Mastering Data Governance and Avoiding Pitfalls in Startups
In the fast-moving startup world, prioritising data governance may
not seem all that crucial until your user base starts to grow. Then,
the amount of data you have to manage increases and your
databases fill up with valuable information. At this juncture,
compliance with regulations and implementing robust backup
strategies become imperative. The question of how to smoothly
transition from building a MVP (minimum viable product) to scaling
your business, all whilst avoiding costly data-related errors along
the way becomes front of mind!
1. Understand the Rules and Regulations
It is essential to ensure that everyone in your team knows the data
protection laws that pertain to your business. In the UK, the main
ones to be aware of are the GDPR (General Data Protection Regulation) and the Data Protection Act.
There may also be some industry specific regulations that your
suppliers or partners may require you to meet such as PCI DSS for
handling card payments. Therefore being aware of what these are
and making sure that compliance with them is a top priority is really
important.
2. Respect Customer Data
Consider how users want their data to be treated and respect their wishes. There are certainly legal requirements, rules and
regulations that you need to follow but don’t restrict yourself to
these only. Your customers will be deeply disappointed if these are
the only things you consider.
Make sure that you don’t abuse their data even if they may have
given you permission to do so knowingly or not e.g. if the request
for permission is buried deep in a privacy policy that they probably
didn’t read thoroughly!
3. Make Sure that Production Data is kept Safe
Often in startups, you need to build a prototype and this will involve
creating and destroying development databases dozens of times a
day. You will need to create a database, fill it with data, test your
product or application against it and then destroy it and in order to
make this an efficient process you will most likely have tools to help
do this with a single command.
Make sure that you don’t accidentally wipe out your production
database by mistake or let any developer who has access to it read
private user data, abuse it or leak it. Although it may sound obvious,
it is all too easy to do and so here are a few ideas to help make
sure this doesn’t happen:
– Make sure that all production instances of the application have a
‘safety interlock’ i.e. a flag in the configuration that makes it clear
that it is a production instance and thus disables all potentially
dangerous commands intended for development and testing.
– Use a managed process e.g. Github Actions to help with
deployments so that developers don’t need to log into the
production system.
– Try to keep developers out of the production system when
diagnosing bugs i.e. set up a logging system and other
instrumentation within your app or tool. Include easy to
understand outputs for developers to diagnose issues more
easily.
– When somebody does need to log into the production system to
investigate something further, do this with another colleague i.e.
team up and work through it as a pair so that you can find
mistakes more easily and hold each other accountable for the
data and how it gets used.
– Make sure you have regular, automatic, tested and securely
stored backups of all your production databases. This may seem
obvious but it is easy to get complacent and to forget about the
downtime and impact when needing to restore a database so
make sure this is optimised as much as possible.
4. Be Prepared for a Culture Shock
Transitioning from development prototypes with simulated test data
to a production environment managing real user data is a big
change.From a technical perspective, production is merely another
instance, especially when utilising cloud infrastructure. However,
the distinction becomes far more pronounced when considering the
legal and business significance of the data between development
and production.
Prior to launching your product and granting external access to your
production instance, it is critical to talk to all stakeholders involved
and to discuss the new production data requirements and establish
a way to secure and protect it properly. Making sure that you have
these important discussions will ensure that you create a plan to
avoid any potential issues, whilst also laying down the groundwork
for the cultural shift needed to introduce your product into the real
world!
That completes our overview of the most common data governance
challenges that most startups will face.