Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Under King V, data governance is a board accountability issue—not just an IT policy or a paragraph in an annual report. The practical test is whether the governing body can get reliable evidence about what sensitive data the organisation holds, who can access it, which systems hold it, and how suppliers handle it. That is Ascent Technology’s interpretation of the change, rather than a substitute for the Code’s wording.
What King V says about data governance
The Institute of Directors in South Africa (IoDSA) released King V on 31 October 2025. It applies to financial years beginning on or after 1 January 2026, and IoDSA encourages early adoption. See the official King V page for the Code and implementation information.
| # | Preview | Product | Price | |
|---|---|---|---|---|
| 1 |
|
On Board: The Modern Playbook for Corporate Governance | $19.93 | Buy on Amazon |
| 2 |
|
Corporate Governance Matters | $65.09 | Buy on Amazon |
| 3 |
|
Corporate Governance | $41.72 | Buy on Amazon |
| 4 |
|
Corporate Governance: Principles, policies, and practices | $70.50 | Buy on Amazon |
| 5 |
|
Corporate Governance: Principles, Policies, and Practices | $96.96 | Buy on Amazon |
As an Amazon Associate I earn from qualifying purchases.
Ascent’s article reads Principle 10 as making the governing body accountable for the effective, compliant and ethical management and control of data and information across its acquisition, use, dissemination and disposal. That is an interpretation of the principle; organisations should consult the official Code for its precise wording and practices rather than treating a paraphrase as a quotation.
The distinction matters: a board may delegate operational work, but delegation alone does not establish that it has appropriate oversight. Ascent’s central argument is that a policy, committee assignment or annual-report statement cannot, by itself, show that the organisation understands its actual data exposure.
#1 Best Overall
What the board should be able to establish
Ascent frames the practical questions plainly: “Where does the sensitive data sit?” “Who holds standing access to it?” “Which of the engines holding it are still supported?” and “Who else touches this data?” These questions turn a broad governance responsibility into evidence the board can request and review.
Data inventory and classification
The organisation should be able to identify sensitive data, locate the systems and environments where it is held, and explain how it is classified. A policy that describes intended handling is not the same as a current inventory showing where information actually resides.
Access and accountability
Management should be able to show who has access, including standing or privileged access, and provide evidence of periodic access reviews and sign-off. The review should cover the systems and people relevant to the data, not merely state that access controls exist.
Recommended Free Tools
Rank #2
Supported systems
For each database engine holding sensitive data, the organisation should know its support status and have a process to track changes. A governance report that lists databases without showing whether they remain supported leaves an important risk question unanswered.
Suppliers and outsourced providers
The view of data exposure should include third parties that store, process or otherwise handle the organisation’s information. Ascent’s operational interpretation calls for accounting for suppliers and outsourced providers, rather than limiting oversight to systems managed directly by internal IT.
Assurance and recovery evidence
Periodic assurance should give the board evidence that controls are operating, not simply that documents exist. Ascent points to the value of current inventories, signed-off access reviews, supplier coverage, support-status tracking, and tested recovery and activity evidence. These are practical implementation axes suggested by the article, not a complete official IoDSA checklist.
Rank #3
Governance paperwork versus operational evidence
A board can compare the strength of its oversight by asking whether its reporting is current, complete and verifiable. A written policy describes expectations; an inventory, access review, supplier record or recovery test helps demonstrate what is happening in practice. The difference is especially important when information is distributed across database platforms, service providers and teams.
- Inventory: Does it identify and classify sensitive data and the systems that hold it?
- Access: Does a documented review show who can reach that data and who approved the access?
- Support status: Is the lifecycle status of each relevant database engine tracked?
- Third parties: Are suppliers and outsourced providers that handle data included?
- Assurance: Is there periodic evidence of control activity and tested recovery?
This framework reflects Ascent’s recommendations. It should not be represented as a prescribed King V checklist unless the official Code or applicable sector rules establish that requirement.
Where to get King V implementation support
IoDSA describes two distinct support routes. The right one depends on whether the need is informal, high-level clarification or organisation-specific advice that may need a formal written opinion.
| Route | Who it suits | What it provides | Important qualification |
|---|---|---|---|
| Member technical support | IoDSA members seeking high-level clarification | Informal King V technical support | Not legal advice and not a formal opinion |
| Paid advisory | Organisations needing specific implementation advice or a formal opinion | Advisory services from IoDSA | Paid service; scope and terms should be confirmed with IoDSA |
These service descriptions come from IoDSA’s technical support information. A member-support response should not be treated as a legal opinion or as confirmation that an organisation meets every applicable obligation.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How to read the risk statistics in Ascent’s article
Ascent’s article cites figures attributed to Redgate, Sophos, Cyanre and South Africa’s Information Regulator. The underlying publications or notices were not available for independent verification here, so the figures should be treated as claims reported by Ascent—not as independently established facts.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problems- Ascent attributes 77% and 44% figures to a Redgate June survey, but the survey year is not specified in the article’s retrieved text. The first is described as the share of organisations without a formal data governance or quality framework; the second as the share investing more than $100,000 in database AI over the preceding year. The original survey was not verified.
- Ascent reports 788 notifications from the Information Regulator in the first quarter of 2026; the original regulator notice was not verified.
- Ascent attributes 79% and 97% figures to Sophos’s 2026 ransomware study; the original study was not verified.
- Ascent reports Cyanre incident data of 18 days for South Africa in 2025 and 117 days for the preceding year; the original data was not verified.
These numbers may provide context for Ascent’s argument, but they should not be used as settled evidence without checking the source publications and their definitions, dates and methods.
Use the Code as the authority
King V’s significance is not that every database decision must be made by directors. It is that board oversight needs to be informed by credible operational evidence about data and information. Ascent’s interpretation is a useful prompt for asking whether that evidence exists; the official Code remains the authority for the principle’s exact requirements.
IoDSA’s King V materials include printed report editions through authorised publishers Juta and LexisNexis. Availability and edition details should be checked on the official King V page.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
