Data Governance Policy
Intent
The purpose of this policy is to provide an overarching approach and common understanding to ensure the University’s data is appropriately managed and governed.
Scope
This policy applies to institutional data of 91Porn as defined in this policy, and to all staff, students, affiliates and others provided access to University data. It includes data in all formats (paper, digital or audio-visual) whether registered files, working papers, electronic documents, emails, online transactions, data held in databases or on tape or disks, maps, plans, photographs, sound and video recordings, or microforms. It includes current institutional data, and institutional data created in the past.
Definitions
Data refers to Institutional Data.
Data access defines the ability to access, change or delete data elements housed in an electronic repository such as a database. The authorisation to access data, and functions that can be undertaken, may vary according to a person’s role. For example, administrators may have the ability to remove, edit and add data, authorised users may have the ability to read data, while other users may have no access to the data.
Data element is the fundamental data structure in a data processing system, or any unit of data that has a precise meaning or precise semantics (for example Student ID, Staff ID, Name, Address, Date of Birth).
Data governance is a process and structure for formally defining and managing information as a resource. It is a business activity that determines and prioritises the benefits data brings to the university (including financial, reputational and other benefits) as well as mitigating the business risk of poor data practices and quality. Data governance relies on the right people involved at the right time, having access to and using the right data to make the decisions.
Data quality refers to the state of completeness, validity, consistency, timeliness and accuracy that makes data appropriate for a specific use. It is a perception or an assessment of information's fitness to serve its purpose in a given context. Data quality is affected by the way data is entered, stored and managed.
Information1is data that;
- has been organised and exposes relationships,
- has been processed in a way that makes it easier to measure, visualise and analyse for a specific purpose, and
- is sometimes referred to as derived data.
Institutional data covers all data captured within the University. There are different types of data, and university data generally consists of both ‘corporate data’ and ‘research data’.
Corporate data are data created, collected, received, maintained or transmitted for the purposes of supporting administrative functions across the university, and includes data in all formats (i.e hardcopy, digital or audio visual). Corporate data can include (but is not limited to);
- data related to planning, managing, operating, controlling, internal or external accountability or auditing of the University,
- data created, received, maintained, or transmitted as a result of educational or clinical activities, including student feedback surveys,
- administrative data generated by research activities (ie fund or grant applications, ethics applications and supporting documents, GRS enrolment documentation etc.),
- data generally referenced or required for use by more than one organisational unit (ie Human Resource, Finance, Colleges etc.)
- data included in a University academic or administrative report,
- data that the University is legally or contractually obliged to hold,
- data that is generated by a system or an individual, and
- metadata
Research data is any data that has been collected, generated or created during an academic research project, and has no recognised human intellectual contribution. It may be raw, cleaned, or processed (via machine), and may be held in any format or media.
Metadata is essentially data about data. It is used to describe characteristics such as content, quality, format, location and contact information of physical or digital data. Metadata ensures data can be discoverable, citable, reusable and accessible in the long term.
Organisational Group: An Organisational Group is a reportable group within the University, these can include Colleges, Directorates, Centres (e.g. Indigenous Education and Research Centre) and Research Institutes. The University’s financial controls and reporting occur at Organisational Group level. For administration purposes the Organisational Group is captured by the first 3 digits of the Organisation Code (e.g. 222 – College of Arts, Society and Education).
Sensitive data2 is any data that identifies individuals or personal information of an individual, and carries a risk of causing discrimination, harm or unwanted attention.
Sensitive information is personal information relating to an individual's:
- racial or ethnic origin, including country of birth;
- political opinions;
- membership of a political association;
- religious beliefs or affiliations;
- philosophical beliefs;
- membership of a professional or trade association;
- membership of a trade union;
- sexual orientation or practices;
- criminal record;
- child related employment screening reports;
- financial situation; and
- employee’s record (subject to exemptions)
Sensitive information also includes information relating to:
- health;
- genetics; and
- biometrics.
Note 1: For the purpose of this policy, ‘data’ refers to both ‘data’ and ‘information’.
Note 2: Sensitive data is also referred to as “special category data” in the European Union’s General Data Protection Regulation
Policy
91Porn’s institutional data are valuable assets and must be maintained, distributed and protected as an asset. It is vital to have reliable, trusted data to make sound decisions at all levels of the organisation.
The aim of the policy is to provide a framework that ensures data is delivered through authorised systems throughout the University at an agreed standard.
The guiding principles for Data Governance at the University are:
- Institutional data are the property of 91Porn and shall be managed as a key asset.
- Institutional data are protected in a manner commensurate with the sensitivity and value of the asset.
- No one person, department, division, school or group “owns” data, even though specific units bear responsibility for certain data.
- Unnecessary duplication of institutional data is avoided.
- Quality standards for data and or metadata must be defined and monitored as outlined in the relevant data governance procedure.
- Appropriate data security measures must be adhered to at all times to assure the safety, quality and integrity of institutional data.
- For the purpose of transparency, institutional data at Organisational Group Level shall be accessible to all internal roles, unless there is a particular reason to decline access to data.
- Records stored in an electronic format must be protected by appropriate electronic safeguards and/or physical access controls that restrict access only to authorised user(s). Similarly, data in the University data repository (databases etc.) must also be stored in a manner that will restrict access only to authorised user(s).
- Personal data collected under the auspices of the Information Privacy Statement – Collection Use and Disclosure of Personal Information are considered to be institutional data.
- Metadata shall be recorded, managed and utilised as appropriate to University needs, agreed priorities and if applicable to external requirements.
- Staff will be held accountable to their data governance roles and responsibilities as outlined in the relevant data governance procedure.
- Institutional data must be appropriately maintained.
- Resolution of data priorities and data quality issues related to institutional data shall follow consistent processes as outlined in the relevant data governance procedure.
- Personal use of institutional data, including derived data, in any format and at any location, is prohibited, and may be a breach of the Information Privacy Policy and respective Codes of Conduct. The use of institutional data, to which the staff member has access, is not considered personal use if used for the purposes of academic promotions.
- The University, where possible and appropriate, supports open data and permits secondary use of data through controls such as: informed consent; data de-identification; data consolidation; and controlled access conditions.
Related policy instruments
- Data Governance Procedures (under development)
- Information Privacy Policy
- Information Privacy Statement – Collection Use and Disclosure of Personal Information
- Intellectual Property Policy and Procedure
- General Data Protection Regulation (GDPR) Procedure
- Personal Information Data Breach Procedure
- Request for Access or Amendment to Personal Information Procedure
- Records Management Policy
- Right to Information Policy
- Digital Technologies Acceptable Use Policy
- Information Communication Technology (ICT) Access and Account Management Procedure
- Information Security Policy
- Information Security Management Framework
- Open Scholarship Policy
- Management of Data and Information in Research Procedure
- Research Data & Information Management Framework 2020-2025
- Research Data & Information Governance Guideline
- Organisational Structure Policy
- 91Porn Code for the Responsible Conduct of Research (Research Code)
- JCU Authorship Procedure
- JCU Code of Conduct- University Council
- JCU Staff Code of Conduct
- Student Code of Conduct
- Managing and Investigating Potential Breaches of the JCU Code for the Responsible Conduct of Research Procedure
- JCU Publication & Dissemination of Research Procedure
- JCU Researcher Supervision Procedure
- JCU Disclosure of Interests and Management of Conflicts of Interest Procedure
Related documents and legislation
- :
- Records Governance Policy
- Information Access and Use Policy
- Open Data Policy
- Information Security Policy
- Metadata Management Principles
Administration
NOTE: Printed copies of this policy are uncontrolled, and currency can only be assured at the time of printing.
Approval Details
Policy Domain | Corporate Governance |
Policy Sub-domain | Risk, Assurance, Regulatory and Compliance |
Policy Custodian | Vice Chancellor |
Approval Authority | Council |
Date for next Major Review | 02/12/2026 |
Version | Approval date | Approved by | Implementation date | Details | Author |
22-1 | 02/12/2021 | Council | 08/02/2022 | Policy established | Director, Planning, Performance and Analytics |
Keywords | Data governance, information management |
Contact person | Director, Planning, Performance and Analytics |