Enterprise Metadata Repository: the enterprise metadata repository is a corporate database that contains important business and technical information about the company’s data. The repository is maintained by the IT organization but owned by the EDM leader. For the privacy program, the enterprise metadata repository would be used to log all the databases where sensitive data is stored. The privacy organization can also request other important information, such as the business and technical owner and users of the database, to be logged in the repository in support of the privacy requirements.

Critical Data Element Identification: An EDM program typically starts by identifying the most critical business data to manage. The information is gathered by surveying key stakeholders from across the company. The stakeholders identify the data elements that most materially affect the results of the company’s financial, regulatory, and business processes and reporting. Sensitive data fits within the regulatory criteria and therefore is added to the critical data element list. The critical data element identification step also identifies the various business processes that depend on the same data. This is valuable information for the privacy program. The EDM program ensures information about the critical data element is kept in the enterprise metadata repository, and controls for adding, updating, and deleting the critical data list are in place.

Business Data Stewards: Business data stewards are new roles in the enterprise data management program. Stewards are business leaders within the business functions who are responsible for driving the implementation of the enterprise data management program. They “steward” the data created in their business process to ensure that it meets all company needs. The business data stewards for customer and employee data, which typically resides in the sales and human resource functions, should be leveraged in the privacy program. The business data stewards partner with privacy professionals to ensure the privacy requirements are implemented in their data.

Data Profiling Tools: New tools exist that allow databases to be searched and better understood. In the privacy program, often times the location of all the stored NPI data across the company is not known. Data profiling tools can be used to investigate databases for sensitive data. Technical skills are required to run the tools, therefore the IT organization will also need to be involved.

Processes/ Training for Creating, Updating, and Deleting Data: An Enterprise Data Management program will review the existing processes for creating, updating, and deleting (CRUD) the critical data. These processes will be enhanced to ensure data requirements and quality controls are in place. Training will be enhanced to ensure employees understand the new procedures. The privacy programs should leverage the new CRUD processes and training to incorporate privacy policy controls.

Privacy professional’s role in the enterprise data governance program

A governance program is necessary to coordinate and manage the various cross-division and cross-process data requirements. The data governance forum(s) is chaired by the EDM lead, the chief data officer, or another appointed executive in the company. The chief marketing officer or chief finance officer may play this role because these leaders understand the need for high-quality, well-managed data. Executive representatives from across the business, operations, technology, compliance, and finance functions participate. The chief privacy officer, or his or her representative, ensures the privacy requirements are communicated, understood, and prioritized. Specifically, the privacy organization will participate in the following governance activities:

Critical data identification process: The privacy organization identifies the sensitive data elements in the critical data element identification process and the appropriate business and technical information to be collected and stored.

Identifying legal requirements: The privacy professional communicates all privacy state, federal, and country privacy legal requirements to be implemented in the data controls and training.

Data initiative prioritization: The chief privacy officer participates in the executive decision-making process to prioritize and fund corporate data initiatives and ensure the initiatives comply with privacy program requirements and implementation timelines.

Data performance metrics: The chief privacy officer participates in setting the performance metrics on key data initiatives and participates in the periodic reviews of performance metrics.

Data archiving, standards, and controls: The privacy organization reviews and approves the corporate processes for data archiving and data controls to ensure compliance with the privacy requirements. The privacy organization would also incorporate privacy requirements for collecting, updating, and deleting sensitive information in new data standards developed as part of the EDM program.

 The chief privacy officer and the chief data officer

Both the chief privacy officer and the chief data officer (CDO) share a common goal: safeguarding and stewarding the company’s critical data. While the CDO’s data scope includes all the critical company data, the chief privacy officer’s role is growing to include more data.

In companies where an enterprise data management program is not yet in place, the privacy organization may be the first to implement data management capabilities such as data standards, data tools, and data processes for managing sensitive data. These capabilities then can be re-used to manage other company data once an EDM program is implemented. In fact, the chief privacy officer can sell the need for an enterprise data management program to other C executives in the company because of his or her unique perspective into the growing need to manage an ever-increasing set of data.

The chief privacy officer’s involvement provides much-needed executive sponsorship for the overall data program, and he or she can influence business peers to participate actively in the program. The privacy organization can also lead by example in implementing the EDM standards within their team. The privacy organization can also re-enforce the enterprise data management program and standards in the privacy specific training and controls.

The emerging enterprise data management trend provides the privacy professional and the chief privacy officer an opportunity to champion data as a “business asset” and simultaneously increase the effectiveness of their privacy programs. As the role continues to evolve, the chief privacy officer may even be in the best position to be the chief data officer.

 
Maria Villar is a recognized expert in enterprise data management and data governance with more than 25 years professional experience. She has held senior executive positions in the technology and financial sectors, where she was responsible for data quality, governance, architecture, and database technology solutions. She is the co-author of the book: Managing Your Business Data: From Chaos to Confidence. She can be reached at mariacvillar@yahoo.com.