Appendix 2. Information Governance Framework

Thumbnail image of the information governance framework, described below (don't bother clicking - you just get a bigger image).
The university's information governance framework presented as image.

Description

This is a description of the Information Governance Framework image.

Definitions for and responsibilities of the roles mentioned below are set out an a separate document entitled 'Information Governance Role Definitions'.

University Level:

At the university level, responsibility is for:

  • Developing overall university information governance policies and framework, and
  • Providing advice to data owners/stewards within specific data domains.

The university's information governance function is based in the Academic Registry.

Note that IT Services are responsible for the university's IT security.

Specific data domains (across Schools and Services):

Data domains are responsible for all data deemed to be within the relevant data domain in accordance with the overall University IG policies and framework. This includes data held in corporate systems, as well as setting the policies and frameworks for locally held datasets relating to that domain.

Each data domain will have a data owner, with one or more data stewards. A listing of data domains and their owners is:

  • Pre-applicant data (Marketing and Advancement)
  • Applicant and student data (Academic Registry)
  • Alumni data (Marketing and Advancement)
  • Staff data (HROD)
  • Finance data (Finance)
  • Partner data (Research and Innovation Office)
  • Research data (Research and Innovation Office)
    • It is acknowledged that Data Ownership of Research data is complex due to the nature of research (e.g. the role of external partners both inside and outside the EU, the role of the lead academic in data management).  However, the Data Owner is responsible for setting policy and culture, not mitigating risks associated with individual research projects; it is for those responsible for the projects to manage these risks in line with the policies set out by the Data Owner.
  • Other data domains (named Professional Services)
    • The specific Data Domains shown above are those which have been identified thus far. Other Data Domains will exist across the University and a named Professional Service will need to be identified to take responsibility for each.

Local level (Schools and Professional Services):

Schools and Professional Services are responsible for locally held datasets which must be managed in accordance with the University’s overall IG policies and framework, as well as any policies and frameworks relating to specific Data Domains.

Each School and Professional Service must have a named data co-ordinator.