Glossary

The terms you are about to be asked about

46 definitions, written for someone who has just been handed responsibility for this and is sitting in a meeting where three acronyms have gone past unexplained. Each entry says what the term means, then the thing people usually get wrong about it.

46 terms

A

Access request: A request from a person or team to use a dataset they do not currently have rights to.; In most mid-market businesses the request is a message to whoever built the report, and the answer is a yes or a no that nobody records. The two things worth writing down are who approved it and why, because in twelve months the only question anyone asks is why this person can see payroll.
Attribute: One field in a dataset — a column in a table, a property on a record.; Worth naming separately from the dataset because ownership and sensitivity often differ inside one table. A customer table can be unremarkable except for the two columns holding date of birth and bank details.
Audit trail: A dated record of who changed what, and what it changed from.; The value is entirely in the “from”. A log saying the retention period is 60 months tells you nothing; one saying it was moved from 36 to 60 by a named person in March tells you whether that was a decision or an accident. Beware the word immutable — most systems mean append-only, which is not the same thing.

B

Business glossary: The agreed definitions of the terms your business reports on — what counts as an active customer, when revenue is recognised, what a churned account is.; It is the cheapest fix for two reports disagreeing, and the one most often skipped because it looks like paperwork rather than engineering. A glossary with twenty terms that everyone uses beats one with four hundred that nobody has read.; Read the guide: Two reports, two numbers

C

Classification: Sorting datasets by how sensitive they are, so that access rules and handling can follow the label rather than being argued case by case.; Confusion to avoid: sensitivity classification is not the same axis as a trust tier. One says who may see it, the other says how much you should believe it. A raw, untrusted table can be the most sensitive thing you hold.; Read the guide: Data classification

D

Data breach: A security incident that leads to personal data being destroyed, lost, altered, disclosed or accessed without authorisation.; The UK reporting clock is 72 hours from becoming aware, where the breach is likely to risk people's rights. What eats the 72 hours is establishing what was in the affected system — which is a register question, not a security one.; Read the guide: UK GDPR in practice
Data catalogue: A searchable inventory of the datasets an organisation holds, with descriptions, owners and technical detail.; American spelling catalog is the same thing. A catalogue answers “what have we got and where”. It does not answer “who decided, and on what basis”, which is the question an auditor and a new CFO both ask.; Read the guide: Purview and Fabric
Data contract: A written agreement between the team producing a dataset and the teams using it, covering schema, freshness, quality thresholds and how much notice a breaking change gets.; The engineering community treats this as a technical artefact enforced in a pipeline. In a business of 200 people it is usually more useful as a paragraph in a procedure: what the producer promises, and who they tell before they break it.
Data custodian: The person who operates the systems a dataset lives in — the pipelines, the storage, the permissions — on behalf of its owner.; Often the same person as the steward in a small team, and that is fine as long as it is written down. What is not fine is the custodian making ownership decisions by default because nobody named an owner.; Read the guide: Owner, steward, custodian
Data dictionary: A field-by-field description of a dataset: what each column holds, its type, its permitted values, and what it means in business terms.; Different from a business glossary, which defines concepts rather than columns. You need both, and the dictionary is the one your engineers will actually maintain.
Data governance: The decisions about who owns which data, what standards it is held to, who may see it, and how those decisions are evidenced.; The word carries a cost that the work does not: to most managers it sounds like a committee. It travels better as “who owns what and how you prove it”, which is the same thing without the flinch.; Read the guide: A data operating model
Data lineage: The record of where a dataset came from, what happened to it on the way, and which reports depend on it.; Sold as an automatic feature and delivered as one, up to a point: tools trace lineage through the pipelines they can read, and lose the trail the moment a number passes through a spreadsheet or a hand-edited step.; Read the guide: Data lineage
Data literacy: The ability of ordinary staff to read a chart, question a number, and know what a dataset can and cannot support.; The cheapest intervention available and the one most easily faked. Completion of an e-learning module is not literacy; whether someone asks where a number came from before quoting it in a board paper is.
Data maturity: How reliably an organisation does the same thing twice with its data — typically scored on a five-level scale from ad hoc to optimised.; A maturity score is only useful if it can fall. A number that only ever rises is a marketing artefact, not a measurement.; Read the guide: Data maturity
Data mesh: An architectural approach that treats each domain team as the owner and publisher of its own data products, rather than routing everything through a central data team.; A serious idea for organisations with several strong engineering teams. Below roughly a thousand people it usually describes a staffing structure you do not have, and the useful half — domain ownership — you can adopt without any of the architecture.
Data operating model: The organisational layer that says who owns each dataset, what the standards are, which procedures apply, and how the whole thing is evidenced — independent of the platform it runs on.; The point of naming it separately from the platform is that it survives the platform. Everything in it stays true if you move from a SQL Server and a stack of spreadsheets to Microsoft Fabric next year.; Read the guide: A data operating model
Data owner: The business leader accountable for a dataset: its quality, who may use it, and what it may be used for.; Accountable, not responsible — the owner does not do the work, and should not be the person who built the pipeline. If the honest answer to “who owns this?” is a job title rather than a name, you do not have an owner.; Read the guide: Owner, steward, custodian
Data product: A dataset treated as something with a customer: a named owner, a documented interface, a quality promise and a support route.; Useful discipline, overused label. Calling a table a data product changes nothing unless someone is on the hook when it breaks at 7am.
Data protection impact assessment: A written assessment, required by UK GDPR Article 35 for high-risk processing, of what a use of personal data could do to the people in it and what you are doing about that.; It is not a form to be completed after the fact. If a DPIA has never changed a plan in your organisation, it is being used as a receipt rather than an assessment.; Read the guide: UK GDPR in practice
Data quality: How fit a dataset is for the decisions being made on it, usually broken into dimensions such as completeness, accuracy, timeliness, consistency, validity and uniqueness.; Quality is relative to a use. The customer address file that is fine for emailing a newsletter is not fine for posting a legal notice, and no single score can tell you both.; Read the guide: Data quality dimensions
Data retention: How long you keep a dataset before it is deleted or archived, and on what basis.; Two failures, and the second is more common: keeping everything for ever because nobody will sign the deletion, and having a policy that says three years while the backups keep it for ten.; Read the guide: Retention schedules
Data steward: The person who does the day-to-day work of keeping a dataset in order — the definitions, the quality checks, the metadata, the questions from users.; The role that actually makes a data operating model work, and the one most often handed to someone as a fifth priority. Budget an hour or two a week per steward and say so out loud, or the job quietly does not happen.; Read the guide: Owner, steward, custodian
Data subject access request: A request from an individual to be given the personal data you hold about them, which UK GDPR generally requires you to answer within one month.; The clock is the problem, not the principle. Organisations that cannot say which systems hold personal data spend the first three weeks looking, which is why a register is a compliance asset rather than an administrative one.; Read the guide: UK GDPR in practice
Data warehouse: A database organised for analysis rather than transactions, holding cleaned, structured data modelled for reporting.; The distinction from a data lake matters less every year, and it never mattered to the question of whether two departments agree on what a customer is.
Dataset register: The list of every dataset and report the business relies on, with a named owner, a source system, a classification and a status against each.; The first artefact worth building, and the one that makes every later argument concrete. Most businesses of this size find between 60 and 300 things belong on it, and that a third of them have nobody against them.; Read the guide: A data operating model

E

ETL and ELT: Two orders for moving data: extract, transform, then load; or extract, load, then transform in the destination.; ELT won on modern cloud platforms because storage got cheap and the warehouse got fast. It matters to governance for one reason: in ELT the raw, untransformed data lands in your platform, so it is now yours to classify and to delete.

G

Golden record: The single reconciled version of an entity — one customer, one product, one supplier — assembled from the several systems that each hold part of it.; Building one is a matching problem and a political problem in roughly equal measure. The matching is solvable; agreeing whose version wins when the CRM and the finance system disagree is the part that needs a named owner.; Read the guide: Master data without MDM

I

Information asset register: A public-sector term for the same list of things a dataset register holds, usually with an named information asset owner against each entry.; If you sell into councils, the NHS or central government, expect to be asked for one by that name. It is not a different artefact.; Read the guide: A data operating model

L

Lakehouse: A storage architecture that keeps files in cheap object storage the way a data lake does, while providing the tables, transactions and schema enforcement of a warehouse.; The word describes the storage layer, not your business. Whether your numbers agree with each other is decided somewhere else entirely.; Read the guide: Purview and Fabric
Lawful basis: The reason UK GDPR permits you to process a piece of personal data — one of six, including consent, contract and legitimate interests.; Pick it before processing, not after a complaint, and record it. Switching basis later is difficult by design, which is why “we'll say legitimate interests if anyone asks” is a plan that fails on the first challenge.; Read the guide: UK GDPR in practice

M

Master data management: The practice of holding one agreed version of the entities several systems share — customers, products, suppliers, sites — and keeping the copies in step.; Enterprise MDM platforms start in six figures. Most mid-market MDM is three decisions written down: which system is authoritative for each entity, how conflicts are resolved, and who resolves them.; Read the guide: Master data without MDM
Medallion architecture: A layered layout for a lakehouse in which data moves through bronze (raw as ingested), silver (cleaned and conformed) and gold (business-ready) tables.; A useful engineering convention that gets mistaken for a trust rating. Gold means refined, not correct, and a gold table built on a broken definition is a confidently wrong number.; Read the guide: Trust tiers and medallion
Metadata: Data about data: what a dataset contains, where it came from, who owns it, when it last updated, how sensitive it is.; The unglamorous half of every catalogue tool, and the half that no product can generate for you. A tool can harvest schema and freshness automatically; it cannot harvest the owner's name or the reason a field exists.

P

Personal data: Any information relating to an identified or identifiable living individual, directly or indirectly — the definition UK GDPR uses in Article 4(1).; Broader than the American term PII, and the gap is where the mistakes live. Device identifiers, IP addresses, cookie IDs and pseudonymised customer keys are all personal data, and none of them looks like a name in a schema scan.; Read the guide: UK GDPR in practice

R

RACI matrix: A grid mapping each activity to who is Responsible for doing it, Accountable for the outcome, Consulted before it, and Informed after it.; One accountable name per row, no exceptions — the moment there are two, there are none. Most RACI grids fail not because the letters are wrong but because they were filled in by one person in a meeting nobody else attended.; Read the guide: A RACI matrix for data
Record of processing activities: The register UK GDPR Article 30 requires: what personal data you process, why, who you share it with, where it goes and how long you keep it.; Most organisations of 50 to 1,000 people are in scope despite the small-organisation exemption, because the exemption falls away as soon as processing is regular — and payroll is regular. Build it from the dataset register rather than as a separate spreadsheet, or the two will disagree within a quarter.; Read the guide: UK GDPR in practice
Reference data: The small, slow-moving lists that everything else joins to: country codes, product categories, cost centres, status values.; Boring and disproportionately damaging. A single unmanaged status list — one system says “Cancelled”, another “CANCELLED”, a third “Void” — is behind a surprising share of reports that disagree.; Read the guide: Master data without MDM

S

Schema: The structure of a dataset: its fields, their types, and the relationships between them.; Schema changes are the most common way a working report breaks. It is the reason a change procedure earns its keep long before a catalogue does.
Schema drift: Unannounced changes to the structure of a source dataset — a renamed column, a widened type, a field that starts arriving empty.; It rarely announces itself as an error. The pipeline keeps running, the report keeps rendering, and a number quietly becomes wrong.
Self-service BI: Letting people build their own reports and dashboards rather than queueing for a central team.; It works, and it produces the specific failure this whole discipline exists for: forty dashboards, six definitions of revenue, and no way to tell which one the board is looking at.; Read the guide: Two reports, two numbers
Semantic layer: A shared definition layer between raw tables and reports, where a measure such as net revenue is defined once and every report reads that definition.; The technical half of a single source of truth. It fails without the human half: someone has to be allowed to decide what net revenue means, and to say no to the fourth variant.; Read the guide: Two reports, two numbers
Sensitive data: A loose business term for data that would cause harm if disclosed. Under UK GDPR the precise term is special category data, which covers health, biometrics, race, politics, religion, trade union membership, sex life and sexual orientation.; Worth keeping the two words apart in your policy. Commercially sensitive and legally special-category are different problems with different rules, and a policy that blurs them tends to over-restrict the first and under-protect the second.; Read the guide: Data classification
Single source of truth: The agreement that for any given number there is one authoritative place it comes from, and everything else quotes it.; It is an agreement first and a system second. Organisations buy the system and skip the agreement, then discover they have bought a very expensive second version of the truth.; Read the guide: Two reports, two numbers
Steward hours: The time your own people spend on data stewardship, as a planned figure rather than an accident.; Not a standard industry term — we use it because the unplanned version is the commonest reason this work stalls. Ninety minutes to set a dataset up, an hour a month to keep it, per owner. If nobody has that hour, the register goes stale in a quarter.

T

Trust tier: A label on a dataset saying how much confidence a decision-maker may place in it — typically three levels, from raw through conformed to board-ready.; Deliberately not called bronze, silver and gold on the business-facing side. Those are storage layers; a tier is a promise to a reader, and the two only line up if someone checks.; Read the guide: Trust tiers and medallion

U

UK GDPR: The UK's retained version of the EU General Data Protection Regulation, which sits alongside the Data Protection Act 2018.; For a mid-market business the practical demands are narrower than the reputation: know what personal data you hold and why, be able to find it, keep it no longer than you need it, and be able to show all three.; Read the guide: UK GDPR in practice

The first step costs you nothing

Forty-five minutes with whoever runs your reporting

We tell you honestly whether this is worth doing at all, and roughly what it would take. If the answer is not yet, you will hear that. "Not for us" is a fine outcome, and a better one than a slow maybe.

Request a demo Is it for us?