Policy Corporate Governance Data Governance Policy

Data Governance Policy

Policy
Procedures
Other related documents

Intent

The purpose of this policy is to provide an overarching approach and common understanding to ensure the University’s data is appropriately managed and governed.

Scope

This policy applies to institutional data of James Cook University as defined in this policy, and to all staff, students, affiliates and others provided access to University data. It includes data in all formats (paper, digital or audio-visual) whether registered files, working papers, electronic documents, emails, online transactions, data held in databases or on tape or disks, maps, plans, photographs, sound and video recordings, or microforms. It includes current institutional data, and institutional data created in the past.

Definitions

Data refers to Institutional Data.

Data access defines the ability to access, change or delete data elements housed in an electronic repository such as a database. The authorisation to access data, and functions that can be undertaken, may vary according to a person’s role. For example, administrators may have the ability to remove, edit and add data, authorised users may have the ability to read data, while other users may have no access to the data.

Data element is the fundamental data structure in a data processing system, or any unit of data that has a precise meaning or precise semantics (for example Student ID, Staff ID, Name, Address, Date of Birth).

Data governance is a process and structure for formally defining and managing information as a resource. It is a business activity that determines and prioritises the benefits data brings to the university (including financial, reputational and other benefits) as well as mitigating the business risk of poor data practices and quality. Data governance relies on the right people involved at the right time, having access to and using the right data to make the decisions.

Data quality refers to the state of completeness, validity, consistency, timeliness and accuracy that makes data appropriate for a specific use. It is a perception or an assessment of information's fitness to serve its purpose in a given context. Data quality is affected by the way data is entered, stored and managed.

Information¹is data that;

has been organised and exposes relationships,
has been processed in a way that makes it easier to measure, visualise and analyse for a specific purpose, and
is sometimes referred to as derived data.

Institutional data covers all data captured within the University. There are different types of data, and university data generally consists of both ‘corporate data’ and ‘research data’.

Corporate data are data created, collected, received, maintained or transmitted for the purposes of supporting administrative functions across the university, and includes data in all formats (i.e hardcopy, digital or audio visual). Corporate data can include (but is not limited to);

data related to planning, managing, operating, controlling, internal or external accountability or auditing of the University,
data created, received, maintained, or transmitted as a result of educational or clinical activities, including student feedback surveys,
administrative data generated by research activities (ie fund or grant applications, ethics applications and supporting documents, GRS enrolment documentation etc.),
data generally referenced or required for use by more than one organisational unit (ie Human Resource, Finance, Colleges etc.)
data included in a University academic or administrative report,
data that the University is legally or contractually obliged to hold,
data that is generated by a system or an individual, and
metadata

Research data is any data that has been collected, generated or created during an academic research project, and has no recognised human intellectual contribution. It may be raw, cleaned, or processed (via machine), and may be held in any format or media.

Metadata is essentially data about data. It is used to describe characteristics such as content, quality, format, location and contact information of physical or digital data. Metadata ensures data can be discoverable, citable, reusable and accessible in the long term.

Organisational Group: An Organisational Group is a reportable group within the University, these can include Colleges, Directorates, Centres (e.g. Indigenous Education and Research Centre) and Research Institutes. The University’s financial controls and reporting occur at Organisational Group level. For administration purposes the Organisational Group is captured by the first 3 digits of the Organisation Code (e.g. 222 – College of Arts, Society and Education).

Sensitive data² is any data that identifies individuals or personal information of an individual, and carries a risk of causing discrimination, harm or unwanted attention.

Sensitive information is personal information relating to an individual's:

racial or ethnic origin, including country of birth;
political opinions;
membership of a political association;
religious beliefs or affiliations;
philosophical beliefs;
membership of a professional or trade association;
membership of a trade union;
sexual orientation or practices;
criminal record;
child related employment screening reports;
financial situation; and
employee’s record (subject to exemptions)

Sensitive information also includes information relating to:

health;
genetics; and
biometrics.

Note 1: For the purpose of this policy, ‘data’ refers to both ‘data’ and ‘information’.

Note 2: Sensitive data is also referred to as “special category data” in the European Union’s General Data Protection Regulation

Policy

James Cook University’s institutional data are valuable assets and must be maintained, distributed and protected as an asset. It is vital to have reliable, trusted data to make sound decisions at all levels of the organisation.

The aim of the policy is to provide a framework that ensures data is delivered through authorised systems throughout the University at an agreed standard.

The guiding principles for Data Governance at the University are:

Institutional data are the property of James Cook University and shall be managed as a key asset.
Institutional data are protected in a manner commensurate with the sensitivity and value of the asset.
No one person, department, division, school or group “owns” data, even though specific units bear responsibility for certain data.
Unnecessary duplication of institutional data is avoided.
Quality standards for data and or metadata must be defined and monitored as outlined in the relevant data governance procedure.
Appropriate data security measures must be adhered to at all times to assure the safety, quality and integrity of institutional data.
For the purpose of transparency, institutional data at Organisational Group Level shall be accessible to all internal roles, unless there is a particular reason to decline access to data.
Records stored in an electronic format must be protected by appropriate electronic safeguards and/or physical access controls that restrict access only to authorised user(s). Similarly, data in the University data repository (databases etc.) must also be stored in a manner that will restrict access only to authorised user(s).
Personal data collected under the auspices of the Information Privacy Statement – Collection Use and Disclosure of Personal Information are considered to be institutional data.
Metadata shall be recorded, managed and utilised as appropriate to University needs, agreed priorities and if applicable to external requirements.
Staff will be held accountable to their data governance roles and responsibilities as outlined in the relevant data governance procedure.
Institutional data must be appropriately maintained.
Resolution of data priorities and data quality issues related to institutional data shall follow consistent processes as outlined in the relevant data governance procedure.
Personal use of institutional data, including derived data, in any format and at any location, is prohibited, and may be a breach of the Information Privacy Policy and respective Codes of Conduct. The use of institutional data, to which the staff member has access, is not considered personal use if used for the purposes of academic promotions.
The University, where possible and appropriate, supports open data and permits secondary use of data through controls such as: informed consent; data de-identification; data consolidation; and controlled access conditions.

Related policy instruments

Administration

NOTE: Printed copies of this policy are uncontrolled, and currency can only be assured at the time of printing.

Approval Details

Policy Domain	Corporate Governance
Policy Sponsor	Vice Chancellor
Approval Authority	Council
Date for next Major Review	02/12/2026

Version	Approval date	Approved by	Implementation date	Details	Author
22-1	02/12/2021	Council	08/02/2022	Policy established	Director, Planning, Performance and Analytics

Keywords	Data governance, information management
Contact person	Director, Planning, Performance and Analytics