Data protection law addresses one dimension of quality — accuracy — and makes it enforceable. Data governance addresses the rest, and the two meet more often than either discipline expects.
The dimensions worth measuring
Quality is not a single property. The dimensions that carry real consequences:
| Dimension | The question | Typical failure |
|---|---|---|
| Accuracy | Does it reflect reality? | A wrong title, a stale address, an inference recorded as fact |
| Completeness | Are required values present? | Nulls that force downstream guessing |
| Consistency | Do copies agree? | Three systems, three versions of the same customer |
| Timeliness | Is it current enough for the use? | Yesterday’s balance in a real-time decision |
| Validity | Does it conform to its own rules? | Dates in the future, invalid country codes |
| Uniqueness | One record per real thing? | Duplicate customers, split histories |
Accuracy and timeliness are the two with direct legal weight, because personal dataPersonal dataAny information relating to an identified or identifiable person: names, IDs, location, online identifiers, and combinations that single someone out. must be accurate and, where necessary, kept up to date. The others become legal problems indirectly and reliably.
How quality failures become rights failures
This is the connection the two disciplines usually miss.
Duplication defeats access and erasure. If a person exists three times across two systems, a subject access response will be incomplete and a deletion will be partial. Both are infringements, and neither was a data protection failure in origin — they were a uniqueness failure.
Inconsistency defeats rectification. Correcting the record in the system of record while two downstream copies keep the old value does not discharge the obligation, and the person will encounter the wrong version again.
Inference recorded as fact is an accuracy problem with legal teeth. “Customer was abusive” recorded as an event is a claim about reality. Recorded as “agent noted”, with a date and source, it is an opinion — a materially different thing, and much harder to challenge as inaccurate.
Poor lineage defeats everything. If you cannot say where a value came from, you cannot correct it at source, so it returns on the next refresh.
Where to intervene
Quality is cheapest to fix at collection and most expensive to fix in reports.
- Validate at entry. Constraints at the point of capture prevent more defects than any downstream cleanse.
- Fix at source, not in the copy. A correction applied to a warehouse table is overwritten on the next load, which is why the same complaint recurs.
- Resolve identity deliberately. Decide how you determine that two records are the same person, and record the rule. Ad-hoc matching creates both duplicates and false merges, and a false merge is a serious accuracy failure — it attributes one person’s data to another.
- Measure and publish. A quality metric nobody sees does not change behaviour. Sample, report, and route defects to a named owner.
Ownership is the mechanism
The recurring pattern in organisations with poor data quality is not a lack of tooling — it is that no one is accountable for any given dataset. Every practical governance model converges on the same roles, whatever they are called: someone accountable for a domain, someone responsible for its day-to-day correctness, and someone operating the system it lives in.
The useful test is whether you can name, for any dataset, who decides what “correct” means for it. If you cannot, quality initiatives will produce reports rather than improvements.
The overlap with accountability
Under the accountability principle you must be able to demonstrate compliance, and accuracy is one of the things to demonstrate. That means quality measurement is not purely an operational nicety — it is part of the evidence base. An organisation that can show it measures accuracy, detects drift and routes corrections to owners is in a materially stronger position than one asserting its data is fine.
Related: records of processing, which is where you find out which datasets exist at all, and rectification in practice, which is what happens when quality fails in public.