Data Governance & Ownership

The first step to thinking clearly is to separate three ideas that get muddled. Ownership is the question of who holds rights over the data - who can licence it, sell it, restrict it or give it away. Custodianship is the question of who physically holds and maintains the data and is responsible for its accuracy, security and upkeep - the custodian is not necessarily the owner. Stewardship is the broader duty of care: governing the data responsibly over time in the interest of those it concerns and those who depend on it. A city twin involves all three, and a great deal of confusion and risk comes from assuming they are held by the same party when they are not.

Consider a concrete tangle. A city's cadastral and survey data has an official custodian with legal authority over it (in India, bodies such as the Survey of India and state revenue departments). Traffic data might be owned by a transport authority but physically held on a vendor's cloud. Mobility data might be owned by a private ride-hailing firm and only licensed to the city under terms. Sensor data might be generated by devices a contractor installed and operates. When all of this flows into one twin, who owns the integrated whole? Who may grant access to it, and to whom? Who is responsible when it is wrong? These are not answered by the technology; they must be answered by explicit governance - agreements, licences, custody arrangements and accountability structures - and if they are left implicit, the defaults tend to favour whoever built the platform.

This is why mature thinking about city data treats it as a governed asset, much like a spatial data infrastructure (SDI): a framework of data, standards, policies and institutional arrangements that make geospatial data shareable and usable across an organisation or a nation, with clear custodians and rules. A twin without that scaffolding is not just technically fragile; it is a governance vacuum, and vacuums get filled by whoever has the most commercial interest in filling them. The designer's role here is not to draft the contracts - defer that to the authorities and legal counsel - but to understand that behind every layer of a convincing twin sits a question of who owns it, who holds it, and who is accountable for it, and to ask those questions out loud before the model is trusted.

Two axes shape who a city twin serves, and they are often confused with each other. The first is public versus private control: is the twin owned and governed by a public body accountable to citizens, or by a private company accountable to shareholders? The second is open versus proprietary: are the data and the platform built on open standards and (where appropriate) open data that anyone can inspect and reuse, or on closed formats and restricted data that only the vendor can fully read? These are separate questions - you can have a publicly owned twin built on proprietary software, or a private platform publishing some open data - and both axes matter.

Open data is the principle that certain data should be freely available for anyone to use and republish, without restrictive licensing. For a city twin, a commitment to open data where privacy and security allow has real public value: it lets researchers, civic technologists, journalists, start-ups and citizens build on the city's data, audit it, find errors, and create value the city never imagined. It also guards against the twin becoming a black box. But open data is not a simple good to be maximised - the whole of Module 8 turns on the fact that some urban data is deeply sensitive, and publishing movement, occupancy or individual-level data openly can enable surveillance and harm. The honest position is open by default for non-sensitive data, carefully governed or closed for the rest, with the line drawn by law and privacy assessment, not convenience.

Open standards are a different and, for governance, even more fundamental matter. A twin built on open, interoperable standards - CityGML for city models, open APIs, documented formats - means the city's data can move between tools and vendors and be read far into the future. A twin built on a vendor's proprietary formats means the data is only as accessible as the vendor allows. This is where public and private interests most often diverge: a vendor has a commercial incentive to keep formats closed so the city cannot easily leave, while the public interest is almost always served by openness and interoperability. A city that insists on open standards keeps the power to switch providers, to audit its own model, and to own its knowledge of itself regardless of who built the software. A city that does not can find its self-knowledge effectively privatised - which is the subject of the next section.

Here is the peril this lesson exists to name: vendor lock-in of a city's model of itself. Building a city twin is expensive and complex, so cities naturally turn to specialist vendors and platforms. That is reasonable - the problem is not using a vendor, it is the terms. If the twin is built on proprietary formats, if the data lives only inside a platform the city does not control, if the integrations and models and configurations are trapped in one company's system, then over time the city's knowledge of itself becomes inseparable from that vendor. The city cannot easily move to another provider, because migration would mean rebuilding everything and may be technically impossible. It cannot fully audit the model, because it cannot see inside. And it cannot walk away, because the twin now underpins how the city is planned and run. The vendor has become a landlord of the city's self-knowledge, and the renewal contract is a negotiation the city cannot afford to lose.

The consequences compound. Cost: a locked-in city has little bargaining power, so prices can rise with every renewal. Fragility: if the vendor raises prices unacceptably, changes direction, is acquired, or simply fails, the city's twin - and the decisions depending on it - are at risk. Accountability: a model the public cannot inspect cannot be democratically governed; officials end up deferring to a black box they do not control. Sovereignty: at national scale this becomes a question of data sovereignty - whether a country's data about its own cities is subject to its own laws and control, or sits on infrastructure and in formats governed by a foreign company. None of these are hypothetical; they are the ordinary failure modes of large public-technology procurement, and a city twin concentrates the exposure because it concentrates the data.

The defences are knowable, and a designer should be able to name them even while deferring the contracting to procurement and legal experts. Insist on open standards and data portability so the city can always export its model and move it elsewhere. Keep ownership of the data explicitly with the public body, with the vendor as a processor or custodian under contract, not the owner. Require interoperability so no single vendor holds the only key. Retain in-house capability so the city understands its own twin rather than being wholly dependent on a supplier. Build governance structures - clear custodianship, audit rights, exit clauses - before the platform, not after. The underlying principle is simple and worth stating plainly: a city should never cease to own, understand and be able to leave its own model of itself. A twin that the public cannot leave is not public infrastructure; it is a private dependency dressed as one.

What does sound governance of a city twin actually require? At minimum, a set of explicit answers to questions that are too often left implicit. Who owns each data layer and the integrated whole? Who is the custodian of record for each - responsible for accuracy, security and upkeep? Who may access what, under what rules and for what purposes, and how is that logged and audited? Who is accountable when the model is wrong, or when data is breached or misused? What standards keep the data portable and the city able to leave? A twin with clear, documented answers to these is a governed public asset. A twin without them is an accident waiting to happen, however impressive the graphics. Good practice tends to crystallise into a data-governance framework - a defined set of roles (data owners, stewards, custodians), policies, quality and access rules, and accountability - layered over the technical platform and treated as seriously as the platform itself.

Accountability deserves special emphasis because it is where governance meets democracy. A city twin influences real decisions about real lives, so the public must be able to ask who decided, on what data, with what assumptions, and to challenge the answer. That requires the twin's data, models and assumptions to be inspectable by those accountable to citizens - which is impossible if the whole thing is a proprietary black box. Governance and openness are not separate concerns; openness is part of what makes accountability possible. This is the thread that connects this lesson to the next two: data ownership and governance are the ground on which privacy, equity and democratic control all stand or fall.

In the Indian context, several things make this urgent. India has a rich but fragmented geospatial-data landscape with official custodians (the Survey of India, state and municipal bodies) whose authority and data of record must be respected - a twin's working layers never replace the authoritative source. India's evolving data-protection regime, centred on the Digital Personal Data Protection Act, 2023, increasingly shapes lawful handling of personal data, and questions of data sovereignty - keeping Indian data under Indian law and control - are live national issues. At the same time, large smart-city and urban-data programmes create real risk of procurement outpacing governance: expensive platforms bought before the ownership, custodianship and exit questions are settled, leaving cities locked in. The honest guidance for a designer is to treat governance as prior to technology, to respect the official custodians and the governing law, and to defer the binding legal and contractual decisions to the authorities, data custodians and legal counsel - while always asking, out loud, who owns this, who can leave, and who is accountable. A city that cannot answer those questions does not really govern its twin - its twin, and whoever built it, governs the city.