Data Governance in Banks: Ownership, Quality and Stewardship (CAIIB ITDB)

Data governance in banks decides who owns customer data, who fixes it when it breaks, and who answers to the regulator when something goes wrong. For CAIIB ITDB candidates, this is a high-yield topic. Exams test four ideas here: ownership versus stewardship, golden source and master data management, the six data quality dimensions, and how the DPDP Act changes the picture. This article walks through each idea in plain, exam-ready language. You will also get five practice MCQs and four FAQs to lock in the concepts before your test.

🏛️ What Is Data Governance in Banks

Data governance in banks is the system of rules, roles and decision rights that controls how data is created, stored, used and retired. It is not a database. It is not a report. It is the framework that makes sure the numbers in that report can be trusted.

Banks hold data on deposits, loans, KYC, credit scores and transactions. Bad data governance means the same customer shows two different addresses in two systems. Good data governance means one address, one source, one truth. This matters for regulatory reporting, credit decisions and customer service alike.

The building blocks link back to core IT concepts you studied earlier in this paper. Understanding Information Technology and its Implications helps you see why data has become a board-level risk, not just an IT concern. The basics from Essentials of Information Technology explain how data moves between systems in the first place.

💡 Exam Tip: If a question asks "who is accountable for data quality," the answer is usually the business data owner, not the IT department.

A bank with weak data governance struggles at audit time. Regulators ask for a single, reconciled number. If three departments give three different figures, the bank has a governance gap, not just a technology gap. That is the core exam angle: governance is a people-and-process problem, and technology only supports it.

👥 Data Ownership and Stewardship Roles

Banks split data responsibility across four layers. Each layer has a different job, and exams love to test the difference between them.

The data owner is usually a senior business manager. This person decides who can access the data and sets the quality rules for that data domain. The data steward is the operational role. Stewards monitor quality day to day, chase down errors, and escalate issues to the owner. The data custodian sits in IT. Custodians manage the physical storage, backups and security controls, but they do not decide business rules. Above all three sits the board, which owns overall accountability for the bank's data risk.

Notice that only the board approves the policy. Every other role executes it. This distinction shows up often in CAIIB ITDB papers, so memorise it as a chain, not a list.

The Database Management Systems chapter gives you the technical side of custodianship: indexing, backup and access control at the database level. Pair that with the governance roles above, and you cover both the "what" and the "who."

🎯 Golden Source, MDM and the Six Data Quality Dimensions

A golden source is the single system a bank trusts as the origin of truth for a given data element. If the core banking solution is the golden source for a customer's account balance, no other report is allowed to override it. This idea sits at the heart of core banking solution architecture, since most golden-source data actually lives inside the CBS.

Master Data Management (MDM) is the discipline of keeping one clean, consistent version of core entities like customer, account and product across every downstream system. MDM tools pull data from the golden source and push a single version out to reporting, risk and marketing systems.

Quality is judged against six dimensions that examiners expect you to name and explain:

• Accuracy — does the value match reality?
• Completeness — are required fields filled in?
• Consistency — does the same fact match across systems?
• Timeliness — is the data current enough to use?
• Validity — does the value follow the expected format or rule?
• Uniqueness — is each real-world entity recorded only once?

⚠️ Common Mistake: Do not confuse data governance with risk data aggregation under BCBS 239. Governance is about ownership, quality and stewardship. BCBS 239 is a separate framework about how fast and how accurately a bank can aggregate risk data for reporting. Read more in our piece on risk data aggregation and reporting, which sits under a different CAIIB paper.

🔍 Metadata, Lineage and the DPDP Act Interface

Metadata is data about data. It tells you a field's name, its source, its format and who owns it. Without metadata, nobody can trust or trace a number in a report. A well-run data governance in banks program keeps a metadata catalogue that any auditor or analyst can search.

Data lineage goes one step further. It maps the journey of a data element from its origin system, through every transformation, to its final report. If a regulator questions a number, lineage lets the bank show exactly where it came from and what happened to it along the way. This is essential when a core banking upgrade or a new interface changes how a field is calculated.

The Digital Personal Data Protection (DPDP) Act adds another layer. Banks process large volumes of personal data, so they must apply purpose limitation, consent tracking and data minimisation on top of their existing governance structure. A bank's data owner and steward roles now also need to answer DPDP-style questions: why is this data collected, how long is it retained, and who has legitimate access? Networking and system design choices, covered under Networking Systems, also affect how securely that personal data moves between branches and data centres.

Good metadata and lineage practice makes DPDP compliance easier. If you already know where a customer's data lives and who touches it, proving compliance is a documentation exercise, not a forensic hunt.

📋 Board-Approved Data Policy and Governance Structure

Every well-governed bank has a single board-approved data policy. This document names the data owners for each domain, sets the quality standards, and defines escalation paths when stewards find a problem. It also states how the bank treats metadata, lineage and retention, tying the whole framework together.

Below the board, most banks now run a data governance council or committee, often chaired by a Chief Data Officer. This council turns board-level policy into working standards: naming conventions, data quality thresholds, and access request procedures. It reports upward on quality metrics and downward on newly approved rules.

📌 Remember: The board approves the policy. The council designs the standards. The steward enforces them daily. Keep this order straight for scenario-based questions.

Data governance also intersects with cyber and access control practices. A policy that names data owners but ignores network security in banking IT infrastructure leaves a gap: well-labelled data that anyone can still access insecurely. The two disciplines have to work together, even though they are tested as separate exam topics.

As banks adopt more automated tools, including generative models for customer service and analytics, the same ownership rules still apply. Our article on generative AI in banking explains how these newer tools plug into an existing governance structure rather than replacing it.

For the full topic map of this elective subject, browse the Information Technology and Digital Banking tag hub on iibf.store.

🧠 Practice MCQs: Data Governance in Banks

Want chapter-wise mock tests with 100+ MCQs? Start practising free →

❓ Frequently Asked Questions

✅ Build Your CAIIB ITDB Score with Structured Practice

Data governance in banks is a compact but scoring-heavy topic. Master the four pillars — ownership and stewardship, golden source and MDM, the six quality dimensions, and metadata with DPDP overlap — and you can answer most variations examiners throw at you.

Reinforce this chapter with full-length practice inside the CAIIB course on iibf.store, and revisit the MCQs above until you can explain each answer without looking. For the RBI's broader technology-risk expectations that frame this whole subject, see the RBI Master Directions on IT governance and risk published on rbi.org.in.