Setting up a data governance council for a CPG organisation

Why CPG needs this more than other sectors

FMCG companies sit on unusually messy data terrain. A single beverage company might combine:

• Shopper data from retailer loyalty programs (who buys what, when, at what price)
• Trade spend data (promotional budgets negotiated per retailer, often confidential)
• Point-of-sale (POS) data streaming from thousands of stores
• First-party dataFirst-party dataData collected directly from your own customers and prospects through your own channels: your most reliable and privacy-compliant source.View full definition → from apps, loyalty schemes or connected packaging

Each dataset touches a different function: brand marketing, sales, finance, IT. None of them "owns" data end to end. Without a council, access requests default to whoever is loudest or most senior, which creates both delay and risk (the wrong person seeing trade terms meant for one retailer only, for instance).

What a data governancedata governanceData governance is the set of policies, roles, and processes that ensure data is accurate, secure, well-defined, and used responsibly across an organization.View full definition → council actually is

A data governancedata governanceData governance is the set of policies, roles, and processes that ensure data is accurate, secure, well-defined, and used responsibly across an organization.View full definition → council is a standing cross-functional group that makes decisions on data ownership, access rights, quality standards and compliance, so individual employees don't need to negotiate these case by case.

It is not a technical team. It is a decision-making body, typically meeting monthly, with authority delegated by senior leadership (often reporting to a Chief Data Officer, or CDO, or in smaller companies, the CIO).

Core seats at the table

| Role | What they protect |

|---|---|

| Brand/Marketing lead | Shopper insight quality, campaign data use |

| Sales/Commercial lead | Trade spend confidentiality, retailer terms |

| IT/Data engineering lead | System architecture, data pipelines, security |

| Legal/Privacy officer | Regulatory compliance (GDPR, CCPA, etc.) |

| Finance representative | Cost allocation, audit trail for spend data |

| Data stewardData stewardA business-side owner responsible for the quality, consistency and appropriate use of data in their domain.View full definition →(s) | Day-to-day data qualitydata qualityThe degree to which data is fit for purpose: accurate, complete, consistent, timely, valid and unique. Poor quality data undermines analytics, reporting and AI.View full definition → for specific domains |

A data stewarddata stewardA business-side owner responsible for the quality, consistency and appropriate use of data in their domain.View full definition → is the person accountable for the quality and correct use of a specific dataset (say, "EU shopper loyalty data") on a daily basis. The council sets policy; stewards execute it.

The regulatory backdrop that forces this structure

This isn't optional bureaucracy. Real regulation makes clear accountability necessary.

In Europe, the GDPR (General Data Protection Regulation) requires companies to demonstrate who is responsible for personal data processing, and to name a Data Protection Officer (DPO) if processing is large-scale. Shopper loyalty data (linked to an identifiable person) qualifies. Fines can reachreachThe number of unique people exposed to your message in a given period. Unlike impressions, reach counts each person once, no matter how often they see it.View full definition → €20 million or 4% of global annual turnover, whichever is higher.

In the US, there is no single federal privacy law, but state laws like the California Consumer Privacy Act (CCPA, updated by the CPRA) require companies to honor consumer requests to know, delete or opt out of data sales, enforced by the California Privacy Protection Agency. A council with clear ownership is how a company actually finds all the places a consumer's data lives, fast enough to respond within legal deadlines (typically 45 days under CCPA).

Retail media and trade spend data raise a different issue: antitrust and competitive sensitivity. If a beverage company's sales team can see one retailer's exact trade terms while negotiating with a competing retailer, that is a governance and legal exposure, not just an IT permissions setting.

How the council actually makes decisions

The council's real output is a small number of durable artifacts, not meeting minutes.

1. A data ownership map: which function owns which dataset, updated annually.

2. An access tiering policy: who can see raw shopper-level data versus aggregated reports. Most companies use three tiers: public/aggregated, internal/role-restricted, confidential/named-access-only.

3. A change log: every time a new access request breaks the existing pattern, it gets logged and reviewed quarterly, so the policy evolves instead of accumulating exceptions nobody remembers approving.

A simplified access policy might look like this in practice:

This isn't code that runs anywhere. It is a governance artifact: a readable record the council can audit, that IT then implements as actual system permissions.

Practical checks the council should run

A council that only meets and talks is theater. It needs recurring, concrete checks:

• Data lineage checks: can you trace a number in a dashboard back to its source system? If a regional manager sees "market sharemarket shareThe percentage of total industry sales your company captures in a given period. It measures competitive position relative to rivals in a defined market.View full definition → up 3%," someone should be able to show which POS feed generated it.
• Access audits: quarterly review of who actually has access to sensitive datasets, removing former employees or role changes (a common failure point: someone moves from sales to brand and keeps trade spend access for a year).
• Data quality spot checks: sampling shopper records for duplicates, missing consent flags, or stale entries. A rule of thumb used by several CPG data teams: if more than 2 to 3% of a customer record set fails basic validation (missing consent timestamp, invalid email format), that dataset is not fit for a targeted campaign yet. This threshold is an internal quality benchmark many teams use, not a legal one.
• Consent audits: confirming marketing data actually has a valid legal basis under GDPR (consent, legitimate interest, or contract) attached to it, not just historically collected data being reused for a new purpose.

Building the council: a realistic sequence

Most CPG companies don't build this in one leap. A workable rollout looks like:

1. Executive sponsor named (usually CDO, CIO, or Chief Marketing Officer) with authority to break ties.

2. Inventory existing datasets and informally note who currently "acts like" the owner.

3. First council meeting: agree on the three or four highest-risk datasets (usually shopper data and trade spend) and set access tiers for those only. Don't try to govern everything at once.

9

4. Publish the ownership map internally so employees stop emailing five people to find an answer.

5. Quarterly cadence for audits and exception review, described above.

A council that tries to govern all data on day one usually stalls. Starting with the two or three datasets that create the most legal or competitive risk (shopper personal data, trade spend, and often supplier cost data) gets early wins that build trust for expanding scope later.

For a fuller regulatory reference, the ICO's guide to data protection (UK Information Commissioner's Office) is a free, practical resource that translates GDPR-style obligations into operational checklists many multinational CPG teams reuse even outside the UK.

Key Takeaways

• A data governancedata governanceData governance is the set of policies, roles, and processes that ensure data is accurate, secure, well-defined, and used responsibly across an organization.View full definition → council is a cross-functional decision body (brand, sales, IT, legal, finance) that resolves data ownership and access questions before they become email bottlenecks or compliance failures.
• Real regulation (GDPR in Europe, CCPA/CPRA in the US) requires demonstrable accountability for personal data, which is exactly what a council with named data stewards provides.
• Trade spend and shopper data are the highest-risk datasets in CPG because they combine competitive sensitivity (retailer terms) with personal data obligations (loyalty programs).
• Effective councils produce concrete artifacts: an ownership mapmapUsing software to automate repetitive marketing tasks and campaigns, enabling personalisation at scale across channels like email, web, and social.View full definition →, tiered access policies, and a change log, reviewed quarterly, not just meeting notes.
• Start small: govern the two or three highest-risk datasets first, then expand scope once the process proves it can move faster than the old ad hoc approval chain.