CompTIA Data+ DA0-002 · Free study guide

Domain 5 — Data Governance (14%)

Governance has the smallest published weight at 14%, but it spans four broad objectives: data management (5.1), compliance (5.2), privacy and protection (5.3), and quality assurance (5.4). This supplemental review reinforces classification, access, life-cycle, quality, and responsible-use concepts; use the four objective lessons for the complete V2 checklist.

Sensitive data classes and their regulations

Be able to recognize three data classes and the regimes that govern them:

PII — personally identifiable information. Anything that can identify a specific individual: names, home addresses, dates of birth, email addresses, government IDs. A marketing dataset with those fields is PII, not "open data," and it demands protective handling regardless of which specific law applies.

GDPR. The EU's General Data Protection Regulation has important extraterritorial reach: it can apply to an organization outside the EU when the regulation's territorial-scope conditions are met, including certain offers of goods or services to people in the EU or monitoring their behavior. It does not apply merely because any EU resident's data happens to appear in a system. Core principles worth knowing include lawful basis for processing, data minimization, purpose limitation, and individual rights.

PHI and HIPAA. Individually identifiable health information — diagnoses, treatment codes, visit dates — held by covered entities in the U.S. and their business associates can be protected health information under HIPAA. First determine whether the organization and data relationship are in scope; not every health-related fact held by every organization is PHI.

PCI DSS. The card networks' security standard for payment card data. Its analytics-relevant rule: minimize where cardholder data lives and render the primary account number unreadable wherever stored. When a reporting team requests the orders table with full card numbers, the answer is truncated or tokenized values — trend analysis needs amounts and dates, never full PANs. Merchants are in scope, not just banks.

Classification and access control

Data classification assigns sensitivity tiers — Public, Internal, Confidential, Restricted — so handling controls can match risk. It is the prerequisite for everything else: you cannot protect what you have not classified.

Access follows two paired principles. Role-based access control (RBAC) grants permissions through defined roles rather than individual grants; least privilege limits each role to exactly what the job requires. The new finance analyst who receives precisely the finance-analyst role's permissions illustrates both at once.

Encryption has two states, and requirements naming both need both controls: encryption at rest protects stored data; TLS in transit protects data crossing networks. A firewall is not storage encryption, and renaming sensitive columns is security theater — recognizably a distractor.

Data masking can reduce exposure in displays or non-production copies by obscuring or substituting sensitive values while preserving selected format or behavior. Static masking changes a copied data set; dynamic masking changes what a viewer sees. Masking is not automatically anonymization: a reversible mapping, retained identifiers, or distinctive combinations may still permit re-identification. Test data must meet the organization's approved risk and privacy requirements, not merely look fictional.

The data life cycle

Data is created, stored, used, shared, archived, and destroyed, and governance attaches rules to every stage. Two stages deserve particular attention:

Retention. A retention schedule defines how long each data type is kept and what normally happens when the period ends. Seven years of support recordings under a two-year maximum may be a failed retention control. Approved legal holds, investigations, or other obligations can suspend normal disposal, so exceptions must be documented and lifted through the governed process. Unnecessary over-retention expands breach exposure and can conflict with minimization requirements.

Destruction. Ordinary deletion removes references, not data; deleted files are routinely recoverable. Defensible disposal of media that held confidential data requires sanitization: cryptographic erasure, secure overwriting, or physical destruction. Quick-formatting a drive or selling the server intact transfers the breach, not the responsibility.

Data management and quality assurance

An authoritative source of truth identifies the approved source for a specific fact or metric. A data flow diagram shows movement among sources, processes, stores, and consumers; lineage traces provenance and dependencies; and a data dictionary defines fields, types, units, allowed values, grain, owners, sensitivity, and calculation rules. Snapshots, versions, refresh intervals, metadata ownership, and change control make a result reproducible after systems and definitions change.

Quality assurance is a continuing system rather than a one-time cleanup:

• Requirement testing checks measurable business and technical acceptance criteria.
• Unit testing checks one transformation or calculation with controlled inputs and expected outputs.
• User-acceptance testing asks representative users to validate the real workflow against documented criteria.
• Stress testing evaluates behavior near or beyond expected volume, concurrency, latency, or resource limits.

Source control records code, queries, tests, schema, configuration, and review history. Reproducibility also needs dependency, environment, parameter, and source-data versions; code alone is not enough.

Health checks and profiling measure freshness, row counts, schemas, nulls, uniqueness, referential integrity, ranges, patterns, distributions, and source reconciliation. Drift detection compares current composition or behavior with an appropriate baseline. Drift is a signal to investigate, not proof of bad data. Automated monitoring needs a threshold, severity, owner, evidence, and response runbook.

Useful quality metrics include accuracy, completeness, consistency, timeliness, validity, and uniqueness. Each needs a scope, denominator, threshold, owner, and response. ISO-aligned practices emphasize documented responsibility, controlled process, evidence, corrective action, and continuous improvement; alignment or certification does not guarantee that every value is accurate.

Responsible AI

As a cross-domain connection to objective 1.5, governance also matters at the model layer. A risk-based review should document data sources, intended use, known limitations, validation, and accountable owners. Where a model can affect people, relevant fairness and error analysis across appropriate groups can help identify disparate outcomes, subject to the use case, law, and approved review process. No review guarantees an error-free model. Apply the verification discipline taught in Domain 1: check AI-assisted outputs against authoritative evidence and retain human accountability for deployment decisions.

What to drill

Use the four objective lessons as the checklist. For 5.1, connect authoritative sources, flows, lineage, dictionaries, hierarchies, snapshots, versions, refreshes, metadata, and change control. For 5.2, apply retention, legal holds, replication, storage, jurisdiction, GDPR, PCI DSS, classification, ethics, audits, and incident reporting. For 5.3, compare RBAC, least privilege, encryption, approved sharing, PII/PHI handling, NIST guidance, anonymization, pseudonymization, tokenization, and masking. For 5.4, choose the correct test, versioning evidence, health check, drift analysis, profile, alert, metric, and ISO-aligned quality practice.