Think of a bank’s common data platform as having three governance layers:
1. Policies & Principles (Top-Level Governance)
These are bank-wide rules set by the Chief Data Office (CDO), Risk, Compliance, and IT Security:
- BCBS 239 principles (for risk data aggregation & reporting)
- GDPR/Privacy policies (handling of PII, legal basis for processing)
- Data Management Policies (ownership, classification, retention)
- Security & Access Policies (least privilege, encryption, logging)
These policies define what must be true for all data, regardless of source or consumer.
2. Frameworks & Standards (Operational Governance)
This is where standards and tools live, enforced by Data Governance, IT, and the Platform team:
- Data Catalog: Register datasets, ownership, definitions, and DDAs.
- Metadata & Lineage Standards: Every dataset must have traceability (source → transformations → target).
- Data Quality Controls: Automated checks (completeness, accuracy, timeliness).
- Access Control Models: Role-based, risk-based, with approvals and audit logs.
- Reference & Master Data Management (MDM): “Single source of truth” for Customer, Account, Product.
This ensures consistency and reusability of data across the bank.
3. Execution Level (Agreements & Deliveries)
This is where the DDA sits.
- For each dataset provided (e.g., Customer Master, Daily Transactions, Credit Exposures), there’s a DDA that:
- Makes the policies concrete (e.g., GDPR → PII masking rule in delivery).
- Makes the standards operational (e.g., “Data must be registered in catalog with lineage”).
- Ensures clear accountability (provider vs. consumer responsibilities).
- The DDA is stored in the data catalog or data contract management tool, tied to the dataset entry.
The DDA is essentially the contract at the execution layer that ensures policies and standards are followed in practice.
How the pieces connect
- Policies: say “All customer data must be protected according to GDPR and only used for legitimate purposes.”
- Standards: say “All datasets must be classified, have lineage, and use Parquet format in the lake.”
- DDA: says “The Customer Master feed will be delivered daily at 7 AM in Parquet format, PII fields masked for Marketing, and registered in the catalog with steward John Doe.”
Example Mapping to BCBS 239 (Risk Regulation)
- Accuracy & Integrity → DDA defines quality checks, provider responsibility.
- Completeness → DDA defines all relevant data fields, mandatory coverage.
- Timeliness → DDA defines delivery deadlines (T+1, intraday).
- Adaptability → DDA defines change management, schema evolution.
- Governance → DDA identifies owner, steward, escalation.
So in audits, the DDA is evidence that the bank complies with BCBS 239 and other regulations.
In summary:
- Policies = rules from regulators & the bank (top-down).
- Standards = how the bank enforces them across the platform.
- DDAs = dataset-level agreements that make it real, binding provider & consumer.