How do you weigh data access against protection in BI?

There is a tendency to 'gather everything' when it comes to customer data, on the premise that it might be useful in the future. This occurs across the entire BI pipeline and needs to be actively resisted because it complicates the requirements and increases the likelihood of inadvertent or even intentional misuse. Decisions should be made on a minimum information basis, as this simplifies the identification of appropriate source data; makes calculations and data associations more straightforward to design, develop, document, and validate; and supports accurate and timely BI outcomes that can be appropriately risk assessed.

I've often emphasized the importance of a data-centric organizational mindset. It's crucial to distinguish between 'data collection' and 'intelligent data collection'. The former refers to collecting data for the sake of it, while the latter focuses on gathering data that aligns with business objectives. Quantifying the value of each data point can help in this distinction. If a specific data set poses high protection challenges but offers minimal business value, its collection and retention should be questioned.

I've experienced that each environment is unique, thus creating the basis of understanding user consumption and business requirements primarily before any data is collected. Working with various industries has shown often that the end user is not aware of the possibilities and power of their data, and often requests too much or too little. Often using the textbook approach will result in inadequate data collection, and methods, like Six Sigma, will allow you to analyze in-depth and assist the requestor/end user to identify their actual requirements. Also, the opportunity to link different source databases are overlooked, and end users expect that each systems data collection should be analyzed on its own, which is not the case.

Having a robust data governance structure is not just about compliance. It's an opportunity to enhance trust both internally among employees and externally with customers. Trust is an intangible asset that can significantly impact the bottom line. It's vital to remember that data governance isn't a one-time initiative but an evolving process that requires regular reviews and updates, especially in an ever-changing digital landscape.

Beyond the standard measures, consider adopting a zero-trust security model. This approach assumes that threats can come from both outside and within the organization. Hence, every access request, regardless of its source, is treated as potentially harmful. This kind of proactive approach can serve as a strong defense mechanism against the ever-increasing sophistication of cyber threats.

Granular permissions not only bolster data security but also enhance data integrity by ensuring that only trained and accountable individuals have access to specific data sets. This layered access ensures that data manipulations, intentional or unintentional, are minimized.

As data has gotten more widespread in an organization, data roles and permissions have become critical. Not only within a BI/Data team, but also in other departments. Knowing what metrics to give access to what role within a company is also be linked to the culture. Do you have an open culture and share 'most' metrics, to increase collaboration/competitiveness. Or are you extremely protective of your data and share only what you need to share.

Empowering users with knowledge is not just about mitigating risks but also about maximizing data's potential. An informed user can leverage data better, spot anomalies faster, and contribute to the overall data ecosystem's health. Periodic "data health" workshops can provide dual benefits – reinforcing best practices and updating users on new data capabilities.

Iterative reviews are essential. As businesses evolve, the data they rely upon and how they use it will change. Regular audits ensure that practices remain relevant. These audits should not just focus on security but also on the utility. Is the data still serving its intended purpose efficiently?

This article lays out an excellent roadmap to balancing the need for data access and data privacy. This has to be designed into a solution and be part of the organization's culture. Proper governance and access policies are key to ensuring trust in data and enabling analytics.