Data analytics governance, within the ISACA CDPSE Data Lifecycle framework, is the discipline of governing what analytical operations can be performed on personal data — by whom, for what declared purposes, and with what privacy controls in place. It is not about statistical methods or data science techniques; it is about the compliance and governance boundaries that determine whether a given analytics activity is lawful, purpose-consistent, and privacy-respecting. Analytics, in this context, means any process that derives insights, patterns, predictions, or decisions from personal data — from simple aggregation and reporting through machine learning and automated decision-making.
Where it stops · what it isn't
- —IS: Governing analytics activities — determining permissibility, scope, and required controls for analytics on personal data
- —IS: Constraining analytics operations to the original stated data purpose and applicable legal basis
- —IS: Implementing privacy-by-design controls (anonymization, pseudonymization, aggregation thresholds, access controls) before analytics execute
- —IS: Managing data subject rights (access, deletion, portability, automated-decision contestation) where they intersect with analytics workflows
- —IS NOT: Teaching statistical methods, machine learning algorithms, or data science tooling
- —IS NOT: A general business intelligence or data quality framework divorced from privacy obligations
- —IS NOT: Synonymous with data governance broadly — it is specifically the privacy-focused governance of analytics activities within an established data lifecycle
- —Common misconception: Anonymized data is NOT automatically exempt from privacy obligations — re-identification risk and evolving regulatory interpretation increasingly apply privacy requirements to pseudonymous and analytically derived outputs
Connected concepts in the graph
Every cubelet sits in a knowledge graph. Here's what this one connects to.
PART OFData Lifecycle (CDPSE Domain 3: Data Lifecycle Management)Data Purpose (CDPSE Knowledge Area: Purpose Limitation and Data Use)
REQUIRESData Minimization (GDPR Article 5(1)(c); CDPSE prerequisite competency)Data Classification and Inventory (prerequisite: knowing what data exists and its sensitivity level)
ENABLESPrivacy Impact Assessment / DPIA (analytics governance feeds into formal risk assessments)Data Subject Rights Management (analytics systems must support SAR, erasure, and portability)
RELATED TOData Security Controls (parallel control layer over the same data assets)Data Retention and Disposal (co-governance of data across the full lifecycle)
CONSTRAINSAI and Automated Decision-Making Systems (analytics governance sets boundaries for model training and deployment)