Data & analytics leaders
Pain: Lakehouse sprawl, no catalog or lineage, and broad access to sensitive tables.
Fit: Lakehouse governance on Databricks/Snowflake with FGAC, catalog and lineage.
Practice · Data Architecture & Governance
Data architecture and governance you can explain
Lakehouse governance on Databricks and Snowflake, entity resolution, fine-grained access control and audit trails — plus the privacy and retention discipline (GDPR, LOPDGDD, e-Admin) that auditors accept. Right-sized for your reality.
Yerbabuena Digital
We help you architect and govern data end to end: lakehouse design on Databricks and Snowflake, entity resolution, catalog and lineage, fine-grained access control and DSPM — plus RoPA, retention, access reviews, cookie consent and audit evidence aligned with GDPR, LOPDGDD and e-Administration. Policies and architecture you can explain to customers, auditors and your own team.
Who this practice is for
Any organization that processes personal data, runs analytics at scale, or sells to the public sector — especially across ES · EN · FR borders.
SMEs going enterprise
Pain: Security questionnaires and DPAs block deals; privacy is a spreadsheet.
Fit: Maintained RoPA, privacy notices and vendor review playbooks.
Public sector suppliers
Pain: LOPDGDD, ENI and audit requirements without a governance team.
Fit: Retention schedules, access logging and evidence packs.
Teams deploying AI/agents
Pain: Unclear what data agents can read, store or delete.
Fit: Data boundaries, FGAC and retention wired into automation.
Architecture and governance as a competitive advantage
Data governance is not a binder on a shelf, and data architecture is not just a diagram. Together they are the policies, models and controls that let you move fast on analytics and AI without breaking the law — or losing customer trust.
We design lakehouse architecture on Databricks and Snowflake: medallion models, catalog, lineage and fine-grained access control so the right people (and agents) see the right data. We bring hands-on experience with entity resolution and graph analytics for regulated industries.
We help you map personal data, define retention, document processing activities, and implement technical controls that auditors and regulators actually understand. Our heritage includes e-Administration, ENI interoperability and large-scale public-sector deployments.
Whether you need a DPIA, a records schedule, access reviews, a DSPM posture or a full governance operating model, we speak plain language first — then back it with evidence.
Governance connects to our other practices: cloud foundations host the lakehouse, AI governance enforces policy at the data plane, and sites and agents inherit the same retention and consent rules your RoPA describes.
Return on investment
Where the numbers come from
Illustrative scenarios — regulatory fines, deal delays and audit costs vary widely. We right-size controls to your risk.
B2B vendor — security questionnaire backlog
Each enterprise prospect sent a 200-row questionnaire; answers were reinvented from email threads. Maintained RoPA + control library.
- Questionnaire turnaround
- −60% — Reusable answers from RoPA
- Deals stalled on privacy
- Fewer — DPA templates ready
- First RoPA draft
- 2–3 weeks — Workshops + tooling
A living RoPA pays for itself the first time sales is not blocked on 'send us your GDPR docs'.
Public sector — audit preparation
Retention and access reviews were manual spreadsheets before annual audit. Automated schedules + logging.
- Audit prep time
- −50% — Illustrative with reports
- Access review cycle
- Quarterly — Role-based + evidence
- Retention jobs
- Automated — Linked to ECM where possible
Automated retention and logs turn audit season from panic into routine exports.
Capabilities
What we architect and govern
From lakehouse design and FGAC to ongoing privacy and audit programs.
Data architecture & lakehouse
Databricks and Snowflake done right — structured for governance, not just analytics.
- Lakehouse and medallion architecture design
- Catalog, lineage and metadata management
- Fine-grained access control (FGAC)
- Entity resolution and graph analytics
Privacy & regulatory
GDPR, LOPDGDD and cross-border processing — documented and actionable.
- Records of processing (RoPA) and DPIA support
- Privacy notices, cookies and consent flows
- Data subject request playbooks
- Vendor and DPA review
Records & retention
Keep what you must; delete what you should.
- Retention schedules aligned to legal holds
- Legal hold and disposition workflows
- Classification of personal vs operational data
- Archive and cold storage strategy
Access, audit & DSPM
Who saw what, when — and where sensitive data lives.
- Role-based and fine-grained access models
- Periodic access reviews and audit trails
- Data security posture management (DSPM)
- E-signature and non-repudiation
Agent-augmented governance
Agents that keep governance current — with you in the loop.
- Catalog and lineage discovery agents
- Classification and PII detection agents
- Access-review and attestation assistants
- Audit evidence collection and report drafts
Operating model
Roles, councils and metrics that keep governance alive.
- Data stewardship and ownership RACI
- Policy templates and training
- KPI dashboards for compliance health
- Integration with cloud, AI and content practices
Use cases
Industries we know well
GDPR + vendor due diligence
Challenge: DPAs and security reviews blocked vendor onboarding and sales.
Outcome: RoPA, DPA templates and control library; faster prospect and vendor cycles.
LOPDGDD and e-Admin evidence
Challenge: Retention and access proof spread across spreadsheets and siloed apps.
Outcome: Schedules, logging and audit exports aligned to ENI deployments.
Agent data boundaries
Challenge: New AI features without clear retention or lawful basis documentation.
Outcome: RoPA updates, consent copy and technical guardrails for agents.
Engagement
How a governance engagement runs
Pragmatic phases — evidence over theater.
Baseline
We map systems, data flows, legal drivers and existing policies. You get a heat map of gaps and quick wins.
Design
Policies, retention rules, roles and control objectives — co-authored with legal, IT and business owners.
Implement
Technical controls in your stack: consent banners, access groups, logging, retention jobs and documentation.
Operate
Recurring reviews, training refreshers and audit support. Governance stays current as you add sites, agents and new data sources.
Before & after
What changes with governance in place
Before
- Privacy answers reinvented per customer or audit
- Retention = keep everything, delete nothing safely
- Access granted ad hoc; no review cycle
- Cookies and forms not aligned with actual processing
After
- Maintained RoPA and reusable questionnaire answers
- Retention schedules with legal hold and disposition
- Role-based access with quarterly reviews and logs
- Trilingual privacy notices and consent that match reality
Outcomes
What strong governance delivers
Audit confidence
Evidence packs and trails that satisfy internal audit, ISO programs and sector regulators — without last-minute fire drills.
Faster deals
Security questionnaires and DPAs answered from a maintained RoPA — not reinvented per prospect.
Safer automation
Agents and integrations inherit clear data boundaries — what they can read, write and retain.
Customer trust
Transparent privacy and cookie practices that match how you actually process data — in three languages when needed.
Frequently asked questions
Frequently asked questions
Is governance only for big companies?
No. Small companies that collect customer data, employ people or serve the public sector benefit most from getting retention and privacy right early — it becomes an advantage, not a tax.
Can you help with a DPIA?
Yes. We facilitate DPIAs with your legal counsel, document risks and recommend technical and organizational measures.
Do you implement tools or only advise?
Both. We write policies and also configure consent, access control and logging in the systems you use — including sites and agents we build.
How does governance connect to content management?
Retention and access control live in your repository. We align ECM metadata with governance policies so enforcement is automatic, not manual.
Do you cover LOPDGDD and GDPR together?
Yes — especially for Spanish organizations and EU cross-border processing. We map obligations to your actual systems.
Can you help our agents stay compliant?
We define what data agents may read, write and retain, with logging and human approval — linked to your RoPA.
Explore our other practices
Yerbabuena Digital
Still navigating between pilot and production?
If you're working through questions around access, architecture, compliance, cost control, or moving a working system into a governed production environment, we can help clarify the next practical step. We respond within one business day with a direct assessment and, where it makes sense, an initial conversation.