Why Roles Matter in Information Governance

Many Information Governance initiatives fail for one simple reason: nobody truly “owns” the decisions. Without clearly defined roles, information policies stay theoretical, technology controls are inconsistently applied, and staff revert to informal workarounds.

Effective Information Governance assigns decision rights—who approves standards, who owns information risk, who sets retention rules, and who can authorise disposal. If you haven’t read the framework article yet, start here: The Information Governance Framework: Key Components Explained .

The Core Information Governance Roles

The exact operating model differs by organisation size and industry, but most effective IG programmes include the following roles. The key is to keep the model practical and scalable.

1) Executive Sponsor

The Executive Sponsor provides authority, funding, and organisational alignment. Without this role, governance struggles to influence behaviour across departments and systems.

• Owns the business outcome (risk reduction, compliance, efficiency)
• Approves the governance mandate and operating model
• Removes organisational blockers and ensures cross-functional participation

2) Information Governance Steering Committee

The steering committee is the decision-making forum for governance. It ensures alignment between business, IT, legal, compliance, privacy, and information management.

• Approves policies, standards, and major changes to controls
• Prioritises implementation phases and high-risk areas
• Reviews metrics, issues, exceptions, and escalations

3) Information Governance Lead (Programme Owner)

This role drives the IG programme day-to-day. In smaller organisations, it may be a combined role; in larger organisations, it is typically a dedicated function.

• Maintains the governance framework, roadmap, and implementation plan
• Coordinates stakeholders and ensures standards become operational
• Owns the governance measurement and improvement cycle

4) Business Information Owners

Business information owners are accountable for information generated by their functions. This is where governance becomes real—because most information risk lives in business processes, not in IT.

• Approve classification and handling expectations for their information
• Ensure retention rules reflect business and regulatory requirements
• Confirm that information is structured and managed in approved repositories

5) Records Manager / Records Management Function

Records Management ensures that records are controlled as evidence across their lifecycle, including retention and defensible disposal. It also ensures auditability.

• Defines records requirements, retention triggers, and disposal governance
• Maintains classification schemes and file plans where applicable
• Supports defensible disposal, legal holds, and audit readiness

Related services: File Plan Development | Retention Schedule Development.

6) IT / Platform Owners

IT platform owners ensure that systems enforce governance—not undermine it. Their role is to translate governance requirements into configuration, controls, and operations.

• Implements metadata, security, retention, and audit controls in platforms
• Maintains technical standards and system guardrails
• Supports integrations across repositories (email, shared drives, cloud platforms)

Related services: SharePoint Design and Implementation | ECM and EDRMS Implementation.

7) Legal and Compliance

Legal and compliance ensure the governance model aligns with regulatory obligations and risk exposure. They are especially important for retention rules, legal holds, investigations, and defensible disposal.

• Advises on legal and regulatory retention requirements
• Defines legal hold and investigation procedures
• Supports defensibility, audit preparation, and regulatory responses

8) Privacy / Data Protection Officer

Privacy roles ensure personal information is processed lawfully, minimised, protected, and retained only as long as required. This role is critical where POPIA, GDPR, or similar regulations apply.

• Defines privacy requirements for collection, access, sharing, and retention
• Ensures lawful processing, consent, and data subject rights processes
• Aligns privacy controls with information governance and security controls

9) Information Security

Security ensures information risks are managed through access control, monitoring, incident response, and security architecture aligned to the classification model.

• Defines security controls aligned to information sensitivity
• Supports secure collaboration and controlled sharing
• Monitors risks and supports incident response

RACI: A Practical Way to Make Roles Work

A simple way to operationalise responsibilities is to define a RACI model: Responsible (does the work), Accountable (owns the outcome), Consulted (provides input), and Informed (kept updated).

Common activities to assign in a RACI include:

• Approving information governance policies and standards
• Approving classification and handling rules
• Defining retention schedules and disposal approvals
• Implementing platform controls (metadata, access, retention)
• Managing exceptions, investigations, and legal holds
• Monitoring governance KPIs and maturity improvements

Common Role and Accountability Pitfalls

• Ownership assigned to IT only: most information risk is driven by business processes and behaviour.
• No decision forum: without a steering committee or equivalent, governance decisions stall.
• Unclear disposal authority: retention exists on paper but disposal never happens.
• Too many roles, too complex: governance must match the organisation’s capacity and maturity.
• No adoption support: users need practical guidance, not just rules.

How to Establish Roles Quickly

To establish governance roles in a practical way, start with a short workshop to confirm scope, identify owners, and define decision rights. Then formalise responsibilities and embed them into system controls and operating routines.

Related service: Information Governance Strategy Workshop .