BLOG
Data governance in pharma is the set of policies and controls that determine who can access sensitive data, such as clinical trial records, real-world data, or patient registries, and under what conditions. Done well, it protects participant privacy and keeps organizations compliant. Done as most organizations do it today, it also does something governance was never meant to do: it makes the data invisible to the people who have a legitimate, compliant reason to use it.
The clearest example of this is clinical trial data. Once a trial's primary analysis is complete, most of that data goes quiet: it sits in trial data management systems or behind access controls tied to the original study team. A researcher working on a related indication two years later often cannot reach it, and may not even know it exists.
The barrier is not an accident, and it is not a case of governance being applied too strictly. Privacy legislation and internal governance processes exist to protect participant data, and organizations are right to comply carefully with consent and research exception frameworks. The problem is architectural: when access is enforced separately, system by system, at the level of each data warehouse or trial database, a researcher has to specify exactly what data they need before they can even request it, and they can only do that by having already seen the data.
That gets worse when the people who once knew a dataset existed, such as the original study team, have left the organization. At that point, nobody left may know to ask for it, and the data stays locked away not because access was refused, but because governance and discovery were never connected in the first place.
A semantic layer is a layer that models data according to its meaning rather than its source system, sitting between the user and the raw data. Instead of treating a table called "adverse events" as a set of rows in a warehouse, it recognizes it as a clinical concept: connected to a patient, a study, and a drug, and mapped to a shared hierarchy. This matters for governance specifically because policy can then be defined once, at this semantic level, and applied consistently everywhere the data is accessed, rather than configured separately per system, per interface, or per tool.
In practice, that means data silos across imaging, clinical, and real-world data can get integrated into a knowledge graph, enriched with ontologies, and harmonized. A user gets a coherent view across all available data, but always within the governance rules that apply to them. Governance stops being a gate at the edge of the data and becomes a property of the data itself.
Turning governance from a blocker into something researchers can actually work with takes four specific capabilities, working together.
Aggregation by default. Users can query across datasets to see population-level summaries: counts, therapeutic areas, age distributions, without touching individual records. This turns a vague request ("I need access to all oncology trial data") into a scoped one: "400 subjects across three studies match my research purpose, and these are the specific attributes I need." That difference is what makes a request easy for a governance reviewer to evaluate instead of a broad ask they have no way to assess.
In DISQOVER, filtering to a disease indication on subject data surfaces aggregated metrics, such as study participation, age range, adverse events, and consent forms on file, without exposing any individual record. The figures shown here are from demo data, used to illustrate how the view works, not a real customer dataset.
Anonymity enforcement with a threshold. Aggregated data can still be re-identifiable. In a rare disease trial with only 50 to 100 patients globally, knowing an age range, a subtype, and a trial site can be enough to work out who someone is, even with names removed. A k-anonymity threshold (commonly set at 10) means any query returning fewer than that number of subjects is automatically suppressed, at both the individual and the aggregate level. This has to be enforced in the semantic layer itself rather than the interface; a rule that only lives in a UI can be bypassed by querying the same data through a different tool.
An example of what a user sees in DISQOVER when the anonymity threshold isn’t met.
Data lineage. Every query carries a record of where the underlying data came from, what transformations it went through, and which governance rules applied, including consent categories and any suppressed attributes. This gives users transparency into what they are looking at, and gives governance reviewers a ready-made audit trail rather than one assembled after the fact.
In DISQOVER, the data sources panel lists every ontology and dataset that feeds into the specific concept at hand, here a mix of standard ontologies and a demo clinical dataset, each with its own description and last-modified date.
Drilling into a specific property, such as reported adverse events, shows exactly which source it came from. This is what makes an audit trail possible without a separate lineage-tracking exercise. The data shown is from ONTOFORCE's demo environment, not a live customer dataset.
A structured path to request. Once a user has explored the data and defined what they need, they can submit a formal request directly from the platform, carrying its filters, consent rules, and lineage with it. That request flows into whatever governance process the organization already runs, such as a ticket system, a data governance board review, or an email procedure, fully scoped rather than broad. The platform triggers the process; the ethical and scientific judgment on whether to grant access stays a human decision.
Requesting access in DISQOVER starts from the exact cohort a user has already built, filters and all, rather than a blank request form. The request carries a link back to how the cohort was defined and lets the user select only the specific properties needed for review, so what reaches the governance team is scoped and traceable from the start. Shown here on ONTOFORCE's demo environment.
Together, these capabilities do not replace governance. They make it executable: consistent, auditable, and fast enough that a request that traditionally takes four to six weeks to assemble and submit can clear compliance review in hours once it reaches the reviewer fully documented.
Take a realistic scenario: a new study reports a higher-than-expected rate of pruritus (itchy skin) as an adverse event for a given drug, and a researcher wants to check whether the same signal shows up in previously collected data, and whether any gene expression data exists to help confirm a molecular basis for it. Working through a semantic layer, that researcher can filter to subjects who consented to reuse, received the drug in question, and reported the adverse event, all without seeing a single individual record; only the aggregated distributions and charts. If narrowing the filter (for example, to moderate-to-severe cases only) drops the matching group below the anonymity threshold, the aggregated view is suppressed and the system says so, rather than silently returning nothing. The researcher can then decide whether to broaden the query or proceed with a smaller, still-compliant group.
Once satisfied, the researcher saves the exploration and submits a request, carrying the exact filters, consent categories, and a link back to how the query was built. In one real example built this way, a query for severe adverse events tied to a specific drug matched nine subjects; the resulting request cleared compliance review and access was granted within hours, not the four to six weeks a manual process typically takes.
You can watch the full recording of our recent "Governing sensitive pharma data with a semantic layer" webinar for the live platform walkthrough of this exploration-to-request flow. Watch now >>>
The same governance holds regardless of who, or what, is asking the question. Organizations are increasingly seeing AI agents, copilots, and custom tools query sensitive pharma data directly, sometimes through APIs, increasingly through MCP (Model Context Protocol) connections that let an agent like Claude or a custom-built tool query a platform on a user's behalf. Because the governance rules described above (privacy flags, anonymity threshold, access scope) are enforced in the semantic layer itself rather than in any single interface, an AI agent gets exactly the same treatment as a human user: it can aggregate, filter, and explore within its access scope, but it cannot retrieve an individual patient record, and a query that drops a subgroup below the anonymity threshold is suppressed and flagged.
An AI agent has no built-in awareness of an organization's data policies; it queries whatever it can reach. The alternative, coding access rules into every UI, API, and agent tool separately, means every new interface has to reimplement governance correctly, and one missed update creates an ungoverned path into sensitive data. Enforcing the rules once, in the data model itself, is what lets an organization add new AI tools without re-validating governance for each one.
Two things are converging that make this hard to postpone: the regulatory perspective and the practical perspective. Waiting for a breach, an audit finding, or a scaling problem to force the issue is a far more expensive way to arrive at the same conclusion.
The regulatory case: organizations operating under GDPR and internal data stewardship frameworks need to be able to show a data protection officer or auditor that access controls hold consistently, not just that policies exist on paper.
The practical case: the volume of sensitive pharma data that could support new research only grows every year, and a governance model that depends on manual, per-request evaluation does not scale to it, while one built into the data itself does.
What is data governance in a pharma context? Data governance in pharma is the set of policies and controls that determine who can access sensitive data, such as clinical trial data, real-world data, or patient registries, and under what conditions. It exists to protect participant privacy and keep organizations compliant with regulations such as GDPR.
What is a semantic layer, in the context of data governance? A semantic layer is a layer that models data according to its meaning rather than its source system, connecting concepts such as patients, studies, and drugs and mapping them to shared ontologies like MedDRA. Because it understands the data, governance rules can be defined once at this layer and applied consistently, rather than configured separately in every underlying system.
Why does strong data governance often block legitimate research? Governance enforced separately at each system or interface requires a user to specify exactly what data they need before they can request it, which they can only do by having already explored it. Without a way to explore data safely first, or without anyone left who knows a dataset exists, legitimate requests often never get made.
What is a k-anonymity threshold and why does it matter for data governance? A k-anonymity threshold requires that any individual in a returned dataset be indistinguishable from at least a set number of others, commonly 10. If a query returns a subgroup smaller than that threshold, even aggregated results are suppressed, because small subgroups can be re-identifiable even without names attached.
Does a semantic layer replace an organization's governance committee or ethics review? No. It makes governance executable, surfacing well-scoped, well-documented requests with consent categories and lineage attached, but the decision on whether to grant a specific request remains a human judgment made by the people responsible for that review.
Does pharma data governance apply to AI agents as well as human users? Yes, when the rules are enforced in the semantic layer rather than in any single interface. An AI agent querying through a tool such as an MCP connection is subject to the same access scope, privacy flags, and anonymity thresholds as a human user in the platform's own interface.
Watch our recent webinar recording to hear more.
Page last updated July 2026.
ONTOFORCE enables life science companies to unlock hidden insights from data.
With DISQOVER, built on knowledge graph technology, we support life sciences and pharmaceutical companies with innovative data management and visualization.
