Skip to main content

Golden copies, data stewards, and sensitivity

The University stores and manages quite a lot of data - nothing like the scale of Google or similar behemoths, but not insignificant either.  Some of this data is quite sensitive.  It can include personal information (including the "protected characteristics" such as race or sexuality); medical information (for staff & students, or for NHS patients on research projects), commercially sensitive information, and information vital to the teaching process such as exam questions.  We are responsible for looking after this data and keeping it secure, a set of procedures that goes by the dry name of "data governance".

One of the key concepts in our approach to data governance is the "golden copy"; the one true source for a particular kind of information.  For example, the student record is the golden copy for data about students.  I have made this one of our Enterprise Architecture principles:
Principle D1: All data held in enterprise systems have a golden copy that holds the definitive value of that data.
We have had this principle in practice for many years. But if you want to know which system is the golden copy for a particular type of data, or who looks after that system, or how you access the data for yourself, you have had to know who to ask.  So I am creating a golden copy data catalogue that publicises this information.  I'm also working with the data governance group to come up with a default process for requesting access.

This throws a spotlight on the people who look after our data.  The usual name for this role in EA circles is the data steward.  As the name implies, someone who has this role is responsible for looking after the data, ensuring it is up-to-date and good quality.  Their responsibilities also include assessing requests for access, and making the data available to people who need it.  So we are working to define this role and work with people across the university so that our data is stewarded consistently.

I am also working with our Chief Information Security Officer (CISO) and our Data Protection Office (DPO) to agree a classification for information sensitivity.  The goal is to provide consistent advice for which data can be made public, which needs "normal" levels of security, and which needs more stringent controls.

So far, the response to this work has been very positive.  Much remains to be done, not least wider consultation with the people who do the crucial role of looking after our data.



Comments

Post a Comment

Popular posts from this blog

Project Leadership

When I look back over recent projects that I've been involved in, it seems that one key to making a project successful is having someone on the team who really drives it forward: someone who is invested in the project as a whole and not just their own part in it. We (by which I mean the University's Applications division) have a well-defined project process, with defined roles, required milestones, deployment standards, and so forth.    All these are useful, but if the team doesn't have a leader, it seems a project can lose its way, perhaps not responding to changing circumstances, getting stuck on a technical problem, or not securing a needed resource in time to meet some external constraint. The leader can be any member of the team - it could be a developer, a project manager, or the sponsor, or someone in another role.  A team can include several people who are this committed to the project; it doesn't have to be a single person.   As an example, one of...
Post a Comment
Read more

Business Model Canvas

A Business Model Canvas is a tool for mapping the core functions and capabilities of an organisation.  Compared to the Core Diagrams that I described in an earlier post , the business model canvas attempts to present more aspects of the business, starting with the value proposition – a statement of what the organisation offers to its users (in the business world, to its customers).  It shows the activities and resources, as Core Diagrams do, but also shows user relationships & channels, and also benefits and costs.  I’m not aware of any universities that have used this tool but you can find examples from elsewhere on the web. We are considering business model canvases as a tool for mapping the strategic capabilities of units at the University of Edinburgh.  Phil Taylor, our EA contractor, sketched an outline of what a business model canvas might begin to look like for HR: This is only intended to be suggestive: the real canvas would need to result from in-de...
2 comments
Read more

"That's not Grid!" - A cautionary tale

I don't usually attempt humour here, but see if you like this... Once upon a time, in the far-off world of Computerland, a great guru arose and declared a vision. "I see a future when all computers will be linked together and people will run their programs without knowing which computers are running them. People do not need to know where their jobs run; they just need the results. I call this Grid Computing!" The people of Computerland were excited by the guru's vision. They went away and worked to make it happen. When they were ready, they returned to the guru and said: "Oh great guru! We have implemented your vision. We can run our programs on whichever processor is free at the time, making sure that all programs can run and making best use of all our processors. No longer does one computer sit idle while another one is overloaded. Your vision is a great success!" "No, no, no!", said the guru, "That's not Grid!" The guru exp...
3 comments
Read more