Register: Data Governance Role Assignment

This is a ready-to-use register that maps each GxP data set to a system and to a named owner, steward, and custodian. Abstract role definitions do not survive contact with an inspector; a concrete register that answers “who owns this data” on the spot does. Keep it under change control and review it at every governance board meeting, because people move and the mapping decays in months if untended. Replace every <<FILL: ...>> placeholder. A filled specimen follows.

Control header

Field	Entry
Document title	Data Governance Role Assignment Register
Document number	`<<FILL: DOC-ID>>`
Version	`<<FILL: version>>`
Effective date	`<<FILL: date>>`
Owner of this register	`<<FILL: role, e.g. Data Integrity SME>>`
Last governance board review	`<<FILL: date>>`

Register

Data set	Primary system	Criticality	Data owner (role)	Data steward (role)	Data custodian (role)	Owner acceptance on file	Segregation confirmed
`<<FILL>>`	`<<FILL>>`	`<<FILL: H/M/L>>`	`<<FILL>>`	`<<FILL>>`	`<<FILL>>`	`<<FILL: Y/N + date>>`	`<<FILL: Y/N>>`
`<<FILL>>`	`<<FILL>>`	`<<FILL>>`	`<<FILL>>`	`<<FILL>>`	`<<FILL>>`	`<<FILL>>`	`<<FILL>>`
`<<FILL>>`	`<<FILL>>`	`<<FILL>>`	`<<FILL>>`	`<<FILL>>`	`<<FILL>>`	`<<FILL>>`	`<<FILL>>`

Field definitions

Field	Format	Required	Who maintains	When
Data set	text	Yes	Register owner	At entry and on change
Primary system	text (system / ID)	Yes	Register owner	At entry
Criticality	H / M / L	Yes	Data owner	At criticality assessment
Data owner	business or quality role	Yes	Governance board	At assignment
Data steward	operational role	Yes	Data owner	At assignment
Data custodian	IT or vendor role	Yes	IT / owner	At assignment
Owner acceptance on file	Y/N + date	Yes	Governance / QA	At acceptance
Segregation confirmed	Y/N	Yes	QA / DI SME	At review

Acceptance criteria for the register

Every GxP system in the validated system inventory appears at least once.
Every row has all three roles filled with a real role title, never “TBD.”
The owner is always a business or quality role, never “IT”; the custodian is the only column where an external vendor appears.
No person sits as both custodian admin and approver of their own access or data changes on the same system (segregation confirmed).
Owner acceptance is on file for every high-criticality data set, and the register is under change control and reviewed at governance board cadence.

Filled specimen

Data set	Primary system	Criticality	Data owner	Data steward	Data custodian	Owner acceptance	Segregation
Chromatography raw data and results	CDS category	H	Head of QC	QC systems specialist	IT application admin	Y, 01 Jul 2026	Y
Batch manufacturing records	MES / EBR	H	Head of Manufacturing	MES super-user	IT / MES platform team	Y, 28 Jun 2026	Y
Stability data	LIMS + stability module	H	Stability program lead	LIMS data steward	IT application admin	Y, 25 Jun 2026	Y
Deviations, CAPA, change control	QMS category	M	Head of QA	QMS administrator (business)	IT / SaaS vendor	Y, 20 Jun 2026	Y
Clinical trial data	EDC / CTMS	H	Head of Clinical Data Management	Clinical data manager	EDC vendor (hosted)	Y, 30 Jun 2026	Y

In this specimen every owner is a named business role, the only external parties sit in the custodian column, and each high-criticality data set has a dated owner acceptance and a confirmed segregation of duties. When the inspector asks who owns the chromatography data, the site opens this register and points to the head of QC, the steward, and the custodian, then produces the signed acceptance form.

Common inspection findings this register prevents

Asked who owns a data set, three people give three answers, or none can name an owner.
A high-criticality system has no assigned steward, so audit trail review falls to no one or to the person who created the data.
A hosted system’s custodian is a vendor with no owner acceptance and no segregation check recorded.
The register exists but is a year stale, listing leavers as owners and stewards.

How to adapt this register

Seed it from your validated system inventory so every GxP system appears.
Assign and ratify roles through the governance board, and record owner acceptance dates from the acceptance form.
Confirm segregation of duties for each system before marking the column Y.
Put the register under change control and review it at every governance board meeting.
Cross-reference it with the data governance RACI so activity-level responsibilities line up with the named roles.