Architecturally Bounded Governance: A Case Study of HR Data Access and Information Security in a Public Sector BI System

Sammanfattning

This study examines how data governance is enacted in practice for HR data access and use in Business Intelligence (BI) systems within a public sector organization. Using data governance theory, access control models, the CIA triad, and socio-technical systems theory, the study explores the gap between formal governance structures and everyday organizational practice. A qualitative, interpretive single-case study was conducted at a large Swedish municipality, based on semi-structured interviews with seven respondents across four departments and system walkthroughs. The findings show that governance operates through two qualitatively different modes within the same organization. Inside the BI platform, governance is embedded and effective. Anonymization, role-based access controls, and structured provisioning make compliance the default for most users. Outside the platform, once data moves into spreadsheets, manual extracts, or legacy files, these technical controls are no longer enforced. Traceability is lost, GDPR protections do not travel with the data, and compliance depends on informal norms. The study proposes the concept of architecturally bounded governance, arguing that governance effectiveness is conditioned less by formal policy quality than by whether it is embedded in systems people use. The findings contribute to data governance research, access control theory, and socio-technical tradition in Information Systems.