A Lifecycle-Oriented Data Governance Framework for Responsible LLM-Based Systems

Abstract

Large Language Models (LLMs) are increasingly integrated into software systems used in healthcare, public administration, and customer service. Decisions about data collection, use, and retention can introduce privacy and security risks, reinforce biases, and affect people who interact with or are subject to these systems. Addressing these concerns requires governance that connects technical safeguards with ethical principles and organizational responsibilities throughout the system lifecycle. Goal: This study proposes and evaluates a lifecycle-oriented data governance framework to support the responsible development and operation of LLM-based systems. Method: The framework was derived from a goal-oriented literature review and integrates five dimensions: bias mitigation, ethics, security and privacy, data quality and integrity, and regulatory compliance. It was evaluated through a survey with 80 professionals from data governance, information security, privacy, artificial intelligence, software engineering, and related fields. Results: The overall mean across the 30 evaluation items was 4.21 out of 5, indicating favorable perceptions of the proposed framework. Corrective bias mitigation and privacy impact assessment support received the lowest item ratings. Open-ended feedback suggested refinements concerning organizational responsibilities, auditing, monitoring, and integration with external systems and providers. Conclusion: The framework connects data governance practices with privacy, fairness, transparency, and accountability concerns across the LLM lifecycle. The findings provide initial evidence of its perceived usefulness for responsible software engineering. Evaluation in organizational settings is needed to assess its operational effectiveness and implications for affected individuals and groups.