A data governance policy is critical to helping your organisation achieve its strategic objectives. Data fuels your organisation’s progress. Whether it’s confidential information from suppliers and contractors, publicly available information, or your customers’ personal information, one fact remains: data has great value to your organisation. A data governance policy shows your organisation values data and provides a useful tool for extracting that value. You may be calling it an information management policy, but that is something a little different. It relates more to information in the form of records.
A data governance policy under the King Code
Governing bodies often realise they need data governance policies to implement the King Code. A good data governance policy allows your organisation’s governing body to set the direction for how management and the rest of the organisation will handle information when carrying out their functions. The King Code places responsibility on the governing body to create a culture in the organisation where not only information but technology is also part of the organisation’s intellectual capital and is handled in a way that creates value.
To create value, King asks the governing body of your organisation to use information in a way that takes advantage of opportunities, manages risks (data breaches, for example), grows the organisation, and benefits society. You should, therefore, look at this policy as something that, at a high level, sets the direction across the organisation for how you’ll achieve those different outcomes. Importantly, though, the policy cannot be a substitute for other more specific and detailed policies and procedures on each issue. Your organisation should still have separate policies that fully address the related issues.
What does the data governance policy cover?
A data governance policy usually covers the following information-related issues:
- classification – principles that help determine who is responsible for caring for particular categories of information, like your customers’ personal information, for example.
- conversion – principles for converting data from one format to another, such as digitising hard copy data into an electronic system.
- custodianship – principles for determining who is responsible for caring for particular categories of information,
- disposal – principles for disposing of and destroying information.
- outsourcing – principles for outsourcing services involving information to suppliers.
- migration – principles for migrating information from one set of equipment and infrastructure to another, such as moving from an on-premises to a cloud solution.
- retention – principles for retaining information, including data types, storage mechanisms, and types of retention period (but not the actual retention periods themselves, which need to be set out in a separate document).
- security – principles for securing information against unauthorised access or interaction (such as in an information security law context).
- sharing – principles for sending information to third parties and receiving it from them.
There are a few good examples online, such as those from LYIT, UNSW Australia, or Australian Catholic University.
Actions you can take
- Govern your organisation’s data effectively and strategically by asking us to draft or review your data governance policy.
- Protect your intellectual property by instructing us to conduct an Intellectual Property Audit for you.