Data Governance Consulting: Owners, Definitions and Rules a Mid-Sized Company Can Keep

Data governance consulting helps a company decide who owns each important data set, what its key terms mean, who may see and change it, how long it is kept and how sensitive it is, and then puts those decisions into the tools you already use. For most Microsoft 365 companies that means Microsoft Purview and Power BI settings.

Lightray Solutions keeps it proportionate. A 40-person firm needs a one-page register and a handful of settings, not an enterprise program, and Edward Pinela, MBA, does the work himself. Lightray does not give legal advice; retention periods and privacy obligations come from your attorney or accountant, and we implement them.

The first step is a free 30-minute strategy call with Edward; ask through the form or by phone and he schedules it personally. A governance engagement is quoted at a fixed price after a short review of your Microsoft 365 tenant and reporting.

What does data governance mean for a company of 20 to 300 people?

Five decisions, written down and enforced: an owner for each important data set, one definition for each key business term, access by role, a retention period for each kind of record, and a sensitivity level that controls how it may be shared. Data quality follows from those, because someone is now responsible for fixing errors.

Large companies wrap this in committees and frameworks. A smaller one gets most of the value from a register that fits on one page and a few settings in Microsoft 365 and Power BI. The table shows each area, the question it answers and the Microsoft feature that can enforce it.

Who should own each data set?

The manager whose team creates the data and suffers when it is wrong: finance for the general ledger, sales for the customer list, operations for inventory. The owner approves access and definitions; a steward, often an analyst or office manager, does the day-to-day clean-up. Neither role needs to be a full-time job.

Microsoft's Purview Unified Catalog formalizes this with governance domains, glossary terms and named owners and stewards, and it suits companies with many data sources. Most smaller firms start with a spreadsheet register listing each data set, its system, its owner and its steward, and move to the catalog only when the list outgrows a page.

How do you get one definition of revenue, customer and active client?

By agreeing each definition once with the owner, writing it in a short glossary, and building it into a single shared Power BI semantic model that every report uses. When the calculation lives in one model rather than in twenty spreadsheets, two managers can no longer bring two different revenue figures to the same meeting.

Power BI and Fabric then help people find the trusted version. Endorsement lets a creator mark an item as Promoted, lets reviewers chosen by your administrator apply a higher badge, and marks core sources such as the customer list as Master data. The technical setup of workspaces and endorsement is covered on self-service BI implementation.

How should retention and deletion be set up in Microsoft 365?

With Microsoft Purview retention policies for whole locations and retention labels for records that need their own period. Microsoft's retention guidance explains the difference: a policy applies to everything in a mailbox or SharePoint site, while a label applies to an individual document and travels with it when it moves.

Two rules Microsoft documents settle most conflicts: retention wins over deletion, and the longest retention period wins. That makes a cautious default safe, since a deletion policy cannot destroy a document another rule must keep.

Privacy law is the other side. California's Attorney General summarizes the CCPA as applying to for-profit businesses doing business in California that meet any of its thresholds, including gross annual revenue over $25 million (adjusted for inflation to $26,625,000 from January 1, 2025), and giving consumers rights to know, delete, opt out, correct and limit. Your attorney decides whether it applies; we make sure you can find, and delete, what a request covers.

How do sensitivity labels protect data in Microsoft 365 and Power BI?

A sensitivity label is a tag such as Public, General, Confidential or Highly Confidential, stored in the file's metadata so it stays with the content wherever it goes. A label can add a watermark or header, encrypt the file so only named people can open it, and set sharing rules for whole Teams and SharePoint sites.

Microsoft's sensitivity label documentation also offers a practical warning: effectiveness drops when users face more than five main labels, so we usually start with four. A default label can cover unlabeled documents, and mandatory labeling can require a choice before saving.

In Power BI, labels behave differently. Inside the service a label does not control who sees a report; workspace permissions and row-level security do. The label's protection applies when data leaves Power BI through supported exports to Excel, PowerPoint or PDF, while a .csv export is not protected, so your administrator may block unsupported export paths for confidential models.

How does a data governance engagement run?

In four steps over a few weeks, starting with the data that causes the most trouble rather than everything at once. It is quoted at a fixed price after the review, and every decision is made by your owners; Lightray proposes, documents and configures, and your team keeps running it.

Governance here is about data at rest. Rules for what staff may put into AI tools are a separate, shorter exercise described in AI governance for small business. Governance also underpins the wider business intelligence consulting work, and per-user data restrictions in reports are built through Power BI row-level security. Edward brings 20+ years of business and data work and 200+ delivered projects, and Lightray's Google rating is 4.9.

• 1. Review. Where important data lives, who can open it, existing labels and retention settings, and the reports people argue about.
• 2. Register and glossary. Owners, stewards and agreed definitions for the first data sets, on one page each.
• 3. Configure. Sensitivity labels, retention policies or labels, group-based access and a shared Power BI model with endorsement.
• 4. Handover. A short governance routine: a quarterly access review, a definition change process and a contact for each data set.

Further reading: Microsoft Learn — Learn about sensitivity labels.