Data Governance Policy

1. Purpose

This policy sets who is accountable for the Organisation's data, how its quality, security, use and lifecycle are managed, and how the Organisation shares it. It gives one set of rules so that data can be trusted, found, protected, used within the law and removed when no longer needed.

• Every important dataset has a named owner and a defined purpose.
• Data is classified, and handled and retained according to its class.
• Data is shared, transferred and used for analytics or AI only on a lawful and approved basis.
• Compliance with law and contract can be shown from records.

2. Scope and Applicability

The policy applies to all data created, collected, received, stored, processed, shared or disposed of by or for the Organisation, in any form and any location, and to all personnel and suppliers who handle it.

• In scope: business, customer, employee, financial, technical, product, operational, log and analytics data, structured and unstructured, in production and non-production systems, backups and archives.
• In scope: personal data, which is also governed by the Data Protection and Privacy Policy, and data used to train or operate AI, which is also governed by the AI Governance Policy.
• Out of scope: data owned by customers and processed on their instruction is governed first by the customer contract, and by this policy for the controls the Organisation applies to it.

3. Objectives

• Make data accountable: one owner, one steward and one custodian for each critical dataset.
• Make data trustworthy: defined quality rules, lineage and a catalogue entry for critical datasets.
• Make data safe: classification, access, retention and disposal that follow the Information Classification and Handling Policy.
• Make data usable: approved routes for sharing, analytics and AI, with privacy checks built in.
• Make data compliant: legal and contract requirements mapped to controls and tested.

4. Terms and Definitions

5. Governance Structure

Data governance is run through three layers. The structure should be scaled to the size of the Organisation, and several roles may be held by one person in a small Organisation, provided there is no conflict.

6. Roles and Responsibilities

7. Data Governance Policy Statements

7.1 Key data governance principles

7.2 Ownership and stewardship

• The Council must assign an owner, steward and custodian to each critical dataset within [60 days] of its creation or of the policy taking effect, and record them in the catalogue.
• A data owner who leaves or changes role must hand over in writing; if not, the Council appoints a replacement within [10 working days].
• Where several teams share a dataset, one owner must be named, and the others are consumers.

7.3 Data catalogue and inventory

• Critical datasets must have a catalogue entry with description, owner, class, systems, personal data flag, retention, quality measures and lineage; it must be updated within [30 days] of a change.
• The data inventory must be kept consistent with the record of processing activities in the Data Protection and Privacy Policy.
• Datasets not in the catalogue must not be used for decisions, reporting to customers or AI training.

7.4 Data quality

• The steward must define rules (for example mandatory fields, valid ranges, duplicate checks, reference matches) for each critical dataset and measure them [monthly].
• Quality targets must be agreed with the owner [for example 98 percent completeness on mandatory fields], and breaches reported to the Council.
• Issues must be logged, assigned and resolved at source rather than patched downstream, and the correction must reach all copies.

7.5 Classification and handling

• Every dataset must carry the highest classification of any element it holds, using the levels in Annexure A and the labels in the Information Classification and Handling Policy.
• Where a dataset is a mix, the owner may split it into parts with different classes to reduce cost, provided the split is enforced technically.
• Classification is reviewed [every 12 months] and when the data changes in use or sensitivity.

7.6 Access and use

• Access follows the Access Control Policy: least privilege, approval by the owner, review [every 6 months] for restricted and confidential data.
• Data may be used only for the purposes approved by the owner. Analytics, reporting and model training on personal data need the Privacy Lead's approval.
• Self-service tools and exports must respect classification, masking and access rules, and export of restricted data must be logged.

7.7 Lifecycle, retention and disposal

• Retention periods are set by the owner with Legal and the Privacy Lead, recorded in the retention schedule in the Documents and Records Management Procedure, and applied automatically where the system supports it.
• Archive data must be stored cheaply but securely, with a known retrieval method.
• On expiry, data must be deleted or anonymised within [30 days], and from backups on rotation. Media must be sanitised under the Asset Disposal Process. Deletion is recorded.
• A legal hold, set by Legal, suspends deletion for the data it covers until Legal lifts it.

7.8 Data sharing

• Data may be shared only where the owner has approved the purpose and recipient, and (for personal data) the Privacy Lead has confirmed the lawful ground.
• Sharing outside the Organisation needs a signed agreement. A data sharing agreement states the data, purpose, duration, security, onward-sharing limits, audit and return or deletion. Annexure C gives sample terms for personal data.
• Shared data must be limited to the fields needed, masked or pseudonymised where possible, sent by a secure channel and logged.
• Each sharing arrangement must be reviewed at renewal or [every 12 months], whichever is first.

7.9 Cross-border transfers

• The owner must complete the transfer assessment in Annexure D before data is stored in, accessed from or sent to another country, and the Privacy Lead and Legal must approve it.
• Transfers must comply with the Digital Personal Data Protection Act, 2023, any restrictions notified under it [confirm the current requirement], sector rules and applicable law in each jurisdiction where the Organisation operates, as well as customer contract limits on location.
• The register of cross-border transfers must be kept current, and the Privacy Lead must review it [every 6 months].

7.10 Analytics and AI use of data

• Datasets used for analytics, product improvement or model training must be approved by the owner and, for personal data, the Privacy Lead, and must be pseudonymised or aggregated wherever the purpose allows.
• AI uses must also follow the AI Governance Policy, including bias testing and a register entry.
• Customer data must not be used for the Organisation's own analytics or models unless the customer contract allows it.

7.11 Data incidents

• Data loss, corruption, wrongful disclosure, wrongful use or quality failures with business impact must be reported under the Information Security Incident Management Policy.
• The owner must lead the business assessment and correction, with the steward and custodian.

8. Compliance and Legal Alignment

The Legal team keeps a register of the laws, regulations, sector rules and customer contract terms that apply to the Organisation's data. Each requirement is mapped to an owner and a control.

• Legal must review the register [every 6 months] and when a new law or contract is signed, and tell the Council of changes within [30 days].

9. Monitoring and Review

• The Chief Data Officer reports the measures to the Council [quarterly] and to top management [yearly]. Internal audit tests data governance in the audit plan.

10. Non-Compliance

• Breaches of this policy are handled under the incident process and the disciplinary process, as the enforcement text of this document sets out.
• Persistent failure of a data owner to meet their duties must be reported to the Council, which can reassign ownership.
• Sharing or transfer without the required approval must be stopped on discovery and the data recovered or deleted where possible.

11. Records and Evidence

Annexure A: Data classification matrix

Annexure B: Roles and responsibilities summary

Annexure C: Sample data processing agreement terms

These terms are a starting point for the Organisation's lawyers. They must be adapted to the service, the parties and applicable law, and reviewed by Legal before use. Bracketed values are to be chosen for each agreement.

Annexure D: Cross-border transfer assessment template

12. Exception

Exceptions to this document are allowed only where compliance is not practicable and the risk has been assessed. A request must state what is to be excepted, why, the risk it creates, the compensating controls, and an end date no later than [6 months]. It is approved in writing by the document owner and the risk owner, recorded in the exceptions register, and reviewed at the end date. An exception does not change the document.

13. Enforcement

Compliance is monitored through internal audits, management review and routine checks by the document owner. Non-compliance is reported through the incident or non-conformity process and handled under the organisation's disciplinary procedure, and under the terms of any contract for people who are not employees. Serious or repeated non-compliance may lead to loss of access and, where the law is broken, to referral to the authorities.

14. Review

This document is reviewed at least every [12 months], and when there is a significant change to the organisation, its systems, its risks or the law, or after an incident that shows it was not effective. Each review is recorded in the revision history.

ISO/IEC 27001:2022 references

Related documents

• Data Protection and Privacy Policy
• Information Classification and Handling Policy
• AI Governance Policy
• Supplier Relationship Management Policy
• Backup and Restoration Policy
• Documents and Records Management Procedure