Knowledge center · Deciding
Why is data strategy a boardroom matter?
Data strategy is a boardroom matter because it decides on investment, accountability, and risk, not on technology. It defines which data supports which business decisions, who is accountable for that data, and in what order to invest. Only executive leadership can answer those questions. In regulated sectors there is a further reason: NIS2 and DORA explicitly hold management accountable for information security and ICT risk.
Author Thomas Wassum, Managing PartnerLast reviewed
Legal information as of October 8, 2026. This article is not legal advice.
Context
A management discipline, not an IT project
A data strategy belongs with executive leadership, alongside financial and HR strategy. It starts with the decisions the company has to make over the next few years: where to invest, which markets to serve, which risks to take. For each of these decisions, it clarifies which data is needed, at what quality, and how current it has to be.
That tells you which data really matters to the business. Not every data source deserves the same attention. A good data strategy sets priorities and is open about what will not be tackled for now. Delegated to IT, it becomes a list of tools. Led by the executive team, it becomes a management tool.
Accountability
What regulation expects of management
In companies within the scope of NIS2, the management body approves the cybersecurity risk-management measures and oversees their implementation. In the financial sector, DORA explicitly places responsibility for ICT risk management with the management body. Neither can be demonstrated without clear accountability for data. A data strategy provides that clarity: who is accountable for which data and how decisions about it are made.
In Germany, Section 38 of the BSI Act (BSIG) has implemented this duty since December 6, 2025: the management bodies of essential and important entities must implement the cybersecurity risk-management measures and oversee their implementation, take part in regular training, and are liable for breaches.
Rules that touch data accountability
- GDPR: accountability for personal data
- NIS2 and Section 38 BSIG: duties of management
- DORA: the management body’s responsibility for ICT risk
- EU AI Act: obligations by the risk class of an AI system
- BCBS 239 and MaRisk: risk data and risk management in German banking
As of October 2026 · not legal advice
Data governance
Clear roles, one authoritative source
Data governance makes the data strategy work in daily operations. It defines who is accountable for a data set on the business side, who maintains its quality, and which source is authoritative for it. The outcome fits on a few pages: the strategy, a governance model with these roles, and a roadmap that states the expected benefit as a target. Leadership can check later whether the strategy is working.
A typical scenario: a financial services provider has to show its regulator where the data in its risk reports comes from. The data exists, but nobody owns it. Together with leadership, the business-critical data domains are defined, data owners are named, and evidence paths are described. The next audit request can be answered with documents that already exist.
The scenario is typical of our engagements, not a single client case.
Three terms in data governance
- Data owner
- Accountable for a data set on the business side: what it means, who may use it, and what quality it needs. Usually a manager in a business unit.
- Data steward
- Maintains the data set under the data owner’s rules, measures its quality, and resolves discrepancies where they arise.
- Single source of truth (SSOT)
- The one authoritative source for each data set. Reports and systems take their values from it; in data architecture, it is called the system of record.
Questions from leadership
What executives ask about it
How does a data strategy differ from an IT strategy?
An IT strategy answers which systems and technology a company works with. A data strategy answers which information supports which decisions and who is accountable for it. It comes before the IT strategy and gives it direction.
Do midsize companies need a data strategy too?
Especially there. In a midsize company, a few people decide a lot, often under time pressure. A data strategy of a few pages helps those decisions rest on reliable numbers rather than on whichever report was finished first.
Who implements the data strategy?
Your team, with clear roles. The data strategy names data owners and those responsible for data quality. SIMO supports the implementation if you wish, with the goal that your team carries it forward on its own.
What is the difference between a data owner and a data steward?
The data owner decides; the data steward maintains. The data owner defines what a data set means, who may use it, and what quality it needs. The data steward applies these rules day to day, measures quality, and fixes errors where they arise. Both roles belong in the business; IT runs the systems that hold the data.
Author and sources
Who answers, and what it rests on
Sources and further reading
- Directive (EU) 2022/2555 (NIS2), Article 20 (external site)
- Regulation (EU) 2022/2554 (DORA), Article 5 (external site)
- Regulation (EU) 2016/679 (GDPR), Article 5(2) (external site)
- Basel Committee on Banking Supervision: BCBS 239, Principles for effective risk data aggregation and risk reporting, 2013 (external site)
- ISO/IEC 38505-1:2017, Governance of data
- DAMA International: DAMA-DMBOK, Data Management Body of Knowledge, 2nd edition, 2017
- BaFin: Rundschreiben 06/2026 (BA), Mindestanforderungen an das Risikomanagement (MaRisk), 9. MaRisk-Novelle [in German], 2026 (external site)
Page last reviewed:
Read on
The next question and the path behind it
Related question
How do you create reliable data flows?
One system of record per data set, binding KPIs, and reconciliations that expose discrepancies.
Related question
When is a company AI-ready?
When use cases, data, technology, and rules fit together. Data first, then the model.
Matching service
Business Data Strategy
How SIMO handles this topic in an engagement: approach, results, and the questions executives ask.
See how SIMO structures and assesses alternatives.
Your next step
From the answer to the decision
The Decision Readiness Check shows how ready your own decision is. If you’d rather talk directly, book an initial call with a Managing Partner.
45 minutes, and you will know whether SIMO fits your decision.
How ready is your decision? Check it in 3 minutes.
Or call us: +49 6021 625 63 40