Data OwnerResponsibility and Governance for Master Data in Procurement
Procurement glossary · Updated · 9 min read
Also known as: Data Owner, Dateneigentümer, Datenverantwortlicher, Data Governance Owner, Business Data Owner
Short answer
- A data owner is the person or function that bears business-level responsibility for a data set such as supplier or material master data.
- They define quality standards, maintenance processes and release rules, and decide on authorisations, consolidations and the data lifecycle.
- Operational maintenance is carried out by the data steward; the data owner monitors compliance and is accountable for quality and consistency.
The data owner is the clearly named person or function that bears business-level responsibility for a data set – in particular supplier and material master data in the procurement environment. They set the rules, decide on releases and changes, and are accountable for the consistency, completeness and quality of the data throughout its entire lifecycle. The data owner is to be distinguished from the data steward, who implements and maintains the requirements operationally. In industrial organisations, the role is a central building block of data governance and has a direct impact on procurement, logistics and compliance.
Key facts
- The data owner bears the business-level and conceptual responsibility for a defined data set, such as material or supplier master data.
- They decide on authorisations, releases, quality standards and the data lifecycle.
- Distinct from the data owner are the data steward (operational and technical maintenance) and the data custodian (technical provisioning).
- In procurement, the role primarily concerns supplier, material, contract and price data as well as interfaces to e-procurement systems.
- Good data ownership typically reduces error rates in order processes, misdeliveries and duplicate structures in the supplier base.
- The role should be documented in a role and responsibility matrix and equipped with authority for consolidations.
Contents
- Definition: data owner
- Methods and approach for establishing data ownership
- Key KPIs for controlling data quality
- Risks and controls in dealing with data ownership
- Data owner in interplay with procurement processes and systems
- Current developments: AI, data catalogues and sustainability-related data
- Typical metrics
- Practical example
- Conclusion
- Frequently asked questions
Definition: data owner
The data owner is the body responsible for a data set – in the procurement context usually a function such as supplier management, category management or master data organisation. They define which attributes are maintained and according to which rules data is created, changed, released or archived. The role is conceptual and business-level, not necessarily technical: the data owner does not have to maintain the data themselves, but must ensure its quality.
Distinction from data steward and data custodian
In practice, a three-way split has proven effective. The data owner bears the business-level responsibility and decides on standards, releases and escalated conflicts. The data steward takes on operational maintenance: checking, enriching, cleansing, monitoring quality rules. The data custodian (e.g. IT) provides technical availability, backup and access security. This separation prevents responsibility from 'falling between the cracks' and creates clear escalation paths for data conflicts.
Data owner in the procurement context
In procurement, ownership typically covers supplier master data (addresses, certificates, credit and risk indicators), material master data (numbers, units of measure, classification, description syntax), purchasing info records with prices and conditions, and contract and framework agreement data. These data pools have a direct impact on order management, goods receipt lead times and delivery reliability: errors in the material master trigger queries, returns and duplicate orders. Ownership should therefore be closely coupled with category responsibility, for example via a category board as the governing body.
Methods and approach for establishing data ownership
Data ownership does not arise from appointment alone, but from a structured approach: defining data domains, assigning responsibilities, setting rules and quality criteria, and monitoring implementation measurably. A role and responsibility matrix (frequently in RACI format) documents who decides, who implements, who is consulted and who is informed.
Data domains and responsibility matrix
First, data domains are carved out – for example suppliers, materials, contracts, certificates. A data owner is appointed per domain; in practice, this is often the head of supplier management for supplier data and category managers for material and conditions data. The matrix governs decision-making authority: who may create, block or consolidate a supplier? Who releases new material numbers? Clear delineations prevent the typical grey zone in which several departments maintain the same data record differently.
Data quality rules and lifecycle
The data owner defines quality rules per attribute: mandatory fields, value ranges, valid code lists (e.g. country codes, units of measure, certification categories) and description syntax. This includes the lifecycle: creation, changes with four-eyes release, periodic revalidation (such as certificate expiry or address validation) and regulated archiving. In practice, quarterly quality reviews have typically become established, in which stewards prepare reports and the owner decides on corrective actions.
Governance integration and committees
Data ownership should be integrated into an overarching data governance body that sets priorities, resolves conflicts across departmental boundaries and drives standards forward. In procurement, alignment with the category board is recommended: consolidation decisions are made there (e.g. a uniform material classification per category), which could not be implemented without ownership authority. Committee work also creates acceptance, because those affected help shape the rules instead of merely receiving them.
Key KPIs for controlling data quality
Data ownership can only be steered if quality is measurable. Typical metrics assess the completeness, consistency, currency and uniqueness of data pools and are often aggregated as a data quality score per domain.
Completeness, consistency and duplicates
Core metrics are the proportion of fully populated mandatory fields (typically > 95% in mature organisations), the consistency rate for value ranges and code lists, and the duplicate rate. In supplier bases, the duplicate rate in immature master records is often in the double-digit percentage range; after cleansing, single-digit values are typically realistic. Duplicates also distort analytical foundations such as supplier rating and spend aggregation.
Currency and lead times
The currency metric measures how many master records have been revalidated within defined periods; for supplier data with compliance relevance (certificates, approvals), 100% within the review cycle is often the target. Process metrics are also useful as a supplement, such as the lead time for new records or change requests – measured from receipt to release. Shorter cycle times have a direct impact on procurement delivery reliability, because delayed master data releases block order processes.
Impact KPIs on procurement processes
Beyond data quality, it is worth considering impact metrics: the proportion of orders running through automatically without rework (typically > 90% in mature e-procurement environments), short-delivery and return rates resulting from incorrect material master data, and the expedite rate as an early indicator of disruptions in order processing. If the expedite rate falls after a master data cleansing initiative, this is a strong argument for further investment in data quality.
Risks and controls in dealing with data ownership
Without clearly named data owners, typical damage patterns arise: duplicate records, inconsistent prices and conditions, outdated certificates, inadequate compliance documentation and unclear release paths. Risks can be significantly reduced through controls, authorisation concepts and documented processes.
Typical risks in practice
Common risks are shadow spreadsheets alongside the system, multiple sources of truth for the same subject, unchecked changes to price and conditions data, and a lack of linkage between supplier data and risk information from supplier risk management. Particularly critical: anyone who can change conditions without a four-eyes principle opens the door to pricing errors that can lead to chargebacks or cumbersome reversals.
Controls, releases and authorisations
Effective controls are the four-eyes principle for critical changes (prices, payment data, bank details), role-based authorisations with least-privilege assignment, change histories with logging, and automated validation rules directly at the point of entry. Periodic access rights reviews and spot-check audits ensure effectiveness. For bank-related supplier data, separate verification by a second, independent employee has become established practice – a core protection against fraud attempts.
Compliance and legal aspects
Data owners are also responsible for lawful data processing: data protection requirements (in particular the GDPR) when handling supplier contact data, commercial and tax law retention periods, and product-specific obligations such as those for waste electrical equipment (WEEE registration obligations for relevant product groups). These statements are to be understood in general terms; the specific implementation should be legally reviewed on a case-by-case basis. In any case, the data owner must be able to document which data is held for which purpose and on which legal basis.
Data owner in interplay with procurement processes and systems
The data owner does not operate in isolation, but at interfaces: with enquiries and award, with supplier risk management, with e-procurement platforms and with integrative procurement models such as vendor managed inventory. Data quality is the prerequisite for automation and strategic decisions.
Tendering, award and conditions management
Tendering thrives on precise data: cleanly classified materials, standardised specifications and consistent supplier master data. The data owner ensures that bidder information, price data and conditions are captured in a structured manner, so that the award decision is made on comparable bases and bidder communication runs efficiently. Faulty master data typically causes queries here, extensions of the negotiation round and delayed awards – measurable in a longer lead time to the award decision.
Supplier risk, rating and consolidation
Supplier master data is the foundation of supplier risk management and supplier rating: without a unique supplier identity, valid certificates and up-to-date risk attributes, risk scores are worthless. The data owner is responsible for ensuring that risk information (e.g. financial figures, certification status, country risks) is regularly revalidated. In addition, a cleansed supplier base enables consolidation: the merging of duplicates and group structures, which pools negotiating power and can lead to better terms in conditions management.
Digitalisation: e-procurement, VMI and data integration
Automated procurement models almost always fail because of poor data. E-procurement requires unambiguous material identification, correct units of measure and valid price conditions so that catalogue orders go through without manual rework. In vendor managed inventory (VMI), customer and supplier exchange inventory and planning data – here the data owner defines interface standards and data sovereignty. The same applies to quantitative foundations such as order quantity optimisation according to economic order quantity (EOQ), which is only reliable with dependable inventory, cost and demand data.
Current developments: AI, data catalogues and sustainability-related data
The role of the data owner is gaining weight through digitalisation and regulation. Artificial intelligence accelerates data maintenance but does not shift responsibility – if anything, it shifts it more strongly towards the owner, who defines model principles and releases. At the same time, sustainability reporting and supply chain due diligence are increasing the data requirements for supplier master data.
AI-supported master data maintenance
In practice, AI tools are increasingly being used to normalise material descriptions, detect duplicates and suggest classifications. This significantly accelerates cleansing projects; typically, such initiatives identify a proportion of more than half of the duplicates and inconsistencies that manual review would have overlooked. However, the data owner remains responsible for the release and for decisions on binding standards – AI proposes, the owner decides.
Sustainability, supply chains and reporting
Sustainability and supply chain requirements add ESG-relevant attributes to the supplier master: certifications, emissions data, proof of origin, risk country labelling. The data owner must define these attributes, determine sources (self-declaration, third-party verification) and establish review cycles. As sustainability disclosures become increasingly subject to reporting obligations, the traceability of data provenance (data lineage) is gaining in importance. Here too: general obligations in overview, specific implementation to be reviewed on a case-by-case basis.
Data catalogues and self-service
A data-driven procurement function offers business departments self-service access to curated data pools, such as supplier profiles, category spend or price indices (commodity indices). Data catalogues document which data exists, who the owner is, what quality it has and how it may be used. This accelerates analyses of procurement policy and site selection for outsourcing or toll manufacturing, because decision papers are based on referenceable, owned data rather than locally maintained island solutions.
Typical metrics
| Metric | Benchmark | Context |
|---|---|---|
| Completeness of mandatory fields | > 95% | typical benchmark for mature master data organisations |
| Duplicate rate in supplier base | < 5% | realistic after cleansing; often double-digit beforehand |
| Automated order processing | > 90% | proportion of orders without rework in mature e-procurement environments |
| Revalidation rate of certificates | 100% | within the defined review cycle for compliance data |
| Lead time for master data changes | < 5 working days | typical target from request to release |
Typical practical benchmarks – they vary by industry, part and contract.
Practical example
A medium-sized mechanical engineering company with around 2,500 actively ordering suppliers identified significant data problems as part of an e-procurement project: around 18% duplicates in the supplier base, highly inconsistent material descriptions and outdated certificates. After appointing a data owner for supplier data and, per category, an owner for material and conditions data, a steward team was established, a rulebook and four-eyes releases were introduced, and the supplier base was consolidated. Within about a year, the data quality score improved significantly, the proportion of orders that could be processed automatically rose, and award decisions were for the first time based on consolidated spend.
- Appoint a data owner per domain and document responsibilities in a RACI matrix
- Carry out duplicate cleansing and standardise description syntax with AI support
- Introduce four-eyes release for critical changes to prices, conditions and bank details
- Anchor quarterly data quality reviews in the category board
Conclusion
In procurement, the data owner is not a peripheral role but a leadership building block of data governance: they are accountable for supplier, material, conditions and contract data, thereby making them reliable for order management, risk monitoring, award decisions and reporting obligations. What matters is a clear distinction from steward and custodian, a documented rulebook and measurable quality metrics. Investment in data ownership typically pays for itself through less rework, a stronger negotiating position and automatable processes. Anyone who takes digitalisation and regulatory requirements seriously starts with the question: who is the owner of this data?
Frequently asked questions
What does a data owner do?
A data owner bears the business-level responsibility for a defined data set, such as supplier or material master data. They define quality standards, maintenance processes and release rules, decide on authorisations and consolidations, and monitor compliance over the data lifecycle. Operational maintenance is usually handled by a data steward, and technical provisioning by IT.
What is the difference between a data owner and a data steward?
The data owner decides: they define standards, rules and releases and bear conceptual responsibility for data quality. The data steward implements operationally: they maintain, check, cleanse and monitor compliance with the requirements in day-to-day business. In short: owner = decision-making and responsibility, steward = implementation and maintenance.
Which data falls within a data owner's area of responsibility in procurement?
Typical examples are supplier master data (master records, certificates, risk attributes), material master data (numbers, units of measure, classification, descriptions), purchasing info records with prices and conditions, and contract and framework agreement data. This data directly determines the quality of order management, supplier assessment and reporting. Depending on the organisation, ESG and compliance data are also included.
How do you appoint a data owner correctly?
The data owner should sit close to the data in business terms and have decision-making authority – in procurement, for example, the head of supplier management or a category manager. What matters is a written role definition, authority for releases and consolidations, and integration into a governance body. A mere nominal appointment without a mandate and resources remains ineffective.
Which KPIs measure data quality in procurement?
Typical KPIs are the completeness rate of mandatory fields, the duplicate rate in the supplier or material base, the consistency rate for code lists, and the currency of revalidations. In addition, impact metrics are used, such as the proportion of orders that can be processed automatically or the lead time of master data requests. In mature organisations, values such as > 95% completeness or single-digit duplicate rates are regarded as realistic targets.
Why is a data owner important for supplier master data?
Supplier master data is the basis for orders, payments, risk and compliance assessments. Without clear ownership, duplicate records, outdated certificates and unsecured changes to bank details arise – with consequences ranging from mispayments to compliance breaches. A data owner establishes rules, release processes and regular revalidation.
