Data governance in marketing: who sees what and why it blocks reports

Data governance in marketing is the decision about who sees which number, with which cut and with which context. It sounds like an IT topic, and it becomes a marketing problem in the first meeting where someone presents a number out of context or where an analysis cannot be done because the person does not have access.

Both things happen for opposite reasons, and most operations live at one of the two extremes. It is worth understanding the cost of each before choosing where to stand, because data governance in marketing is precisely the choice of a point between them.

The extreme of loose access

Everyone sees everything. The spreadsheet is shared with an open link, the dashboard was sent by email and the report circulates as a PDF between departments.

The first cost is misreading. A number without context becomes an argument in a meeting: someone opens the dashboard, looks at a weekly drop and concludes that the campaign stopped working, without knowing that this cut does not consider the conversion window. Whoever built the dashboard understands the caveat. Whoever received the link does not.

The second cost is compliance. Personal lead data circulating in an exported spreadsheet is the scenario the legal team fears most, and it is the most common. If you are assessing this side, we cover it in detail in the article about LGPD (Brazil's General Data Protection Law) in marketing.

The third cost is subtle and expensive: when anyone exports and builds their own version, divergent numbers appear for the same question. The discussion becomes about which spreadsheet is right.

The extreme of overly rigid access

The opposite gets stuck in another way. Access is concentrated in the data or IT team, and every query becomes a request.

The symptom is the queue. The manager asks for a cut, the request goes on the list and comes out three days later, when the decision has already been made another way. It is the same pattern we described among the signs that the operation needs a data structure.

The real cost is not the delay. It is that people stop asking. After two or three waits, the team stops requesting the data and goes back to deciding by experience. The control became perfect, and the operation got worse.

The middle path: same base, different views

The way out is not choosing between the two extremes, but separating two things that are usually treated as one: access to the data and the format in which it is presented.

Everyone can read the same base. What changes is the view. The analyst needs the dense dashboard, with cuts by campaign, by stage and by period, because their job is to investigate. The director needs the broad dashboard, with four numbers and the comparison with the previous month, because their decision is about allocation.

When each profile has the right dashboard, two problems disappear together. The director stops asking the analyst for reports, because they already have the answer on screen. And the analyst stops explaining why someone's spreadsheet number does not match, because there is no parallel spreadsheet.

That is what the View by profile in Laiki's dashboards solves: the same organized dataset, presented in different ways depending on who is looking.

Resource · In PortuguesePrompt Guide for Marketing and Sales70 prompts with questions about marketing, sales and behavior to ask your data.Download the guide

What to really restrict

Separating views does not eliminate the need to restrict. Three things deserve real control, not just a different presentation.

Personally identifiable data. The lead's name, phone and email matter to whoever is going to talk to that person. For aggregate analysis, anonymized data answers just the same. BI tools offer ways to do this, and the Looker Studio documentation on governance recommends precisely hiding sensitive fields at the source and applying row-level security.

Sensitive commercial information. Margin, unit cost and commission usually stay out of the marketing dashboard, and that is a leadership decision, not the data team's.

Export. It is worth separating who views from who exports. Export is what creates the uncontrolled copy, and it is what leaks into a WhatsApp group months later.

Audit logs: the part nobody asks for until they need it

An audit log is the record of who viewed what and when. It looks like bureaucracy until the day someone asks how a piece of data ended up in a certain place.

It serves two situations. In the first, an incident: you need to reconstruct the path of the data. In the second, compliance routine: showing the legal team that access is traceable, not a promise.

It is worth checking, in the tool you use, exactly what the log records and for how long it stays available. At Laiki, audit logs are on the Pro plan, along with on-demand anonymization.

How to decide in practice

Start with the question each person needs to answer, not with their job title. List three or four real profiles in your operation, write down the decision each one makes and build the view from that.

Then define what is truly restricted: personal data, sensitive commercial information and export permission. Everything else can be open, as long as it is presented in the right format.

And review the access list every semester. People join, people leave, and the access of those who left tends to survive longer than it should.

Frequently asked questions

Who is responsible for data governance in marketing?

Marketing leadership, with support from IT and the legal team. The one who decides which number each profile needs to see is the one who knows the department's decisions, not the one who administers the tool.

Doesn't restricting access slow the team down?

Restricting the data does. Adjusting the view does not. That is the difference: when a person receives the right dashboard for their question, they get faster, even while seeing less.

How often should permissions be reviewed?

Every semester at the very least, and whenever someone leaves the company or changes department. Forgotten access is the kind of risk that only shows up when it has already become a problem.