Data security vs data protection vs data governance: How the careers differ 

There are a lot of strikingly similar job titles in data. Data security, data protection, and data governance might seem, at first glance, more-or-less the same, but they actually cover very different – but related – disciplines. 

So, what do you need to know when choosing data security vs data protection vs data governance as a career path, and what kinds of skills or backgrounds are required for each discipline? 

The three fields at a glance 

Here is a quick comparison of data security vs data protection vs data governance before we look at each in detail: 

Field	What it protects or controls	Typical employers	Common starting backgrounds	Main output of the role
Data security	Data kept confidential, intact and available	Security teams, working with Data Engineering	IT, engineering, cyber security	Access control, encryption, monitoring, incident response
Data protection	Lawful handling of personal data	Legal, Risk or Compliance teams	Legal, risk, compliance	Compliance with UK GDPR: impact assessments, breach reporting
Data governance	Data ownership, definitions and quality	Data, Analytics or Chief Data Officer teams	Analytics, data management	Policies, standards and stewardship of data

Data security careers 

So, what exactly is data security? In short, it’s the technical discipline of keeping data confidential, intact, and available. 

With so much data being produced every day, that discipline has become more important than ever, and many teams are ramping up their data security capabilities and leaks and threats become more evident. 

A data security professional typically works alongside a broader security or data team, often working closely with data engineering. 

Common roles and what they do 

These are some of the most common roles you’ll find in data security job listings. They typically cover building, maintaining, and monitoring data controls and access. 

• Data security analyst: Monitors access to data and systems, reviews alerts and logs for unusual activity, and supports the response when an incident occurs. 
• Data security engineer: Builds and maintains the controls that protect data, such as encryption and access control, often working closely with data engineering teams. 
• Data security architect/manager: Designs the overall approach to protecting data, sets the standards that others follow, and leads the wider team. 

Skills and tools employers look for 

There are a number of essential skills employers will look out for when making a data security hire: 

• Data classification: Sorting data by how sensitive it is, for example public, internal or confidential, so that the right level of protection is applied to each type. 
• Identity and access management: Controlling who can log in and what they are allowed to see or change, so that only the right people can reach sensitive data. 
• Data loss prevention: Tools and processes that spot and stop sensitive data from leaving the organisation by accident or on purpose, such as being emailed to the wrong person. 
• Cloud data security: Protecting data that is stored and processed on cloud platforms rather than in a company’s own data centre, including how it is encrypted and who can access it. 
• Working with data engineering teams: Data engineers build the systems that move and store data, so security specialists work with them to build protection in from the start rather than adding it later. 

Data protection careers 

Data protection is not a technical discipline. A data protection officer typically handles the legal and compliance side of data, working with the legal, risk, or compliance teams rather than with data or IT. Consequently, they will often come from a legal or compliance background. 

Common roles and what they do 

Here are the typical roles you’ll find in data protection job listings: 

• Data protection officer: Monitors an organisation’s compliance with data protection law, advises staff on their obligations, and acts as the point of contact for the regulator and for individuals whose data is held. 
• Data protection analyst: Supports day-to-day compliance, such as handling requests from individuals, keeping records of how personal data is used, and helping to carry out risk assessments. 
• Privacy manager/analyst: Looks after the organisation’s wider approach to privacy, including policies, staff training, and reviewing new projects for privacy risks. 

In the UK, this means dealing with UK GDPR and the Data Protection Act 2018, subject access requests (where individuals ask to see the data held about them), data protection impact assessments for higher-risk projects, and reporting data breaches to the regulator where required. 

Skills and knowledge employers look for 

Data protection is less technical than data security, but that does not make it easier. The work requires extensive practical knowledge of law and regulations, requiring keen judgement. 

• Regulatory knowledge: A working understanding of data protection law, such as UK GDPR and the Data Protection Act 2018, and how it applies in practice. 
• Risk assessment: Spotting where personal data could be mishandled and judging how serious the risk is, for example through data protection impact assessments. 
• Policy writing: Turning legal requirements into clear policies and procedures that staff can follow. 
• Communicating with non-specialists: Explaining legal obligations in plain language to colleagues in IT, marketing, HR and senior leadership. 
• Working with regulators: Dealing with the Information Commissioner’s Office (ICO), including reporting breaches and responding to enquiries. 

Data governance careers 

Data governance is all about deciding who owns data, how data is defined, and how its quality is maintained. In some cases, responsibility for governance will be with a senior data professional, such as a Head of Data, rather than with separate data governance roles. 

Common roles and what they do 

As mentioned above, data governance will often fall under the purview of a senior data manager, rather than in a separate role. Sometimes, however, you will find the following jobs listed: 

• Data steward: Looks after the quality and definitions of data in one area of the business, such as customer or finance data, and makes sure the agreed rules are followed day to day. 
• Data governance analyst: Supports the governance programme by monitoring data quality, maintaining data catalogues and metadata (the descriptive information that explains what data is and where it came from), and reporting on issues. 
• Data governance manager/lead: Sets governance policy and standards, agrees who owns which data, and works with senior stakeholders to get them adopted. 
• Head of data governance: Owns the overall governance strategy and is accountable for it at a senior level, often within a Chief Data Officer function. 

The key difference between the first and third roles is that a steward looks after a particular data domain, while a governance lead sets the policy and standards that stewards follow. 

Skills and tools employers look for 

Less about technical skills, governance roles will often suit people who enjoy building and maintaining structures. Employers may seek skills such as: 

Governance suits people who enjoy structure and influencing others as much as technical depth. Employers typically look for: 

• Stakeholder management: Building relationships with data owners and senior leaders, and persuading them to follow agreed rules even when it adds work for their teams. 
• Policy and standards design: Writing clear, practical rules for how data is named, defined, handled and kept, so that teams across the business work consistently. 
• Data quality: Measuring whether data is accurate, complete and consistent, and agreeing how problems are fixed at source. 
• Metadata: Describing data so that people can find and trust it, such as what each field means, who owns it and how it is used. 
• Catalogue and lineage tooling: Familiarity with data catalogues (searchable inventories of an organisation’s data) and lineage tools (which trace where data comes from and how it changes as it moves between systems). 

Where the three fields overlap, and where they don’t

The best way to illustrate the key differences and overlaps between the three roles is with a scenario. In this case, imagine a scenario: there’s been a suspected data leak of sensitive customer information. 

A data security analyst would contain and investigate the breach; a data protection officer would then notify the appropriate regulators and the affected parties; then the person responsible for data governance would fix the ownership and policy gap that enabled the leak to take place. 

The fields overlap in that they substantially deal with the same incident, but each has a clearly defined role. Data governance vs data security comes down to rules versus defence: security protects the data from threats, while governance sets who owns it and how it should be handled. Data governance vs data protection is more about scope: protection covers the lawful handling of personal data, while governance covers all data, personal or not. 

How pay compares across the three fields 

As always, salaries depend on seniority, sector, and location. These figures, from Harnham’s own research, illustrate a wide range of salaries, but a relatively high entry level base, emphasising the role’s importance. 

This table covers per annum base salaries in London only. Download our most recent salary guide for the full figures. 

Role	Entry level	Mid-level	Technical lead/Manager	Senior management	Head of/Director
Data security	£45,000	£62,000	£79,000	£94,000	£115,000
Data protection	£42,000	£58,000	£72,000	£84,000	£98,000
Data governance	£44,000	£65,000	£85,000	£99,000	£120,000

Which path suits your background 

Many people enter these fields sideways, usually coming from a different professional background. Although all three have significant overlap, they tend to suit people with particular skillsets: 

If you come from IT, engineering, or cyber security 

Data security is the natural next step if you come from IT, engineering or cyber security, as your technical grounding in systems, access and threats transfers directly. Data engineering experience also helps if you later move towards governance, because you will already understand the pipelines and tooling that governance policies have to work with. 

If you come from legal, risk or compliance 

A risk and compliance background leads naturally to data protection, since you already know how to interpret regulation and assess risk. But that same background also applies to data governance policy work, where turning rules into clear, practical standards for the wider business is a core part of the job. 

If you come from analytics or data management 

Governance and stewardship build most directly on a background in analytics or data management. Your experience of data quality, reporting and business knowledge is exactly what these roles demand, so moving into data stewardship is often the most accessible way in. 

Frequently asked questions 

Is it a data protection officer or a data privacy officer? 

A data protection officer is the formal title used under UK GDPR, and therefore the one you’ll find in UK job listings. A data privacy officer is considered the generic term and might be found on international postings. Titles vary by employer 

Is data protection the same as information governance? 

While the two overlap, they are not identical. Data protection is about lawful handling of personal data, while information governance is a broader discipline covering how all information is managed, retained, and used.  

Are data security roles the same as cyber security roles? 

No. Cyber security is a different discipline, covering the wider defence of systems and networks from cyber threats, including individual attackers. Data security, meanwhile, focuses on protecting the data itself. There is overlap, and some people will move between the two disciplines 

Which qualifications and certifications do employers look for? 

There are a variety of qualifications and certifications covering the different disciplines that employers will be on the look out for. For example, CISSP and CISM for data security, the CIPP/E and CIPM for data protection, and CDMP for data governance.

Looking for your next data job? 

Get in touch with the Harnham team today to find your next role at some of the world’s most innovative data and AI firms.