A managing director at a 15-person professional services firm receives a subject access request from a former client. Under UK GDPR, she has 30 days to respond. The problem: no one in the business knows exactly what data they hold on that person, which systems it lives in, or who is responsible for locating it. Nothing malicious has happened. There are simply no agreed rules about where client data sits or who looks after it.
That gap is what data governance exists to close. And for a small team, closing it does not require an enterprise framework.
What is right-sized data governance?
Data governance is the set of decisions a business makes about what data it collects, who can access it, how long it keeps it, and who is accountable when something goes wrong. For a small services firm, right-sized governance means applying those decisions to a small number of critical data sets rather than attempting to cover everything at once.
The standard guidance for businesses at this scale is to start with three to five “crown jewel” data sets: customer records, employee data, financial information, and supplier details. These carry the highest legal obligations and the most risk if they are lost, leaked, or misused. Everything else can follow once the foundation is in place.
The UK government’s National Data Strategy describes a deliberately proportionate approach. It aims for a regime that is pro-growth, not one that loads administrative burden on firms without the resources to carry it. The ICO’s guidance for small organisations echoes this: every business must map its personal data, define retention periods, and control access, but a 15-person consultancy is not expected to operate like a regulated bank.
Why does data governance matter for your business?
The 2024 NCSC Cyber Security Breaches Survey found 50% of UK businesses experienced a breach or attack in the past year. For small firms, incidents that escalate rarely trace to sophisticated external attacks. They more often start with gaps in the basics: who has access to which systems, where data sits, and whether the business would notice if something went wrong.
The regulatory consequences of those gaps are documented. In 2020, the ICO fined a small London pharmacy £275,000 for storing around 500,000 medical documents in unlocked containers without adequate organisational controls. The enforcement was not about a technical failure. It was about an absence of process. The firm had no documented approach to how sensitive data should be stored, protected, or destroyed, and that absence was what the ICO cited.
For businesses regulated by the FCA, the standard is higher. Financial advisers, insurance brokers, and others under FCA supervision must demonstrate effective governance and oversight of data used in regulated activities, including data held in cloud systems and AI tools. The FCA has been explicit: boards remain accountable for data quality and model governance even when third-party technology is doing the processing.
There is a productivity case here too. When your data is accurate, well-classified, and covered by clear retention rules, your client reporting is faster, your records are cleaner, and any AI tools you deploy produce better outputs. Governance pays forward.
Where will you actually meet data governance in practice?
Data governance tends to show up in the day-to-day operational moments rather than as a discrete project. A new employee joins and needs CRM access. A client asks to be removed from your mailing list. Someone’s Microsoft 365 account needs revoking when they leave. Your accountant asks how long you should keep client financial records. These are the moments when having clear answers matters.
The practical point is that governance lives inside the tools you already use. Microsoft 365’s sensitivity labels and Purview retention policies can classify and restrict documents without custom infrastructure. Your CRM has role-based access controls that may not yet be configured. Your cloud accounting tool has an audit trail. Using what you already pay for is the right first step.
UK services firms commonly over-collect and under-delete, keeping records indefinitely because it feels safer. UK GDPR’s storage limitation principle says otherwise: personal data should be kept only as long as necessary and then securely deleted or anonymised. Automating retention rules in M365 or your records management system removes the manual policing, reduces your legal exposure, and cuts the volume of data you need to protect in the event of a breach.
When is a lighter approach enough, and when is it not?
For a 5-50 person services firm with no regulatory licence and no AI deployments processing sensitive personal data, four short policies and a named data steward in each business area cover the ground the ICO requires. A data classification policy, an access and acceptable use policy, a retention schedule, and a brief incident response plan are the foundation.
The lighter approach has clear limits. FCA-regulated firms face more prescriptive expectations around operational resilience, oversight of cloud providers, and documented governance for data used in regulated activities. A framework designed for a small management consultancy will not meet that standard without additional controls.
The EU AI Act introduces a second trigger worth knowing. If your business develops or deploys high-risk AI systems, credit scoring, HR screening, and clinical decision support are examples that fall into scope, the Act requires documented governance over training and validation data even if your processing happens in the UK. For firms whose AI use is limited to a CRM assistant or a document summariser, this does not apply. But if AI is central to your product or your advice, it is worth checking early rather than late.
The practical question to ask is: does your sector, your AI ambitions, or your current scale push you into a category that needs more than the four-policy framework? If none of those apply, the lighter approach is sufficient. Start there and build as those things change.
What else connects to data governance?
Data governance sits at the intersection of three related disciplines: data quality, data retention, and AI governance. You cannot assess data quality without knowing who owns each data set and who is accountable for keeping it accurate. You cannot apply meaningful retention rules without knowing what you hold and where. You cannot govern how your AI tools use data without first governing the data itself.
The benefit of treating these as one body of work is that progress compounds. When you classify your customer data and assign a data steward, you have also laid the groundwork for a retention schedule, for defining which AI tools can access that data, and for answering a subject access request in a day rather than a month. The governance overhead does not multiply as you add each layer. It stacks.
For businesses thinking about AI adoption, the ICO’s guidance on profiling and automated decision-making assumes a firm already knows what data it holds and how accurate it is. Data governance and AI readiness draw on the same foundations, started at different points. The firms that find AI adoption straightforward are usually the ones that have already done this work.
