Data Governance and the Information Lifecycle

This hub treats data as an organizational asset that needs ownership, discipline, and a managed end of life. It starts with governance: decision rights, data owners and stewards, proportionate operating models for small and large organizations, policies and change control, board and executive oversight, risk registers, training, metrics, and the audit evidence a management review can actually establish. It then covers discovery and understanding: inventories, data maps, catalogs, metadata, business glossaries, and records of processing activities, distinguished from one another and extended to tracking pixels, mobile SDKs, smart-TV collection, AI prompts, foreign vendors, and data brokers. Classification separates statutory categories from internal business classes, carrying forward the owner's concentrated-protection thesis as a working method rather than a legal doctrine. Quality, lineage, provenance, and master data trace the version of a record used in a decision. The lifecycle itself runs from planning and acquisition through validation, storage, use, sharing, retention, archival, preservation, and disposition, with branches for copies, reuse, holds that interrupt disposal, and backups that restore deleted material. Archives and the owner's Dracula Data concept cover stale information that remains evidentiary after outliving its authority, context, accuracy, or permission. Legal holds, deletion, and defensible disposition address Federal Rule 37(e), Texas spoliation law, vendor backups, restoration, and hold release. AI-derived information closes the hub: inferences, embeddings, model artifacts, de-identification limits, privacy-enhancing technologies, synthetic data, and provenance constraints, cross-linked to the AI site without duplicating its AI-law analysis.

Key questions

How should a company determine what information it holds
Which records should be retained, archived, or deleted
Who decides what data the organization keeps, and what evidence must that decision leave
How do legal holds interrupt routine deletion
What limits apply to AI-derived data, inferences, and de-identification
When does old information become a liability rather than an asset

Controlling authorities

Federal Rule 37(e) (preservation and sanctions); Texas spoliation law; NIST Privacy Framework, NIST CSF 2.0, and NIST SP 800-188 as voluntary frameworks and guidance; TDPSA assessment and retention provisions where they create legal duties (recommendations without a statute are identified as such).

Guides in this hub

Planned insights

I10 NIST Sanitization Guidance Has a New Final Revision
I11 A Classification Draft Is Not a Final Standard (the discontinued IR 8496 draft as history, and current alternative materials)
I12 A Model Derived From Personal Data Is Not Automatically Anonymous (linkability, inferences, PET limits, and issues still needing resolution)
I13 Data Deletion Must Account for Restoration (backups, replicas, vendor copies, and the return of previously deleted material)
I14 Old Information Can Still Be Essential Evidence (Dracula Data, archives, legal holds, context, and when disposition should be restricted)
I16 What a Governance Audit Must Be Able to Reconstruct.

Tracker records

K58 NIST Privacy Framework version and revision status
K59 NIST Data Governance and Management Profile
K60 NIST CSF 2.0
K63 NIST IR 8496 draft with development ceased
K64 NIST SP 800-188 de-identification guidance
K65 Brookshire Brothers v. Aldridge and preservation rules
K66 Morgan Stanley 2022 SEC data-disposal order.