Governance Added Late Fix

The data lake had 300 datasets and no owner list. The audit notice gave us 4 months.

A HealthTech scaleup, grown fast, lake filled organically by every team. Clinical-adjacent data in some corners. Then the compliance review landed on the calendar and “we’ll add governance later” ran out of later.

The retrofit, in order:

1. Inventory first. Script the lake, list every dataset, its size, its last read. A third hadn’t been touched in months, which shrank the job immediately.
2. Owners before rules. Every live dataset got a named owner in 2 weeks of uncomfortable Slack threads. Unowned meant archived.
3. Classify only what’s live. Personal or clinical data tagged, access tightened, retention set.
4. Write down the process you now follow, because the auditor asks how, not just what.

It took most of a quarter alongside normal work. The audit passed. The same setup built in from the start would’ve been days, and I’ve done it that way since, in regulated settings.

Late is 10x the cost of early. It’s also 10x better than never, with an auditor on the calendar.

How many datasets in your lake would survive an “unowned means archived” rule?