• Section 1 - Introduction/Background
• Section 2 - Purpose/Scope
• Section 3 - Data Principles
• Section 4 - Data Governance and Ownership
• Figure 1 – Hierarchy of Data Governance Roles and Responsibilities
• Section 5 - Data Quality
• Section 6 - Data Security Classification
• Section 7 - Data Handling and Protection
• Section 8 - Roles and Responsibilities
• All Staff
• Chief Operating Officer and Vice-President Operations
• Data Executive
• Data Guardian
• Data Steward
• Section 9 - Definitions

Section 1 - Introduction/Background

(1) Data is a key strategic and operational asset of the University and the appropriate governance of the availability, usability, integrity and security of data is critical to the University’s operations.

(2) This Procedure should be read in conjunction with the IT Acceptable Use Policy, the Data Quality Management Procedure and the Data Handling Guidelines.

Section 2 - Purpose/Scope

(3) The purpose of this Procedure is to:

1. define the roles and responsibilities for the governance, protection, quality and overall management of data stored by the University;
2. set the standards for classifying data stored by the University based on its level of sensitivity and value; and
3. establish principles for creating and maintaining high quality data.

(4) This Procedure applies primarily to Data Executives, Data Guardians, Data Stewards and the Data and Analytics Division.

(5) Sections 3 and 7, and clause 27 apply to all Staff.

(6) This Procedure applies to all data stored by the University, with the exception of data referred to in clause 7.

(7) This Procedure does not apply to:

1. Research data defined in the Research Data Management Policy with the exception of Section 6 Data Security Classification; and
2. data of University controlled entities.

(8) The handling of data expressed in this procedure is also underpinned by the University’s Data Handling Guidelines, IT Acceptable Use Policy, Privacy Policy, Cyber Security Policy, Records Management Policy and other relevant policies.

Section 3 - Data Principles

(9) Collection, access authorisation, and use of data must be underpinned by a relevant business need.

(10) High quality data enables informed decision-making and accurate reporting. The University is committed to the continuous improvement of data quality.

(11) The collection and management of personal information is to be handled in accordance with the Privacy Policy which facilitates the University’s compliance with current legislative requirements.

(12) Data stored in University records must be retained and disposed of in an appropriate manner in accordance with the Records Management Policy.

Section 4 - Data Governance and Ownership

(13) All data assets must have an assigned Data Executive, Data Guardian and Data Steward to ensure clear lines of responsibility and accountability. Data governance roles are defined in the table below.

Figure 1 – Hierarchy of Data Governance Roles and Responsibilities

(14) Data governance roles are assigned based on the University Enterprise Data Model managed by the Data and Analytics Division, which separates all University data into information domains and subdomains.

Section 5 - Data Quality

(15) Data quality requirements must be defined by a Data Guardian, and required data quality monitoring mechanisms put in place.

(16) The Data Quality Management Procedure describes the main dimensions used to measure and monitor data quality.

(17) Data quality issues must be managed as prescribed in the Data Quality Management Procedure.

Section 6 - Data Security Classification

(18) The security classification is based on the likely impact on an individual and/or the University’s activities, objectives and reputation resulting from compromise of the data confidentiality.

(19) To ensure appropriate handling and protection, University data assets are to be assigned one of the following security classifications.

(20) To ensure immediate protection of higher risk data, the ongoing priority for Data Guardians is to identify and classify data assets that should have classification of Restricted.

(21) The default security classification for newly created data assets must be Controlled unless there is a specific need to protect the confidentiality of the information. For detailed information on data asset creation refer to the Data Handling Guidelines.

Section 7 - Data Handling and Protection

(22) The Data Handling Guidelines provide best practice guidance on how to protect and handle data based on security classification of its data assets.

(23) Electronically stored data must be protected by appropriate safeguards and/or physical access controls that restrict access to the authorised user(s).

(24) Controlled, protected or restricted data must not be stored on external portable storage (CDs, DVDs, USB/Flash Drives, etc.), personal devices, personal cloud storage or personal email accounts.

(25) Restricted data must not be stored on University managed devices and should be stored on University managed file servers (Such as H: or S: drives) or with the IMTS approved external services providers.

(26) Higher level data assets containing lower level data assets that have different security classification levels must be handled and protected according to the highest security classification assigned to any data asset within.

Section 8 - Roles and Responsibilities

All Staff

(27) All Staff  are responsible for:

1. complying with this procedure, together with the Data Quality Management Procedure and Data Handling Guidelines;
2. adhering to the principles laid out in Sections 3 and 7 of this Procedure;
3. handling data based on its security classification level; and
4. raising data quality issues in accordance with the Data Quality Management Procedure.

Chief Operating Officer and Vice-President Operations

(28) The Chief Operating Officer and Vice-President Operations is responsible for appointing Data Guardians on recommendation of the relevant Data Executive.

Data Executive

(29) Data Executives are responsible for:

1. overseeing the continuous improvement of the University's data management, integration and use;
2. recommending to the Chief Operating Officer and Vice-President Operations the appointment of Data Guardians within their respective portfolio; and
3. resolving disputes over ownership, access, quality and the classification of data.

Data Guardian

(30) Data Guardians are responsible for the overall implementation and enforcement of data management, quality, privacy and security within their assigned domain, including but not limited to:

1. ensuring that all legal, regulatory, and policy requirements are met in relation to data within their assigned domain;
2. assigning appropriate security classification levels to data assets;
3. ensuring that all data assets have a Data Steward(s) assigned;
4. approving data access requests or establishing an approval model for role-based access to data;
5. approving the release of University data to be used or shared outside the University;
6. maintaining acceptable levels of data quality as well as identifying data critical to business operations to be constantly monitored for quality; and
7. escalating data governance issues to the appropriate Data Executive.

Data Steward

(31) Data Stewards are responsible for performing data management, quality, privacy and security tasks as directed by the Data Guardian, as well as:

1. creating and enforcing processes and procedures for implementation;
2. acting as subject matter experts for the University community for data within their stewardship;
3. understanding end-to-end data flows and identifying data dependencies to support enterprise reporting and downstream data consumption;
4. developing and approving business terms and definitions;
5. proactively communicating planned changes for data held in systems within their assigned domain;
6. developing data sharing agreements with other business units;
7. recommending appropriate data security classifications to the Data Guardian; and
8. escalating data governance issues to Data Guardian.

(32) The Data and Analytics Division is responsible for:

1. recording and maintaining the list of the current agreed Data Executives, Data Guardians, Data Stewards and Data Specialists;
2. locating and assigning Data Specialists;
3. recording and maintaining the security classification for data assets;
4. providing guidance for Data Executives, Data Guardians, Data Stewards on the implementation of their duties and responsibilities.

Section 9 - Definitions