ISO/IEC 38505 Series: ISO/IEC 38505 Series – Tutorial (about 60 minutes)

The ISO/IEC 38505 series is the international guidance on the governance of data: how the board, owners or other governing body of an organisation make sure that data is used to create value, that its risks are understood and that legal, social and internal limits are respected. Directors, chief data officers, data governance leads, risk and compliance staff, privacy and security professionals and auditors use it to frame what the top of the organisation must decide about data and what it can delegate. After this tutorial you will be able to explain the three parts of the series, apply the ISO/IEC 38500 governance model to data, walk through the data accountability map, weigh value, risk and constraints for a data set, and place the series next to ISO 37000, ISO/IEC 27001, DAMA-DMBOK and other frameworks.

Free tutorial · about 60 minutes · 7 lessons · 5 diagrams · then a 25-question knowledge check and a certificate.

Course overview

Edition and status: The series is published jointly by ISO and IEC and maintained by joint technical committee ISO/IEC JTC 1, subcommittee SC 40 (IT service management and IT governance). As verified on 2026-10-29 it has three published parts. ISO/IEC 38505-1:2026, Information technology — Governance of data — Part 1: Application of ISO/IEC 38500 to the governance of data, is the second edition, published in August 2026; it cancels and replaces the first edition, ISO/IEC 38505-1:2017, and its stated main change is alignment with ISO/IEC 38500:2024, which is itself aligned with ISO 37000. ISO/IEC TR 38505-2:2018, a Technical Report on the implications of Part 1 for data management, is still listed as current; note that it was written against the 2017 edition of Part 1. ISO/IEC TS 38505-3:2021, a Technical Specification with guidelines for data classification, is also current. No further parts had been published at the time of writing. This tutorial teaches the 2026 edition of Part 1 and points out where the 2017 edition, still widely quoted in books and courses, looked different.

Who it is for: board members and executives who are asked to "own" data, chief data and analytics officers, data governance and data management practitioners, enterprise architects, information security and privacy staff, internal auditors, consultants and engineers who build data platforms and want to understand what governance asks of them.

Prerequisites: none. A general idea of what a board or executive committee does, and of how an organisation collects and uses data, is helpful. Knowing ISO/IEC 38500 helps but is not required; the parts you need are explained here.

Learning objectives. After this tutorial you will be able to:

Explain why data needs governance at board level and how governance of data differs from data management.
Describe the purpose, audience and status of each part of the ISO/IEC 38505 series.
Apply the Engage–Evaluate–Direct–Monitor model and the governance principles of ISO/IEC 38500 to decisions about data.
Use the data accountability map (collect, store, report, decide, distribute, dispose) to locate where value and risk arise.
Weigh the data-specific aspects of value, risk and constraints and turn them into board-level policies and measures.
Explain how an organisation can assess its governance of data, and why there is no certificate for the series itself.
Relate the series to ISO 37000, ISO/IEC 38500, ISO/IEC 27001, ISO/IEC 42001, DAMA-DMBOK and similar frameworks.

Lesson 1 – Origins, purpose and scope

Why data needs governing, not only managing

Every organisation runs on data. A retailer knows what its customers buy, a hospital holds patient histories, a utility reads millions of meters, and a city records who pays which tax. In the last two decades cloud platforms, connected devices, large-scale analytics and artificial intelligence have made data cheaper to collect and easier to combine. That brings two kinds of pressure at once. On one side, data has become a source of new products, better decisions and efficiency, so leaders are expected to exploit it. On the other side, data can be leaked, misused, sold without consent, kept far too long or fed into models that treat people unfairly, and regulators, customers and the public hold the organisation's leadership responsible when that happens.

Most organisations already have people who manage data: database administrators, data engineers, analysts, records managers and security teams. What is often missing is a clear answer at the top to questions such as: Which data matters most to our purpose? How much risk are we willing to take with it? Which uses are off limits even if they are legal? Who is accountable when something goes wrong? Those are governance questions. They cannot be answered by a tool or a technical team alone, because they involve strategy, ethics and the expectations of stakeholders. The ISO/IEC 38505 series was written to help governing bodies ask and answer them.

Governance versus management

The distinction between governance and management runs through the whole series. Governance is the system by which an organisation is directed and overseen: the governing body sets purpose and direction, holds management to account and checks that the organisation behaves as intended. Management is the day-to-day work of planning, building, running and improving things within that direction. For data this means the governing body does not design schemas, choose a database or write a retention script. It decides what the organisation wants from its data, what it must never do, which risks are acceptable, and how it will know whether its intentions are being met. Management then turns those decisions into processes, controls, platforms and roles. Part 1 states plainly that it is concerned with evaluating, directing and monitoring the use of data, not with the mechanics of storing or retrieving it.

A useful test is to ask who would have to explain a decision to a regulator, a court or the public. If the answer is "the board" or "the chief executive", the decision is a governance decision and belongs in the scope of this series. If the answer is "the platform team", it is a management decision that should still be consistent with what the board has directed.

A short history

The series builds on ISO/IEC 38500, the international standard for the governance of information technology. ISO/IEC 38500 first appeared in 2008, drawing on an earlier Australian standard, was revised in 2015 and was revised again in 2024. Its central idea is that the governing body should evaluate, direct and monitor the use of IT according to a small set of principles. In the mid-2010s the committee responsible for ISO/IEC 38500 recognised that data deserved its own guidance: data is not the same thing as the technology that holds it, it outlives systems, and its value and risks behave differently. The result was ISO/IEC 38505-1 in 2017, which applied the ISO/IEC 38500 principles and model to data and introduced the data accountability map. A Technical Report, ISO/IEC TR 38505-2, followed in 2018 to explain what Part 1 means for the people who manage data, and a Technical Specification, ISO/IEC TS 38505-3, followed in 2021 with guidance on classifying data.

In 2021 ISO published ISO 37000, guidance on the governance of organisations in general. ISO/IEC 38500 was then rewritten in 2024 to align with ISO 37000, moving from six principles to eleven and adding the three governance outcomes that ISO 37000 describes. The 2026 edition of ISO/IEC 38505-1 follows that change, so that the governance of data now sits in a consistent chain from organisational governance down to data.

Scope of Part 1

Part 1 is addressed mainly to the governing body, which may be a board of directors, owners, partners, trustees, a council or a similar group. It also offers guidance to a wider audience: executive managers, specialist advisers such as lawyers and accountants, internal and external service providers, and auditors. It applies to all kinds of organisations, public or private, commercial or not-for-profit, and to every size, regardless of how much the organisation depends on data. It covers the current and future use of data that is created, collected, stored, secured, protected or controlled by IT systems.

Part 1 positions the governance of data as a domain within the governance of IT, which is in turn a domain within organisational governance (corporate governance, in a company). The 2026 edition also notes something new: its principles can be relevant to the governing bodies of data-sharing networks, platforms and data spaces, but the inter-organisational side of data governance is outside its scope. If your question is "how should a consortium of hospitals govern a shared research data space?", the series gives you useful principles but not a complete answer.

Figure 1 – Governance of data sits inside the governance of IT, which sits inside organisational governance; it directs data management and is informed by evidence from data use.

Figure 1 shows the nesting. Each layer inherits the purpose and values of the layer above it. The governance of data takes direction from organisational and IT governance, gives direction to data management, and receives reports and evidence back so that the governing body can monitor whether its direction is followed. Notice that the arrow back up goes to governance, not to the board's inbox in raw form: good governance depends on management turning activity into information the governing body can actually use.

Lesson 2 – Key concepts and vocabulary

The terms below are explained in our own words. Part 1 has its own clause of terms and definitions, and ISO/IEC 38500 defines the governance terms; consult them when you need the formal wording.

Governing body – the person or group with ultimate authority over and accountability for the organisation, such as a board, owners, partners or a council. It can delegate tasks but not its accountability.
Governance of data – the part of governance concerned with how the organisation uses data: setting direction, deciding acceptable risk and uses, assigning accountability and overseeing results.
Data management – the operational disciplines that carry out that direction: modelling, integration, storage, quality, metadata, security, retention and so on.
Data – facts, figures, text, images or signals that can be recorded, processed and communicated; when interpreted in context, data becomes information that supports decisions.
Stakeholder – anyone who affects or is affected by the organisation's use of data: customers, employees, regulators, shareholders, partners, data subjects and the wider community.
Engage, Evaluate, Direct, Monitor – the four governance tasks in the current model. The governing body engages stakeholders, evaluates the situation and options, directs through strategy and policy, and monitors performance and conformance.
Data accountability map – a simple model in Part 1 that follows data through six activities (collect, store, report, decide, distribute, dispose) so the governing body can see where its oversight is needed.
Data-specific aspects – the three lenses Part 1 adds to the general governance principles: value, risk and constraints.
Value – the benefit data can bring, which depends on characteristics such as its quality, timeliness, context and volume.
Risk – the effect of uncertainty on objectives as it applies to data, including loss, misuse, poor quality, security breaches and unfair outcomes; Part 1 connects it to risk management, classification and security.
Constraints – the limits on what the organisation may or should do with data: laws and regulations, societal expectations and the organisation's own policies.
Data classification – grouping data by characteristics such as sensitivity, criticality or legal status so that consistent handling rules can be applied; Part 3 is devoted to it.
Governance outcomes – the three results that ISO 37000 and ISO/IEC 38500:2024 expect good governance to deliver: effective performance, responsible stewardship and ethical behaviour.
Oversight mechanism – a means by which the governing body keeps watch, for example a data or risk committee, regular reporting, internal audit or independent assurance.

Three outcomes, applied to data

The 2026 edition opens its discussion of good governance of data with the three outcomes. Effective performance means that data actually helps the organisation achieve its purpose: decisions improve, services get better and investments in data pay off. Responsible stewardship means looking after data as an asset held in trust, for the organisation and often for the people it describes, so that it stays accurate, protected and available for as long as it is needed and no longer. Ethical behaviour means using data in ways that are fair, transparent and consistent with the organisation's values, even where the law is silent. The introduction to Part 1 stresses this last point: because regulation often lags behind technologies such as AI, the organisation itself must make sure its use of data is ethical.

Why "acceptable" matters

The series repeatedly speaks of the effective, efficient and acceptable use of data. "Effective" is about achieving objectives, "efficient" is about doing so without waste, and "acceptable" is about whether stakeholders and society would consider the use legitimate. A marketing team may find a way to infer customers' health conditions from their shopping that is both effective and cheap. Whether it is acceptable is a separate question, and it is the governing body's job to make sure somebody asks it.

Lesson 3 – Structure of the series and of Part 1

The three parts

The series has a deliberate division of labour. Part 1 is an International Standard of principles and guidance for governing bodies. It is high-level, principles-based and advisory: it tells the governing body what to pay attention to, not how to build a data platform. Part 2, a Technical Report, looks one level down. It helps the governing body and executive management hold an informed dialogue, so that data use across the organisation follows the strategic direction the board has set. It covers what information the governing body needs to evaluate and direct data strategies and policies, and what measurement systems can do to monitor the performance of data and its uses. Part 3, a Technical Specification, addresses one topic in depth: how governing bodies and managers can use data classification to support the data governance policy, and which factors to weigh when developing and deploying a classification system.

The document types matter. An International Standard has passed the full consensus process. A Technical Report is informative and often collects explanations or practice. A Technical Specification is published when there is agreement on guidance that may later become a full standard. None of the three is a management system standard with requirements for certification.

Inside Part 1 (2026 edition)

Part 1 follows a logical path from "why" to "how to apply it". After the scope, the normative reference (ISO/IEC 38500) and terms, the main clauses are:

Clause 4, Good governance of data – the three outcomes, the benefits of governing data well, the responsibilities of the governing body and the oversight mechanisms it can use.
Clause 5, Principles, model and aspects – a short overview of how the three building blocks fit together.
Clause 6, Data accountability – the data accountability map and its six activities, with one subclause for each activity.
Clause 7, Guidance – Principles – the governance principles of ISO/IEC 38500 applied to data.
Clause 8, Guidance – Model – the governance model, with subclauses for engaging stakeholders, evaluating, directing and monitoring.
Clause 9, Guidance – Data-specific aspects – value (quality, timeliness, context, volume), risk (management, data classification schemes, security) and constraints (regulation and legislation, societal, organisational policy).
Clause 10, Application of the data accountability map – how to bring the activities, principles, model and aspects together.

The 2017 edition followed a similar path from accountability map to principles, model and aspects. The visible differences follow from the alignment with ISO/IEC 38500:2024: clause 4 now opens with the three governance outcomes, clause 7 works with the newer set of principles instead of the six used in 2017, and clause 8 makes engaging stakeholders an explicit task alongside evaluate, direct and monitor.

The governance model

Figure 2 shows the model as a loop. Engage means understanding what stakeholders expect and need from the organisation's data, and communicating with them about it. Evaluate means examining how data is used today and could be used tomorrow, together with the related value, risks and constraints. Direct means giving management clear instructions through a data strategy, policies, priorities, risk appetite and assigned accountability. Monitor means checking, through measures and assurance, whether the direction is being followed and is producing the intended results. What the board learns from monitoring feeds a new round of evaluation and, where expectations have shifted, renewed engagement.

The principles

The 2015 edition of ISO/IEC 38500, and therefore the 2017 edition of Part 1, used six principles: responsibility, strategy, acquisition, performance, conformance and human behaviour. ISO/IEC 38500:2024 adopted the governance principles of ISO 37000 instead, which brings the count to eleven. ISO 37000 calls purpose the primary principle; value generation, strategy, oversight and accountability are foundational; and stakeholder engagement, leadership, data and decisions, risk governance, social responsibility and viability and performance over time are enabling. The 2026 edition of Part 1 is aligned with this set. Read for data, they ask questions such as these (our wording):

Purpose – does our use of data serve the reason the organisation exists?
Value generation – which data creates value, for whom, and how do we know?
Strategy – is there a data strategy that supports the organisational strategy?
Oversight – can the governing body see what is happening to its most important data?
Accountability – is it clear who answers for each data set and each major use?
Stakeholder engagement – do we know what customers, staff, regulators and data subjects expect?
Leadership – do leaders model the data behaviour they ask of others?
Data and decisions – are decisions, including the board's own, based on reliable information?
Risk governance – is data risk within the appetite the board has set?
Social responsibility – are our data practices fair to people and society?
Viability and performance over time – will our data and the trust it depends on still be sound in ten years?

Part 2 was written in 2018 against the 2017 edition of Part 1, so its vocabulary reflects the six earlier principles and the older model. Most of its advice still carries over to the current set, but expect the wording to differ when you read it.

Lesson 4 – How it works in practice

The data accountability map

The distinctive tool of the series is the data accountability map. Its purpose is to stop the governing body from thinking about "data" as one undifferentiated mass. Instead, it follows data through the activities in which value is created and risk arises, so that oversight can be aimed where it matters.

Figure 3 – A simplified data accountability map: six activities in which data gains value and carries risk, each needing governance attention.

Figure 3 is our simplified reading of the map. Collect covers every way data enters the organisation: forms, sensors, transactions, purchases from data brokers, partner feeds and data generated by the organisation's own systems. Store covers holding the data, whether on premises or with a cloud provider, including protection and backup. Report covers turning data into information through queries, analytics, dashboards and models. Decide is where people or automated systems act on that information, and decisions themselves create new data. Distribute covers sharing data or derived results with other parts of the organisation, customers, partners, regulators or the public, and selling or publishing it. Dispose covers archiving, anonymising and destroying data when it is no longer needed or must not be kept.

For each activity the governing body can ask the same three questions from clause 9: What value is at stake? What risks? Which constraints apply? Clause 10 of Part 1 then explains how to bring the activities together with the principles, the model and the aspects. In practice many organisations capture this as a simple grid for each of their most important data sets, with the six activities as rows and value, risk and constraints as columns, as the worked example in Lesson 6 does.

Value, risk and constraints

Figure 4 – The three data-specific aspects of Part 1 and the topics grouped under each.

Figure 4 groups the topics clause 9 covers. Under value, quality asks whether data is accurate and complete enough for its use; timeliness asks whether it is available when the decision is made; context asks whether it is understood, with its origin, meaning and limits documented; and volume asks whether more data truly adds value or only adds cost and risk. Under risk, the organisation is expected to manage data risk within its general risk management (ISO 31000 is a natural partner), to use classification schemes so that handling rules match sensitivity and criticality, and to secure data appropriately. Under constraints, the organisation must respect laws and regulations such as privacy, sector and competition rules, must consider what society regards as acceptable, and must follow its own policies and commitments.

The three aspects pull against each other, and that is the point. More volume may add value but also adds risk. A strict reading of constraints may block a valuable use. The governing body is the place where such trade-offs are made openly and consistently, rather than project by project.

Roles

The series does not prescribe an organisation chart, but a typical arrangement looks like this. The governing body sets direction and remains accountable; it may use a board committee for risk, audit or technology to look at data in more depth. An executive owner, often a chief data officer or chief information officer, is accountable to the board for carrying out the data strategy. Data owners in business units are accountable for particular data sets and their use, while data stewards look after definitions, quality and day-to-day handling. Specialist functions such as information security, privacy (including a data protection officer where the law requires one), records management, legal and architecture provide expertise and controls. Internal audit gives the board independent assurance. Part 2's emphasis on dialogue between the governing body and executive management is the glue between these roles.

Implementation steps

Figure 5 – Direction flows down from the governing body and evidence flows back up, the dialogue Part 2 is designed to support.

An organisation that wants to apply the series can work through the following steps. They are a practical sequence, not a procedure prescribed by the standard.

Agree the mandate. The governing body confirms that it accepts accountability for data and decides how it will exercise oversight, for example through an existing risk committee.
Engage stakeholders. Find out what customers, employees, regulators, partners and communities expect from the organisation's use of data, including concerns about privacy, fairness and AI.
Take stock. Identify the data sets that matter most to the organisation's purpose and to its risk profile. A complete inventory is ideal but rarely possible at first; start with the critical ones.
Map and evaluate. For each critical data set, walk through the six activities and record value, risk and constraints. This is where most insight appears: data collected for one purpose is often distributed or kept for another.
Direct. Approve a data strategy, a short set of board-level data policies (acceptable use, classification, sharing, retention and disposal, use in AI and automated decisions), a risk appetite for data and named accountabilities.
Delegate and build. Management turns the direction into standards, processes, tools and training, typically using a data management framework and security and privacy controls.
Monitor and report. Agree a small set of measures that show both performance (value delivered) and conformance (policies followed), plus incident and exception reporting and periodic independent assurance.
Review and adapt. Revisit the strategy and policies when the business, technology, law or stakeholder expectations change. The 2026 edition describes governance of data as an ongoing practice that adapts to the evolving data landscape.

Typical artefacts

Organisations applying the series usually end up with a recognisable set of documents and records: a data strategy linked to the organisational strategy; a board-approved data governance policy and a handful of supporting policies; a data classification scheme, ideally informed by Part 3; accountability maps or registers for critical data sets; a data risk register or a data section in the enterprise risk register; terms of reference for the oversight committee; and a regular board report on data. None of these is mandated by name, but each is a practical expression of the principles and model.

Classification in practice

Part 3 deserves a short note because classification is where governance most directly touches daily work. A classification scheme gives everyone a shared language for how data should be handled. The governing body should decide the purpose of the scheme (protection, legal compliance, value, criticality or a mix), approve the categories at a high level and make sure the scheme is applied and reviewed. Management designs the categories, labels, handling rules and tooling. A common failure is a scheme with too many levels that nobody applies consistently; another is a scheme that only addresses confidentiality and ignores integrity, availability or legal status. Part 3 discusses the factors to weigh when developing and deploying a scheme so that it serves the wider data governance policy.

Lesson 5 – Assessment, certification and compliance

There is no certificate for the series

Organisations often ask whether they can be "certified to ISO/IEC 38505". They cannot, at least not in the accredited sense used for ISO 9001 or ISO/IEC 27001. Part 1 is a guidance standard addressed to governing bodies; it does not set out auditable management system requirements, and there is no accreditation scheme for certification bodies to audit against it. Parts 2 and 3 are informative documents. A claim that an organisation is "38505 certified" should therefore be treated with caution; at most it can mean that a consultant or auditor reviewed the organisation's practices against the guidance. Training providers may offer courses or personal certificates on IT and data governance, but these are not ISO credentials and do not certify an organisation.

How governance of data can still be assessed

Absence of certification does not mean absence of assessment. Governing bodies and auditors can evaluate governance of data in several ways:

Board self-assessment. The governing body reviews, perhaps annually, whether it has engaged stakeholders, set direction, assigned accountability and received useful reports, using the principles as a checklist.
Internal audit review. Internal audit examines evidence such as minutes, policies, accountability registers, risk records and reports, and tests whether the direction is followed in practice.
Evidence of success. ISO/IEC/TS 38501, the implementation guide for the governance of IT, encourages organisations to define the beneficial outcomes they expect and the evidence that would show success. The same idea works well for data.
Structured assessment. ISO/IEC 38503 gives guidance on assessing the governance of IT against ISO/IEC 38500. It was not written for data specifically, but its approach can be adapted to the governance of data, which is a domain of the governance of IT.
Maturity assessment. Many organisations use a data governance or data management maturity model to describe their current and target state. These models come from other bodies, not from the series, so be clear which model you are using and why.
Independent assurance. External auditors, regulators or specialist firms can review specific areas such as privacy or security, often against certifiable standards or legal requirements.

What a good assessment looks for

Assessors who use the series typically look for signs that governance is real rather than paper: board minutes that show data decisions being debated and taken; a data strategy that is referenced when investments are approved; named accountable owners for critical data sets who know they are accountable; policies that are short enough to be read and are applied in projects; risk records that mention data risks in business terms; reports to the board that include both value and risk measures; and examples where the board said "no" or "not like this" to a proposed use of data. The absence of all such evidence suggests that data governance has been delegated in full to a technical team, which is precisely what the series warns against.

Compliance and certifiable neighbours

Applying the series does not by itself make an organisation compliant with data protection or sector law. It helps the governing body make sure compliance is managed, by treating legislation as a constraint and asking for assurance. Where an organisation needs a certificate, it usually turns to management system standards such as ISO/IEC 27001 for information security, ISO/IEC 27701 for privacy information management or ISO/IEC 42001 for AI management. The series then provides the board-level frame above those systems: it explains why they exist, what risk appetite they serve and how the board will oversee them.

Lesson 6 – Worked example

The organisation

Harbourline Mutual (a fictional company) is a regional health and travel insurer with about 2,000 staff and 900,000 members. It holds claims, medical and payment data, buys demographic data from a broker and runs a customer app. The board has approved a strategy to use analytics and machine learning to speed up claims and detect fraud. At the same time, a competitor has suffered a public data breach and the regulator has written to all insurers about the use of automated decision-making. The board chair asks the newly appointed chief data officer to help the board apply ISO/IEC 38505-1.

Step 1 – Mandate and engagement

The board decides that its existing risk committee will oversee data and amends the committee's terms of reference. To engage stakeholders, the chief data officer runs a short member survey, meets the member advisory panel, reviews complaints, talks to the regulator's supervision team and interviews staff in claims and fraud. Two clear messages emerge: members welcome faster claims but are uneasy about decisions made "by a computer", and staff are unsure which data they may use for analytics.

Step 2 – Evaluate with the accountability map

The team chooses three critical data sets: claims and medical records, payment data and the purchased demographic data. For each, they walk through the six activities and record value, risk and constraints. The table below shows part of the result for claims and medical records.

Activity	Value	Risk	Constraints
Collect	Complete claim forms reduce rework	Collecting more medical detail than needed	Health-data rules; consent and purpose limits
Store	One trusted claims history	Breach of sensitive records; copies in spreadsheets	Security policy; data residency rules for the cloud provider
Report	Fraud patterns and claim-time trends	Poor-quality codes give misleading results	Internal policy on analytics on health data
Decide	Faster approval of simple claims	Unfair or unexplained automated refusals	Regulation on automated decisions; societal expectations
Distribute	Sharing with reinsurers and providers	Over-sharing or onward use by partners	Contracts; sharing policy; member expectations
Dispose	Lower storage cost and exposure	Keeping records for decades "just in case"	Legal retention periods; records policy

The evaluation also shows that the purchased demographic data adds little value to claims decisions while adding reputational risk, and that nobody is accountable for disposing of old claims extracts held by analysts.

Step 3 – Direct

On the committee's recommendation, the board approves four decisions. First, a one-page data strategy that ties analytics to the purpose of paying valid claims quickly and fairly. Second, a data risk appetite: low tolerance for loss of medical data, and no fully automated refusal of a claim; automation may approve, but a person must review any refusal. Third, a policy set covering acceptable use, classification (four levels, with medical data in the highest), sharing with third parties, and retention and disposal. Fourth, named accountabilities: the chief data officer for the strategy, the head of claims as data owner for claims data, and the chief information security officer for protection. The board also directs management to stop renewing the demographic data contract unless a clear value case is made.

Step 4 – Management builds

Management uses a data management framework to set up stewardship, a business glossary and quality checks on claim codes, applies the classification scheme in the data platform, extends the information security management system to the new analytics environment and creates a review process for machine-learning models before they reach production.

Step 5 – Monitor

The risk committee agrees a quarterly data report with a few measures: average claim time and the share of claims approved automatically (performance); results of quality checks on claim codes (value); open data incidents and exceptions to the sharing policy (risk); the number of analyst extracts past their retention date (conformance); and member complaints about automated decisions (stakeholder trust). Internal audit schedules a review of the new policies after twelve months.

Step 6 – Learn and adapt

After two quarters the report shows faster claims, but also that complaints rose in one region where a model flagged more claims for review. The committee asks management to investigate whether the model treats some members unfairly, which it does because of a skewed training sample. The model is retrained and a fairness check is added to the review process. This is the model of Figure 2 in action: monitoring led to renewed evaluation and new direction, and engagement with members continued through the advisory panel.

What the example shows

Harbourline did not buy a tool or write a thick manual. The board made a few clear decisions based on a structured look at its data, delegated the work, and set up a way to see whether the decisions worked. The accountability map made hidden risks visible, especially in distribution and disposal, which are easy to forget. The three aspects forced trade-offs into the open: the demographic data was dropped because its value did not justify its risk.

Lesson 7 – Relationship to other standards and frameworks

The series is a small set of documents at the top of a large landscape. It works best when combined with standards and frameworks that address management and operations. The table compares the most common neighbours.

Standard or framework	Owner	Focus	Relationship to ISO/IEC 38505
ISO 37000	ISO	Governance of organisations in general: purpose, principles and outcomes	The top of the chain; its principles reach Part 1 through ISO/IEC 38500:2024
ISO/IEC 38500	ISO/IEC JTC 1/SC 40	Governance of IT for the organisation	The parent standard and the only normative reference of Part 1, which applies its principles and model to data
ISO/IEC/TS 38501	ISO/IEC JTC 1/SC 40	Implementation guide for the governance of IT	Practical guidance on arrangements, outcomes and evidence of success that also helps with data
ISO/IEC 27001	ISO/IEC JTC 1/SC 27	Certifiable information security management system	Delivers the security side of the risk aspect; the board sets appetite, the ISMS manages it
ISO/IEC 42001	ISO/IEC JTC 1/SC 42	Certifiable AI management system	Manages AI systems that use data in decisions; the series frames board oversight of those uses
ISO 8000 series	ISO	Data quality and master data	Detailed methods for the quality part of the value aspect
DAMA-DMBOK	DAMA International	Body of knowledge for data management functions	A management-level toolkit for carrying out what the governing body directs
COBIT	ISACA	Governance and management of enterprise IT	Includes a management objective for data (Managed Data) within an IT governance system; useful for management to carry out board direction

Governance versus management frameworks

The key to using these together is to keep the layers straight. ISO 37000, ISO/IEC 38500 and the 38505 series speak to the governing body. DAMA-DMBOK, ISO 8000, ISO/IEC 27001 and ISO/IEC 42001 are about how management and specialists do the work. Many data governance programmes that are labelled "governance" are really data management programmes: they define stewards, glossaries and quality rules, which is valuable, but they never involve the board. The series helps such programmes connect upwards, so that the stewards' work is anchored in a strategy and a risk appetite the governing body has approved.

Privacy and AI

Two areas of rapid change make the series especially relevant. Privacy law in many jurisdictions now expects accountability at senior level, and the series gives boards a structured way to show it. AI systems depend on data at every activity of the accountability map: training data is collected and stored, models report and decide, outputs are distributed and data must eventually be disposed of. The 2026 edition explicitly mentions AI and the ethical use of data, and its bibliography points to the AI vocabulary standard ISO/IEC 22989. A board that has applied the series to its data is in a much better position to oversee AI, and an AI management system under ISO/IEC 42001 will fit naturally under that oversight.

Sector and national guidance

Some countries have adopted Part 1 as a national standard, and sector regulators sometimes publish their own data governance expectations, for example for banks or health services. Where such rules exist, they become constraints in the sense of clause 9, and the series provides a neutral way to organise them under board oversight rather than a competing set of requirements.

Common pitfalls and best practices

Pitfalls

Delegating everything to IT. The board approves a "data governance project" and never hears of it again. Accountability cannot be delegated; the series exists to keep the governing body involved.
Confusing governance with tooling. Buying a data catalogue or quality tool is treated as having governance. Tools support management; they do not set direction or risk appetite.
Looking only at storage and security. Attention goes to protecting stored data while collection, distribution and disposal are ignored, even though many failures happen there.
Treating legality as the only test. If a use is legal it is approved, without asking whether stakeholders would find it acceptable. Part 1 expects ethical judgement where law is silent.
Claiming certification. Marketing material says the organisation is "certified to ISO/IEC 38505", which no accredited scheme supports and which damages credibility.
Reports full of activity, empty of meaning. The board receives counts of stewards appointed and policies written, but nothing on value delivered or risk exposure.
Using the old edition without noticing. Teams keep training on six principles and an unchanged model after the 2026 edition has aligned Part 1 with ISO/IEC 38500:2024.

Best practices

Start from purpose. Tie every data initiative to the organisation's purpose and strategy, and say which stakeholders benefit.
Focus on critical data first. Apply the accountability map to the few data sets that matter most before attempting the whole estate.
Make trade-offs explicit. Record how value, risk and constraints were weighed for major decisions, including decisions to stop using data.
Name accountable people. Every critical data set and major use should have an accountable owner who knows it and reports on it.
Keep board policies short. A handful of clear, principle-level policies works better than a long manual nobody reads; detail belongs in management standards.
Balance the measures. Report performance and conformance together, and include stakeholder signals such as complaints or trust surveys.
Use certifiable standards underneath. Rely on ISO/IEC 27001, ISO/IEC 27701 or ISO/IEC 42001 where certificates are needed, and keep the series as the board-level frame above them.

Summary and key takeaways

The ISO/IEC 38505 series guides governing bodies on the governance of data; as of 2026-10-29 it consists of Part 1 (2026, second edition), TR Part 2 (2018) and TS Part 3 (2021).
Governance sets purpose, direction, risk appetite and accountability for data; management carries it out. The board cannot delegate its accountability.
Part 1 applies ISO/IEC 38500 to data; the 2026 edition aligns with ISO/IEC 38500:2024 and therefore with ISO 37000's principles and three outcomes.
The governance model is a loop: engage stakeholders, evaluate, direct, monitor, and adapt as the data landscape changes.
The data accountability map follows data through collect, store, report, decide, distribute and dispose, showing where oversight is needed.
Value, risk and constraints are the data-specific lenses; good governance makes the trade-offs between them explicit.
There is no certification against the series; assessment relies on self-assessment, internal audit, evidence of success and certifiable neighbouring standards.
The series sits above management frameworks such as DAMA-DMBOK, ISO 8000, ISO/IEC 27001 and ISO/IEC 42001 and connects them to board decisions.

Reflection questions

Which three data sets are most critical to your organisation's purpose, and who on the governing body would answer for a serious problem with each of them?
Walk one of those data sets through the six activities of the accountability map. In which activity is your organisation weakest today, and why?
Think of a use of data in your organisation that is legal but might not be acceptable to customers or staff. How should that use be evaluated and who should decide?
Look at the last report your board or executive committee received about data. Which parts showed value, risk and conformance, and what would you change?
Your organisation already holds an ISO/IEC 27001 certificate. Explain to a sceptical executive what applying ISO/IEC 38505-1 would add, and what it would not.