CompTIA Data+ · Domain 5 of 5

CompTIA Data+ Domain 5: Data Governance

The rules and checks that make data trustworthy and lawful to use: documented definitions, compliance obligations, privacy controls and the testing that proves data quality before and after release.

Exam weight
14%
Official objectives
4
Estimated questions estimate
~13
Suggested study time estimate
10–15 hrs

About 17 min read Reviewed October 2026

Overview

Data Governance covers how an organization manages, protects and assures its data over time. Objective 5.1 explains data management concepts: integration, documentation, a single source of truth, data versioning and metadata. Objective 5.2 summarizes compliance: retention, the General Data Protection Regulation (GDPR), jurisdictional requirements, replication and storage location, data ethics, the Payment Card Industry Data Security Standard (PCI DSS), audit, classification and incident reporting. Objective 5.3 compares privacy and protection practices such as role-based access control, encryption, usage and sharing rules, NIST guidance, PII and PHI handling, anonymization and masking. Objective 5.4 compares quality assurance practices, from unit tests and UAT to data profiling and automated monitoring.

The domain exists because analysts handle regulated and business-critical data every day. It governs the sources from Domain 1, formalizes Domain 2's quality checks and limits what Domains 3 and 4 may share.

How it's tested

Items in this domain are mostly explain, summarize and compare-and-contrast questions wrapped in short scenarios. A stem describes data, a regulation, a user need or a testing stage, and you choose the concept, control or practice that fits. Two options often both sound protective or both sound like testing; the deciding clue is who needs to see what, or at what stage the check runs.

  • Pick the protection control

    A data element and a business need are described, such as agents verifying the last four card digits, and you choose masking, anonymization, encryption or role-based access control.

  • Identify the compliance concept

    A situation involving retention periods, cross-border replication, card data or a breach is described and you name the requirement, such as GDPR, PCI DSS, jurisdictional rules or incident reporting.

  • Match the quality practice to the stage

    A point in the data or report lifecycle is described and you choose unit testing, requirement testing, stress testing, UAT, source control, a health check, profiling or automated monitoring.

Reasoning it through

A team wants to publish a research data set built from patient records so outside academics can study treatment outcomes, with no way to identify any patient. Options include masking, encryption, role-based access control and anonymization. Outsiders get the data, so access control cannot protect it, and encryption or masking can be reversed or still leak identity. Irreversible anonymization fits the requirement.

Objectives 4

Official objectives from the CompTIA outline, in outline order.

5.1 Explain data management concepts.Integration, documentation, source of truth, data versioning and metadata.
What it means
Data management keeps data consistent and understandable across systems through integration, documentation such as data dictionaries and process notes, an agreed source of truth for each data element, versioning of data sets and definitions, and metadata that describes data's meaning, structure, origin and lineage.
What to understand
A source of truth is the one authoritative system for a data element, such as the HR system for job titles; other copies must reconcile to it. Metadata includes technical details (types, sizes, table names), business definitions (what 'active customer' means) and operational details (load times, lineage). Documentation and versioning let others reproduce a result and know which definition was in force.
How it shows up
A scenario shows two reports disagreeing on the same metric, and you identify the missing source of truth, data dictionary or version control as the fix.
Common confusion
Treating metadata as only technical schema details and forgetting business definitions and lineage.
5.2 Summarize concepts related to data compliance.Retention, GDPR, jurisdiction, replication, storage, ethics, PCI DSS, audit, classification, incident reporting.
What it means
Compliance concepts include how long data is kept and when it is destroyed (retention), the EU GDPR, jurisdictional requirements on where data may reside, how replication and storage location affect those rules, ethical use of data, PCI DSS for payment card data, audits that verify controls, classification levels and incident reporting obligations.
What to understand
GDPR applies to personal data of people in the EU wherever the processor is located, grants rights such as access and erasure, and requires notifying the supervisory authority of qualifying breaches within 72 hours. PCI DSS is an industry standard, not a law, for anyone storing, processing or transmitting cardholder data. Replicating data to another region can breach residency rules even if the primary copy is compliant.
How it shows up
A stem describes a retention request, a backup region, a card-data workflow or a breach, and you identify the concept or obligation it triggers.
Common confusion
Calling PCI DSS a government regulation, or assuming GDPR applies only to companies based in the EU.
5.3 Compare and contrast data privacy and protection practices.RBAC, encryption, usage, sharing, NIST, PII, PHI, anonymization and masking.
What it means
Privacy and protection practices include role-based access control (RBAC), encryption at rest and in transit, policies on data usage and sharing, guidance from the National Institute of Standards and Technology (NIST), handling of personally identifiable information (PII) and personal health information (PHI), and de-identification through anonymization and masking.
What to understand
RBAC grants permissions to roles, enforcing least privilege. Encryption protects data from anyone without the key, but authorized users see clear values. Masking hides part or all of a value in views, such as showing only the last four card digits, while anonymization removes identifying information so individuals cannot be re-identified, and it is meant to be irreversible.
How it shows up
A user need and a sensitive field are described, and you choose the control that allows the task while exposing the least data.
Common confusion
Treating masking and anonymization as the same, or assuming encryption prevents authorized analysts from seeing raw values.
5.4 Compare and contrast data quality assurance practices.Requirement, stress, unit and user acceptance tests; source control; health checks; monitoring; profiling; ISO.
What it means
Quality assurance practices include requirement testing, stress tests, user acceptance tests (UAT), source control, unit tests, data health checks, automated data quality monitoring, data profiling and International Organization for Standardization (ISO) standards for quality management.
What to understand
Unit tests check one transformation or calculation in isolation; requirement testing confirms the output meets documented requirements; stress tests check behavior under heavy volume or many users; UAT has business users confirm the solution works for them before release. Data profiling summarizes a data set's content and structure, a health check assesses quality at a point in time, and automated monitoring runs rules continuously and alerts on failures. Source control tracks and versions code changes.
How it shows up
A lifecycle stage or problem is described, such as business sign-off before go-live or a nightly load that silently drops rows, and you choose the matching practice.
Common confusion
Using UAT to catch calculation bugs a unit test should find, or relying on a one-time profile when ongoing monitoring is needed.

High-yield concepts

The terms, rules and formulas this domain turns into questions most often.

  • Source of truth

    A source of truth is the single authoritative system or data set for a given data element, which every report and copy should reconcile to.

    Remember
    When two reports disagree, establish which source is authoritative before fixing either report.
    Tested as
    Scenarios with conflicting figures from different systems.
    Trap
    Averaging or picking the more convenient figure instead of designating an authoritative source.

  • Metadata

    Metadata is data about data: technical metadata (types, formats, table names), business metadata (definitions, owners) and operational metadata (load times, lineage).

    Remember
    A data dictionary is a documented collection of metadata.
    Tested as
    Data management questions about documenting and understanding data.
    Trap
    Thinking metadata covers only column names and data types.

  • Data versioning

    Data versioning records distinct versions of data sets, definitions or models with identifiers and dates so results can be reproduced and compared.

    Remember
    Version the data and the definition, not just the code.
    Tested as
    Reproducibility and audit scenarios.
    Trap
    Overwriting a data set in place and losing the version a published report used.

  • Data retention

    Retention policies set how long each class of data is kept, based on legal, regulatory and business needs, and how it is disposed of afterward.

    Remember
    Keep data as long as required and no longer; over-retention increases risk and may breach privacy law.
    Tested as
    Compliance scenarios about old records and deletion requests.
    Trap
    Keeping everything indefinitely 'just in case'.

  • GDPR

    The EU General Data Protection Regulation governs processing of personal data of individuals in the EU, granting rights such as access, rectification and erasure and requiring breach notification to the supervisory authority within 72 hours of awareness where a breach poses risk.

    Remember
    Scope follows the data subject, not the company's headquarters.
    Tested as
    Compliance items with EU customers or employees.
    Trap
    Assuming a US-based company is out of scope when it processes EU residents' data.

  • PCI DSS

    The Payment Card Industry Data Security Standard is a contractual industry standard from the major card brands that sets security requirements for any entity storing, processing or transmitting cardholder data.

    Remember
    Stored card numbers must be unreadable, and sensitive authentication data such as the card verification code must not be stored after authorization.
    Tested as
    Scenarios involving payment data in analysis sets.
    Trap
    Calling PCI DSS a law, or keeping full card numbers in an analytics table.

  • Jurisdictional requirements and replication

    Laws in some countries or sectors require certain data to stay within a geographic boundary, and replication or backups to another region can move copies across that boundary.

    Remember
    Check where every copy lives, including replicas and backups.
    Tested as
    Cloud storage and disaster recovery scenarios.
    Trap
    Checking only the primary database region.

  • Data classification

    Classification assigns sensitivity levels, commonly public, internal, confidential and restricted, that determine handling, access and sharing rules.

    Remember
    Classification drives the control: higher sensitivity means tighter access, encryption and sharing limits.
    Tested as
    Questions about what may be shared with whom.
    Trap
    Applying the same controls to all data regardless of class.

  • Masking vs. anonymization

    Masking hides all or part of a value in displays or copies, such as showing only the last four digits, while anonymization removes or transforms identifiers so individuals cannot be re-identified.

    Remember
    Masking keeps a usable but partial view; anonymization is meant to be irreversible.
    Tested as
    The most common privacy compare-and-contrast item.
    Trap
    Calling data anonymized when a lookup table or combination of fields can still re-identify people.

  • Encryption

    Encryption makes data unreadable without the key, protecting it at rest on storage and in transit over networks.

    Remember
    Encryption protects against unauthorized access, not against authorized users seeing the data.
    Tested as
    Control-selection items about stolen media or intercepted traffic.
    Trap
    Choosing encryption when the requirement is to limit what authorized staff see.

  • Role-based access control (RBAC)

    RBAC assigns permissions to roles, such as analyst or finance manager, and users inherit the permissions of their roles.

    Remember
    Grant the least privilege each role needs and review role membership regularly.
    Tested as
    Who-can-see-what scenarios for reports and data sets.
    Trap
    Granting individual ad hoc permissions that are never revoked.

  • PII vs. PHI

    Personally identifiable information identifies a person, such as name, national ID number or email; personal health information is health-related data tied to an individual, such as diagnoses or treatment records.

    Remember
    PHI is a sensitive subset of personal data with stricter handling rules in many jurisdictions.
    Tested as
    Classification and protection scenarios.
    Trap
    Assuming a data set without names has no PII, when combinations like birth date and postal code can identify people.

  • Unit test vs. UAT

    A unit test checks one piece of logic, such as a transformation or measure, against expected results; user acceptance testing has business users confirm the finished solution meets their needs.

    Remember
    Unit tests are early and technical; UAT is last and done by users.
    Tested as
    Quality-practice scenarios naming who tests and when.
    Trap
    Relying on UAT to find calculation bugs.

  • Data profiling vs. automated monitoring

    Data profiling summarizes a data set's structure and content, such as null rates, distinct counts and value ranges; automated data quality monitoring runs defined rules on every load and alerts when they fail.

    Remember
    Profile to learn what the data looks like; monitor to catch it changing.
    Tested as
    Questions on catching recurring load problems.
    Trap
    Running a single profile and assuming quality stays the same afterward.

  • Source control

    Source control systems such as Git track every change to queries, scripts and report definitions, with history, authorship and the ability to roll back.

    Remember
    Source control supports peer review and recovery from bad changes.
    Tested as
    Quality assurance and versioning scenarios.
    Trap
    Storing SQL scripts in shared folders with names like final_v3_really_final.

Side by side

Concepts candidates mix up, compared on the point that decides the answer.

Masking vs. anonymization vs. encryption vs. RBAC

ConceptMeaningKey differenceCommon trap
Masking Hides all or part of a value, such as showing only the last four digits Users still work with the record but see a partial value Assuming masked data is anonymous
Anonymization Removes or transforms identifiers so people cannot be re-identified Intended to be irreversible; suits sharing outside the organization Leaving quasi-identifiers that allow re-identification
Encryption Makes data unreadable without a key Protects stored and transmitted data from unauthorized parties Expecting it to limit what authorized users see
RBAC Grants permissions by role Decides who can access data, not how values appear Using it when partial visibility of a field is needed

GDPR vs. PCI DSS

ConceptMeaningKey differenceCommon trap
GDPR EU regulation on processing personal data Law; scope follows individuals in the EU; includes data subject rights Thinking non-EU companies are exempt
PCI DSS Card industry security standard for cardholder data Contractual standard enforced by card brands and acquirers, not a statute Calling it a law or storing card verification codes

Unit test vs. requirement test vs. stress test vs. UAT

ConceptMeaningKey differenceCommon trap
Unit test Checks one function, transformation or measure Earliest, narrowest, run by developers Skipping it and finding bugs in UAT
Requirement testing Verifies output against documented requirements Traces each requirement to a test Testing only what was built, not what was asked
Stress test Runs the solution under heavy data volume or user load Tests performance limits, not correctness Assuming a fast test with sample data proves production speed
UAT Business users confirm the solution meets their needs Final sign-off before release Using it as the main bug-finding stage

Exam traps

Each trap is an answer that looks right. Learn the clue that should change your mind.

  1. Encryption for display limits

    What candidates pick
    Encrypt the card number column so support agents see less.
    Why it looks right
    Encryption is the best-known protection control.
    Why it's wrong
    Authorized users with access see decrypted values; limiting what an authorized user sees is masking.

    Clue to watch for Staff need part of a value, such as the last four digits, to do their job.

  2. Masked equals anonymous

    What candidates pick
    Share a masked customer file with an external research partner as anonymous data.
    Why it looks right
    Names and numbers are hidden.
    Why it's wrong
    Masked records may still be linked back through remaining fields or unmasked copies; external sharing without identification calls for anonymization.

    Clue to watch for External recipients and a requirement that no one can be identified.

  3. Primary region only

    What candidates pick
    Approve the design because the main database sits in the required country.
    Why it looks right
    The production data is in the right place.
    Why it's wrong
    Replicas and backups in another region still store the data abroad and can breach jurisdictional requirements.

    Clue to watch for Disaster recovery, replication or backups to another region.

  4. Keep everything forever

    What candidates pick
    Retain all historical customer data indefinitely for future analysis.
    Why it looks right
    More history seems more valuable.
    Why it's wrong
    Retention policies and privacy laws limit how long personal data may be kept; over-retention adds breach and compliance exposure.

    Clue to watch for A retention schedule, a deletion request or old personal data.

  5. UAT for calculation bugs

    What candidates pick
    Let business users find errors in the margin calculation during acceptance testing.
    Why it looks right
    Users know what the numbers should be.
    Why it's wrong
    Logic errors belong to unit testing of each calculation; UAT confirms fitness for purpose and catches far fewer defects at greater cost.

    Clue to watch for A single formula or transformation needs verifying before integration.

  6. One-time profile for ongoing loads

    What candidates pick
    Profile the data once and approve the nightly pipeline.
    Why it looks right
    The profile showed clean data.
    Why it's wrong
    Quality can change with each load; automated data quality monitoring checks every run and alerts on failures.

    Clue to watch for Recurring loads and a need to detect problems as they occur.

Answer framework

Use this sequence when a Domain 5 item asks which governance concept, control or quality practice applies.

  1. Identify the data involved and classify it: PII, PHI, cardholder data, confidential business data or public data.
  2. Name the obligation the scenario triggers, such as retention, GDPR rights, PCI DSS, jurisdictional residency, audit or incident reporting.
  3. Determine who needs what: full access, partial view, aggregated results or no identity at all.
  4. Choose the control that meets that need with the least exposure: RBAC for who, masking for partial views, encryption for stored or moving data, anonymization for identity-free sharing.
  5. Match the quality practice to the lifecycle stage: unit and requirement tests while building, stress tests and UAT before release, profiling and automated monitoring in operation.

Practice question

Call-center agents must confirm a caller's identity using the last four digits of the payment card on file, but they must never see the full card number. Which practice best meets this requirement?

Want more like this? The CompTIA Data+ practice test has questions for every domain.

Checklist

0 of 14

Tick each one you can do without notes. Your ticks stay in this browser.

Study strategy

Start with objective 5.3, because privacy controls produce the most confusable answer options. Build a four-row table for RBAC, encryption, masking and anonymization showing what each protects against and what the authorized user still sees, then write one scenario where each is the only right answer.

Next, cover objective 5.4 by mapping each quality practice to a stage of a pipeline you know: unit tests when writing a transformation, requirement testing against the specification, stress tests with production-scale volume, UAT before release, then profiling, health checks and automated monitoring in operation, with source control throughout.

Then study objective 5.2. Candidates underestimate it because regulations sound like legal reading, but the exam stays at the summary level: who GDPR protects and what it requires, what PCI DSS covers, how replication affects residency, and why retention, classification, audits and incident reporting exist. Finish with objective 5.1, linking source of truth, metadata, documentation and versioning to the report disagreements you have seen in Domains 3 and 4.

Afterward, practice compare-and-contrast questions and, for each miss, write the one clue that separated the two closest options.

FAQ

How much of DA0-002 is Data Governance?

CompTIA weights it at 14%, the smallest of the five domains. CompTIA does not publish how many questions come from each domain.

Do I need to memorize GDPR articles or PCI DSS requirement numbers?

The objective asks you to summarize compliance concepts, so focus on scope, purpose and key obligations, such as GDPR data subject rights and breach notification and PCI DSS protection of cardholder data, rather than article or requirement numbers.

What is the difference between masking and anonymization?

Masking hides part or all of a value while the record stays usable, such as showing the last four card digits. Anonymization removes identifying information so people cannot be re-identified, which suits sharing data externally.

Why are NIST and ISO in the objectives?

They are standards bodies whose frameworks shape privacy, security and quality practice. Know them as sources of recognized guidance rather than memorizing specific control catalogs.

Is the smallest domain safe to skip?

No. Governance concepts also decide answers in other domains, such as what an external report may show or whether raw identifiers may be loaded, so skipping it costs points beyond its 14%.

What is the difference between data profiling and automated data quality monitoring?

Profiling summarizes a data set's structure and content to understand it, usually at a point in time. Automated monitoring runs quality rules on every load and alerts when they fail.

How does this domain connect to Data Acquisition and Preparation?

Domain 2 finds and fixes problems in a specific data set; Domain 5 makes quality checks repeatable and decides which data may be collected, stored and moved.

Other Data & Analytics certifications

Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.

Test your Domain 5 knowledge

You have just compared privacy controls, compliance concepts and quality assurance practices. See whether you can separate the two closest options when a scenario names who needs to see what.

Take the CompTIA Data+ practice test Check your CompTIA Data+ readiness

Keep going