How to Hire Data Governance Specialists: Signals and Tests

Data governance fails in a predictable way: it becomes a documentation exercise that changes nothing. Hiring well means screening for people who make it operational. This guide covers how, drawing on FISTA Solutions' AI enablement work. This article is general guidance, not legal advice.

Why do governance programmes fail?

Because they produce artefacts rather than changes in behaviour.

Artefact	Fails when	Works when
Policy	Nobody enforces it	A mechanism applies it
Catalogue	Completeness is the goal	People use it to choose datasets
Classification	Too many tiers to apply	Few tiers with clear consequences
Committee	No authority	Decisions land with named owners
Lineage diagram	Hand-maintained	Generated automatically

What should you test in an interview?

Ask what changed as a result of their last programme. That single question separates the field.

Strong candidates cite datasets that gained owners, access decisions that became faster, or a classification that actually gates something. Weak candidates cite documents produced and committees convened.

Why does ownership come before policy?

Because a policy with nobody accountable for applying it is a statement of intent. Named ownership for each significant dataset gives every subsequent question somebody who can answer it.

Ask how they established ownership when nobody wanted it. That is the hard part, and the answer reveals whether they can operate politically as well as technically.

What makes classification usable?

Few tiers with clear consequences. A scheme with seven sensitivity levels and no difference in handling between them will be applied inconsistently or not at all.

Ask how many tiers their scheme had and what each one changed in practice. If nothing changed, it was a labelling exercise.

What makes a catalogue succeed?

Adoption. A partial catalogue people use beats a complete one they ignore.

Catalogues work when they answer a question people already have — which dataset should I use, who owns this, is this current — and fail when they exist to satisfy an audit. Ask how they measured usage.

How do access decisions work in practice?

This is where governance meets daily reality. Ask how long it took someone to get access to a dataset before and after their programme.

Governance that makes access slower without making it safer drives people to copy data into spreadsheets, which is worse than the situation it replaced. See what is purpose limitation.

How does retention fit in?

Retention decisions require someone with authority to say data should be deleted, which organisations find surprisingly difficult.

Ask whether they ever deleted anything. Programmes that only ever add controls accumulate liability rather than reducing it.

How does AI change the urgency?

Substantially. Assistants and agents query across data that previously required deliberate effort to combine, so classification and access decisions that were theoretical become operational.

An assistant that can reach personal data because a permission was set loosely years ago is a governance failure that will be discovered by a user rather than an audit. See what is shadow ai.

What about regulatory context?

It varies by jurisdiction and sector, and it sets the floor rather than the ceiling. Ask which regimes they have worked under and what they did beyond compliance.

Governance driven solely by regulation tends to satisfy the letter and miss the operational benefit. This is general guidance, not legal advice.

Contract, staff augmentation, or permanent hire?

Augmentation suits establishing a programme: ownership model, classification scheme, catalogue foundation, access process. Permanent ownership suits the ongoing operation, because it depends on organisational relationships.

What are the common hiring mistakes?

Hiring a documentation specialist. Giving the role no authority. Measuring on artefacts produced. And starting with policy rather than ownership.

How do you onboard them well?

Give them the list of datasets people actually use, the access request backlog, and the last data incident. Those three describe where governance is needed rather than where it looks tidy.

What does good look like after 90 days?

Named owners for the datasets that matter, a classification scheme with real handling consequences, an access process people do not route around, and a catalogue with measurable usage.

When do you not need this role?

When the organisation is small enough that everyone knows what data exists and who decides. Governance earns its cost through scale and regulatory exposure.

What should be measured?

Proportion of significant datasets with named owners, time to grant or deny access, catalogue usage, and incidents involving inappropriate data access.

What should you do first?

Take your ten most-used datasets and try to name an owner for each. The gaps are the programme.

How do you handle data quality within governance?

Quality and governance are frequently separated into different programmes and then both underperform. Ownership is the link: a dataset with a named owner has somebody accountable for whether it is right, and a dataset without one has quality problems that circulate as complaints.

Ask candidates how quality issues were escalated and resolved under their programme. Answers that route to an owner with authority are working; answers that route to a committee are not.

How FISTA Solutions helps

FISTA Solutions builds operational data governance through AI enablement and staff augmentation: ownership established before policy, classification schemes with real handling consequences, catalogues measured on adoption rather than completeness, access processes designed so people do not route around them, and governance extended to cover what assistants and agents can reach, through AI agents. The record is 150+ projects for 50+ companies across 12+ countries.

To make governance operational, message FISTA on WhatsApp, or read AI governance cost.