APRA CPG 235: what it means for data governance teams

TL;DR: APRA's CPG 235 reframes data in Australian financial services as a strategic asset, according to AvePoint, with 532 OAIC breach notifications in the first half of 2025 and 14% attributed to financial services. The governance challenge is no longer policy design alone; it is lifecycle control, accountability, and automation across data that now carries operational and regulatory weight.

Editorial analysis by NHI Mgmt Group, based on content published by AvePoint: “CPG 235 in Action: Practical Ways for Australian Financial Organisations to Treat Data Strategically”.

By the numbers:

• In the first half of 2025, the OAIC recorded 532 data breach notifications.
• The financial services industry accounted for 14% of incidents recorded by the OAIC in the first half of 2025.

Key questions

Q: How should organisations govern data across its lifecycle?

A: Organisations should treat governance as a chain of controls across acquisition, storage, transfer, retention, and disposal.

Q: What are the signs that data governance is failing in a financial services environment?

A: Common signs include duplicate and derivative data spreading across systems, inconsistent classification, incomplete inventories, overexposed records, and data moving without clear controls.

Q: What are the signs that data governance is not keeping pace with APRA expectations?

A: Common signs include unclear ownership, manual exception handling, inconsistent retention rules, weak lineage visibility, and access approvals that are not tied to the data lifecycle.

Practitioner guidance

• Define lifecycle ownership for critical data Assign named owners, custodians, and stewards to capture, processing, retention, publication, and disposal decisions so governance has accountable control points.
• Map lineage for regulated data sets Build traceability for where critical data originates, how it changes, and which systems consume it so assurance can follow the data path.
• Automate classification and retention enforcement Apply policy controls automatically across hybrid repositories so sensitive data is tagged, retained, and disposed of consistently.

Bottom line: Data governance in financial services now carries resilience and trust implications, not just compliance obligations.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →