Policies and controls over how data is defined, accessed, and retained. Covers catalogues and lineage, ownership, classification of sensitive data, and regulatory compliance.