Data governance for working with EU partners

The commencement of negotiations on Ukraine’s accession to the European Union marks a new stage in the convergence of the Ukrainian economy with the European market. For businesses, this means not only prospects for expanding cooperation but also the necessity to enhance corporate information management standards. Personal data protection, transparency of information processes, directory management, data provenance control, and audit readiness are gradually becoming important characteristics of corporate IT architecture.

June 2024: A New Stage of Ukraine’s European Integration

On June 25, 2024, the first Intergovernmental Conference between Ukraine and the European Union took place in Luxembourg, officially opening negotiations on Ukraine’s accession to the EU.

This was preceded by the European Council’s decision of December 14-15, 2023, to commence negotiations and the Council of the EU’s approval of the negotiation framework on June 21, 2024.

This is an important political and economic event that shapes new prospects for Ukrainian businesses.

Ukrainian enterprises are already working with European partners, using international platforms, exporting products, and participating in cross-border production chains.

However, deepening integration will gradually increase the importance of compliance with European information management requirements. This is not just about personal data.

For industrial and commercial companies, product traceability, supplier directory authenticity, transaction documentation, information security, access control, and the ability to confirm the origin of critical indicators become important.

For example, a European partner may require confirmation of product characteristics, information about suppliers, the history of changes to technical documents, or details about cybersecurity measures.

Meeting such requirements becomes significantly more complex if corporate data is distributed across dozens of incompatible systems.

The situation becomes particularly problematic when the same counterparty has different identifiers in ERP, CRM, accounting systems, and electronic document management.

Therefore, European integration creates an additional incentive for systematic Data Governance. At the same time, it is important to distinguish between current legal requirements and future legislative harmonization.

The start of accession negotiations does not mean that all EU legislation automatically became mandatory for every Ukrainian enterprise on June 25, 2024. Certain provisions, particularly GDPR, may already apply to certain operations of Ukrainian companies due to the territorial scope of the relevant regulation.

Other requirements may arise from operating in a specific EU country, industry regulation, or contractual obligations to partners.

This demarcation must be considered when forming the corporate IT strategy.

2. Data Governance as a System of Corporate Responsibility

Data Governance is often perceived as a set of access rules or a metadata management software platform. However, its main function is to formalize responsibility for corporate information.

In a large enterprise, data is created and used by various departments. The commercial department works with clients. The financial department works with payments and counterparties. Logistics works with warehouses and routes. Production works with nomenclature and technological operations.

The IT department ensures the technical operation of systems but cannot always independently determine the correctness of business content.

Therefore, a management model is needed in which each critical information resource has a defined owner.

Key Roles

The appointment of a DPO is not automatically mandatory for every company working with European partners. The necessity of such an appointment is determined by the GDPR conditions and the specific activities of the organization.

For small businesses, individual roles can be combined.

However, authority and responsibility must remain documented.

3. GDPR: when it applies to Ukrainian companies

General Data Protection Regulation — EU Regulation 2016/679 — has been in effect since May 25, 2018. It establishes rules for personal data processing, the rights of individuals, and the obligations of controllers and processors.

For Ukrainian enterprises, the territorial scope of GDPR is of fundamental importance. According to Article 3, the regulation may apply not only to organizations registered in the EU.

It may also cover certain data processing by organizations outside the EU if it relates to offering goods or services to individuals in the EU, or monitoring their behavior within the EU.

However, the mere presence of a European client or the availability of a website from the EU does not always automatically mean that all GDPR provisions apply.

The nature of the activity and the specific data processing must be evaluated.

Examples

The last example is particularly important. Cooperation with an EU company does not make all information about such a company personal data.

However, contact information of employees, personal email addresses, and data of authorized persons may be personal data.

Therefore, the corporate system must be able to distinguish between categories of information.

4. Classification of Corporate Data

The first technical step towards compliance with information protection requirements is data classification. Not all corporate data requires the same level of protection.

For example, a public product catalog has different requirements than personal employee data or confidential technical documentation.

It is advisable to create a multi-level classification system.

Example Corporate Policy

This is a conditional classification for an enterprise, not a universal legal scale. A single information system may contain multiple data categories.

For example, an ERP system stores a company’s financial information, employee personal data, and counterparty contact details.

Therefore, it is desirable to organize access control not only at the system level but also according to information categories and user functions.

5. Data Catalog: The enterprise must know what data it has

It is impossible to effectively manage information if the organization does not have an up-to-date list of its resources. In large corporate systems, data can be stored in ERP, CRM, DWH, file archives, mail systems, cloud services, and local departmental databases.

Therefore, it is advisable to create a Data Catalog. It should contain more than just table names.

For critical datasets, it is desirable to store:

• business description;
• owner;
• source system;
• information category;
• the purpose of processing;
• the legal basis for personal data, where applicable;
• storage location;
• retention period;
• access rules;
• dependent information products;
• quality requirements.

Logical Architecture of Data Governance

• ERP
• CRM
• DWH
• DMS

Data Catalog and Metadata Management

Classification · Owners · Description · Location · Retention Periods

• Data Quality
• Data Lineage
• Access Control

Governance and Audit

Policies · Responsibility · Proof of Execution · Change Control

It is important that the Data Catalog does not necessarily contain copies of all data. Its main purpose is to describe information resources and to enable their discovery and management.

6. Data Lineage: Proof of Information Origin

For European partners and regulatory checks, not only the value of the indicator but also the ability to establish its origin may be important. For example, an enterprise generates a report on product characteristics.

The indicator can be sourced from a production system, undergo transformation in ETL, be reconciled with the MDM directory, and be published via the corporate portal.

If the source formula or directory changes, the enterprise must understand which reports will be affected.

This is a Data Lineage task.

Example of an information chain

• Primary production records
• ETL: verification and transformation
• MDM: directories and identifiers
• Data Warehouse: reconciled indicators
• Report for partner or audit

Data Lineage is not sufficient proof of legal compliance. However, it helps document information transformations and makes results reproducible.

This is particularly important for complex reports generated from multiple corporate sources.

7. MDM for International Supply Chains

Master Data Management is practically relevant for Ukrainian manufacturing companies working with European partners.

For example, one supplier might use different names and codes in the Ukrainian ERP, an international procurement system, and the accounting platform of a European client.

Without a harmonized reference data, duplicates, matching errors, and traceability issues arise.

MDM allows for the creation of unified identification rules.

Critical Reference Data

It is especially important to maintain change history. For example, a change in the legal name of a counterparty should not automatically change historical documents without proper business and legal grounds.

For international cooperation, it is also useful to support alternative identifiers. One corporate object can have an internal ERP code, a partner code, and an external industry identifier.

MDM must control the correspondence between them.

8. GDPR: principles of minimization and storage limitation

For systems subject to GDPR, the principles established in Article 5 are important.

These include lawfulness, fairness and transparency of processing, purpose limitation, data minimisation, accuracy, storage limitation, integrity, and confidentiality.

For corporate architecture, these principles have practical implications.

For example, if a CRM is used to manage customer contacts, it is advisable to determine which personal data are truly necessary. Unlimited copying of full customer profiles to analytical systems may be unjustified.

In many cases, aggregated or pseudonymized information is sufficient for a DWH.

It is important to remember that pseudonymization does not necessarily remove data from the scope of GDPR. If an individual can be re-identified using additional information, the data remain personal.

Principles and Technical Implementation

Legislative requirements for storing financial, labor, and other documents must also be considered.

The personal data deletion rule should not be applied mechanically without analyzing other legal obligations.

9. Data Retention: Information Lifecycle

For large enterprises, managing data retention periods is particularly complex. ERP can contain operation history for many years. CRM stores customer contacts who no longer cooperate with the company. DWH stores copies of information that has been deleted from operational systems.

Without a centralized policy, there is a risk that data will remain in archives indefinitely.

Therefore, a Data Retention system needs to be created.

For each information category, the following are defined:

1. Purpose of processing.
2. Responsible person.
3. Legal or contractual basis for storage.
4. Retention period or criteria for its determination.
5. Archiving conditions.
6. Deletion or anonymization procedure.
7. Backup processing procedure.

Example Registry

CREATE TABLE data_retention_policy (
    policy_id BIGSERIAL PRIMARY KEY,
    dataset_name VARCHAR(150) NOT NULL,
    data_category VARCHAR(100) NOT NULL,
    owner_department VARCHAR(100) NOT NULL,
    retention_days INTEGER,
    legal_basis TEXT,
    deletion_method VARCHAR(100),
    policy_status VARCHAR(30) NOT NULL
);

This table is an example of an information model.

It does not automatically implement legal compliance or secure deletion.

In a real architecture, dependencies between systems, archives, backups, and potential legal restrictions must be considered. For example, deleting information from a CRM does not necessarily mean it is deleted from the DWH.

Therefore, the procedure must cover all relevant information resources.

10. Access Management and Zero Trust

For international cooperation, information security becomes a crucial component of trust.

Organizations must control who has access to sensitive data, what actions are permitted, and how administrative operations are logged.

Protection of privileged accounts is particularly important. For example, an ETL administrator should not automatically have the right to change backup policies or delete corporate archives.

For critical systems, it is advisable to use:

• multi-factor authentication;
• the principle of least privilege;
• separate service accounts;
• network segmentation;
• access auditing;
• regular review of permissions;
• configuration control;
• encryption of relevant data.

Zero Trust is an architectural approach in which access is determined based on verification of identity, context, and policies, rather than solely on network location.

This is particularly relevant for Ukrainian enterprises with distributed teams.

11. NIS2, DORA, and the AI Act: What’s Relevant in June 2024

European digital regulation is evolving rapidly, but for a correct corporate strategy, it’s essential to distinguish between requirements already in effect, adopted acts with future application dates, and documents still undergoing the legislative process.

Regulatory Landscape as of June 28, 2024

It is important to note that NIS2 is a directive requiring implementation by member states, and its applicability depends on whether a specific organization is in scope.

DORA has a specialized scope, primarily for the financial sector and designated ICT service providers.

As of June 28, 2024, the EU AI Act should not yet be described as a fully effective and applicable regulation: its final publication in the Official Journal of the EU will occur later.

For Ukrainian companies, these documents may be relevant due to activities in relevant markets, contractual obligations, or the future approximation of legislation.

However, not all of these acts can be automatically considered directly binding for every enterprise registered in Ukraine.

12. Data Quality for European Cooperation

European partners may have high requirements for the reliability of corporate information. For example, a manufacturer must confirm product characteristics, delivery times, compliance with technical specifications, and the origin of certain components.

If information is stored in different systems without unified directories, preparing such confirmations requires significant manual effort.

Data Quality helps ensure consistency.

Key Dimensions

It is especially important not to confuse technical verification with legal compliance.

For example, a database may contain all the necessary fields about a product, but this does not mean that the product complies with the requirements of a specific European directive or standard.

The IT system ensures the preservation, control, and traceability of evidence.

The compliance itself is determined by competent specialists in the relevant subject area.

13. Practical Example: Ukrainian Manufacturer and European Partner

Let’s consider a hypothetical Ukrainian company that produces industrial components and plans to expand sales in the EU market.

The company uses ERP, CRM, EDM, and a corporate DWH.

Counterparty information is partially duplicated between systems.

Product technical specifications are stored in separate file directories.

Production batch data is transferred to ERP but lacks a full link to quality control documents.

Stage 1. Inventory

A catalog of critical information resources is created.

Personal, commercial, and technical data are defined separately.

Stage 2. MDM

Counterparties, nomenclature, production sites, and batch identifiers are brought into a consistent model.

Stage 3. Document Flow

Technical documents receive version control and a link to specific products and batches.

Stage 4. Data Lineage

A lineage map of key performance indicators for partner reporting is generated.

Stage 5. Personal Data Protection

The company identifies which operations may fall under GDPR and reviews legal grounds, contracts, and protection mechanisms.

Stage 6. Access Control

Rules for accessing confidential technical and commercial resources are implemented.

Stage 7. Data Quality

Checks for mandatory attributes, directory consistency, and completeness of batch information are automated.

Stage 8. Audit

The company verifies the ability to reproduce the information chain from the production record to the document transferred to the partner.

The result should not be just a new set of reports, but a controlled information architecture capable of supporting international cooperation.

This is a hypothetical example, not a description of a real client project.

14. 120-Day Data Governance Roadmap

Implementation should preferably begin with information resources used in international operations or containing the most critical data.

Deploying full-fledged Data Governance for all systems simultaneously can create an excessive burden on the team.

Therefore, it is advisable to use a phased approach.

15. Corporate Data Management KPIs

It is especially important that KPIs do not create an illusion of compliance.

For example, the existence of a data protection policy does not prove that all information processes actually comply with its requirements.

Therefore, regular checks and documentation of results are necessary.

16. Risks and Common Mistakes

Equating Data Governance with the acquisition of a software product. Without responsibility and procedures, a data catalog does not ensure management.

Automatic application of GDPR to all company information. It is necessary to define the specific scope of application.

Undefined data owners. The IT department cannot be solely responsible for the entire business content of information.

Lack of MDM. Duplicates of counterparties and products complicate international operations.

Insufficient control of Data Lineage. Without known origin, it is difficult to confirm metrics.

Excessive storage of personal data. Information must be used in accordance with defined purposes and grounds.

Mechanical deletion. Retention policies must consider other legal obligations.

Excessive rights of integration services. Compromise of one component can grant access to many systems.

Confusion between audit and compliance. The presence of logs does not guarantee the legality of operations.

Ignoring contractual requirements. Partners may establish specific requirements for information exchange and protection within the framework of applicable law.

17. Intecracy Group Competencies

Data Governance for international cooperation requires a combination of data management, system integration, document management, and robust infrastructure.

Data Management IG (dmig.com.ua) specializes in ETL, MDM, Data Quality, Data Warehouse, Data Lake, Data Governance, and corporate analytics. These competencies are directly related to information catalogs, reference data harmonization, data lineage control, and ensuring the quality of corporate reporting.

IQusion IT (iqusion.com) represents system integration, electronic document management, BPM, and business process automation. Relevant technologies can be used to formalize approval procedures, manage documents, process requests, and ensure the reproducibility of information operations.

Softline IT (softline.kiev.ua) specializes in server and network infrastructure, storage systems, and infrastructure projects. These competencies are important for ensuring the availability, protection, and reliability of corporate information resources.

SL Global Service (sgs4business.com) operates in the areas of cloud integration, virtualization, and hybrid infrastructure. Such technologies allow for the controlled placement of corporate systems, backup, and integration of distributed environments.

Taken together, these competencies can support the construction of an information architecture that ensures the transparency and controllability of corporate data.

At the same time, issues of legal interpretation of GDPR and other European legislation must be resolved with the involvement of relevant legal professionals.

European integration requires mature corporate data governance

The commencement of negotiations for Ukraine’s accession to the European Union is a significant stage in the country’s economic and institutional development.

For Ukrainian businesses, it creates new opportunities, but at the same time, it enhances the importance of transparency, information security, and the quality of corporate processes.

Enterprises aiming to expand cooperation with European partners must pay attention not only to product characteristics or service costs.

The ability to document operations, confirm information origin, ensure version control, and respond to reasonable requests from partners and auditors becomes crucial.

This requires a systemic Data Governance model.

It should define corporate data owners, rules for their use, and responsibility for quality.

MDM ensures the consistency of identifiers and reference data.

Data Quality allows for control over the completeness, accuracy, and compliance of information with defined rules.

Data Lineage helps establish the origin of metrics and dependencies between information systems.

Electronic document management ensures control over documents, versions, and approval history.

Infrastructure and cloud technologies form the basis for secure storage and access.

The differentiation of various legal regimes is of particular importance.

Not all corporate information is personal data, and the start of negotiations on Ukraine’s accession to the EU does not mean the automatic application of all European norms to every Ukrainian organization.

However, enterprises must understand which requirements already apply to their activities and which may become relevant in the process of developing international cooperation.

Therefore, preparation for the European market should not be a one-time campaign, but a consistent program for increasing the maturity of corporate information management.

The main conclusion of June 2024: data quality, transparency, and traceability are gradually becoming not only an internal advantage for an enterprise but also an important factor of trust in international economic relations.

For the Data Management IG, this means expanding the scope of traditional data management competencies.

ETL, MDM, Data Warehouse, and Data Quality must ensure not only analytical efficiency but also the possibility of controlled, secure, and documented use of corporate information.

It is precisely such an architecture that creates the foundation for long-term cooperation between Ukrainian enterprises and European partners.