Metadata is structured information that describes, explains, and contextualises other data. In an information security and compliance context, metadata includes attributes such as the creation date, author, classification level, retention period, and access permissions associated with a data asset. Proper metadata management is essential for data governance, as it enables organisations to understand what data they hold, where it resides, and how it should be protected.
From a privacy perspective, metadata can itself constitute personal data under the GDPR if it relates to an identifiable individual. Organisations must therefore include metadata in their data protection impact assessments and ensure it is subject to appropriate access controls, retention policies, and deletion procedures alongside the primary data it describes.