Enterprise Data Governance Policy

Title

University of North Carolina at Chapel Hill Policy on Enterprise Data Governance

Introduction

Purpose

Being a good caretaker of University of North Carolina at Chapel Hill ("University" or "UNC-Chapel Hill") data helps faculty and staff access the data they need. This policy and the Standard for Enterprise Data Governance explain how to be a good caretaker of data. They contain instructions on the best ways to classify, use, protect, and manage data.

This policy sets up a framework for protecting University data. This framework:

  1. gives responsibilities to the stewards, managers, and custodians of University data.
  2. empowers the Enterprise Data Coordinating Committee (EDCC) to give advice about the best way to manage and protect enterprise data that still meets the University’s needs.
  3. charges the EDCC with recommending standards and procedures for governing enterprise data.

Scope

This policy applies to everyone connected with the University who manages University data.

Policy

Policy Statement

Data is one of the University’s strategic assets. This means we need to follow sound practices and procedures to manage it. To learn more about the data this policy applies to see the Standard for Enterprise Data Governance. Some examples include information about students, employees, and finances.

It’s important to follow the UNC-Chapel Hill Information Classification Standard. It’s especially important to protect sensitive information, which the standard calls Tier 2 or 3 data.

The Chief Information Officer (CIO) has worked with other University officials to define other policies and standards that apply to enterprise data. Be sure to follow them as well.

Enterprise data should be available to those who need it because they have responsibilities at the University, as long as:

  • the way they access and manage data follows the law and other policies and standards, and
  • access the data to support the mission of the University and help it run well.

This policy works with other policies and laws that apply to University data. It does not replace them. These laws include: 

  • HIPAA (Health Insurance Portability and Accountability);
  • FERPA; and
  • North Carolina Public Records Law.

Roles and Responsibilities

Offices that interpret and apply the laws that govern data include the:

  • Public Records Office;
  • Institutional Privacy Office;
  • Internal Audit; and
  • the Office of University Counsel.

The EDCC helps govern the University's information technology. It develops the Enterprise Data Governance Policy and the related Standard. If needed, it recommends new standards for governing University data. The EDCC reports to the CIO, and the CIO appoints its members. Members include representatives from:

  • the Office of University Counsel;
  • University Archives;
  • Institutional Research and Assessment;
  • Information Technology Services;
  • Information Security Office;
  • Institutional Privacy Office;
  • senior University managers.

The CIO and the EDCC may create working groups to carry out their responsibilities. The Standard for Enterprise Data Governance defines the responsibilities of the EDCC.

The University owns enterprise data (we’ll refer to it here as University data), but departments, units, and schools are responsible for some subsets of it. This policy defines five roles for working with University data:

  • data trustees;
  • data stewards;
  • data managers;
  • data custodians;
  • those in technical roles.

The paragraphs below describe the five roles. You can learn more about them in the Standard for Enterprise Data Governance.

Data Trustees

Data trustees are advisors to the EDCC. Their authority comes from their position in the University. (See the Standard for Enterprise Data Governance for a list of data trustee positions.) Each data trustee oversees a broad segment of enterprise data at the University. They guide policy and strategic planning for that data. They also set up procedures and communicate policies for that data.

Of the roles in this policy, data trustees have the most responsibility. They make sure that access to the data in their segment is handled the right way. They also make sure the data is correct, secure, and available. Data trustees protect the privacy of data and support its integrity. Data trustees give authority to data stewards, managers, and custodians, and they are responsible for what they do. The Standard for Enterprise Data Governance defines what data trustees do.

Data Stewards

Data stewards oversee the data in a functional area and guide strategic planning for that data. Data stewards have authority because of their position at the University or because a data trustee gives it to them. If someone asks for data from their area, the data steward decides whether to give it to them. They also recommend policies, standards, and procedures to make sure the data in their area is:

  • accessed the right way;
  • correct;
  • secure; and
  • available.

They also protect the privacy of the data and maintain its integrity. Data stewards give authority for subsets of data to data managers and custodians. They are still responsible for all data in their area. The Standard for Enterprise Data Governance defines what the data stewards do.

Data Managers

Data managers are subject matter experts for the data in a subject area. Data trustees or stewards choose data managers for their expert knowledge in a subject. Data managers manage the day-to-day work for the data in their subject. They also set up business rules for that data. If someone outside their unit asks to use this data, they decide whether to let them. They also set constraints on how the data is used. Data managers are accountable for the data they manage. This is true whether they collect and maintain the data themselves or whether others do. The Standard for Enterprise data Governance defines what data managers do.

Data Custodians

Designated by Data Trustees or Data Stewards, are University employees who have administrative and/or operational responsibilities for Enterprise Data. Specific responsibilities of Data Custodians are defined in the Standard for Enterprise Data Governance.

Technical Roles

The CIO gives authority to the technical staff who manage our systems and keep them secure. Technical staff help enforce policies and standards by building rules into our networks and systems. They work with those responsible for University data to make sure the right people have the right access. They act as gatekeepers. They make sure the tools that grant access follow needs and rules set by the business units. Technical staff also:

  • develop and support systems;
  • supply security and monitoring services;
  • advise the EDCC when the security of enterprise data is at risk;
  • do the technical work needed to manage enterprise data.

The Standard for Enterprise Data Governance defines what technical staff do.

Definitions

  • Access: The right to read, enter, copy, query, upload, download, or update data.
  • Data: The representation of discrete facts, ideas, or pieces of information. Any information in electronic or audiovisual format, and any hardware or software that enables the storage and use of such information.
  • Enterprise Data: Any data or records that UNC-Chapel Hill employees or other people create or receive while conducting University business. This does not include data excluded by this policy or the Standard on Enterprise data Governance. Enterprise data includes machine-readable data, data in electronic communication systems, data in print, and data that has been backed up or archived on any media.

Related Requirements

External Regulations and Consequences

University Policies, Standards, and Procedures

Contact Information

Policy Contact

Unit: ITS Policy Office

Phone: 919-962-HELP

Email: its_policy@unc.edu

Important Dates

  • Effective Date and title of Approver:
    1. Effective Date: December 12, 2010 (Formerly "Institutional Data Governance Policy")
    2. Approver: Chief Information Officer
  • Revision and Review Dates, Change notes, title of Reviewer or Approver:
    1. Last Revised Date: January 2, 2018
    2. Revised by: Revised by the Enterprise Data Coordinating Committee to reflect current Data Governance best practices, to adhere to the new University Policy on Policies. Approved by the Vice Chancellor for Information Technology & CIO.
    3. Substantive Revisions:
      1. Complete revision. Moved from three-tier to four-tier governance model, added and defined technical roles, clarified roles and responsibilities.
      2. Revised by the Enterprise Data Coordinating Committee to reflect current Data Governance best practices, separated into Policy and Standard to adhere to the new University Policy on Policies.
100% helpful - 1 review

Details

Article ID: 131263
Created
Thu 4/8/21 9:05 PM
Modified
Thu 10/27/22 10:37 PM
Effective Date
If the date on which this document became/becomes enforceable differs from the Origination or Last Revision, this attribute reflects the date on which it is/was enforcable.
02/26/2020 8:24 AM
Issuing Officer
Name of the document Issuing Officer. This is the individual whose organizational authority covers the policy scope and who is primarily responsible for the policy.
Issuing Officer Title
Title of the person who is primarily responsible for issuing this policy.
Vice Chancellor for Information Technology and Chief Information Officer
Last Review
Date on which the most recent document review was completed.
10/27/2022 12:00 AM
Last Revised
Date on which the most recent changes to this document were approved.
01/02/2018 11:00 PM
Next Review
Date on which the next document review is due.
10/27/2025 12:00 AM
Origination
Date on which the original version of this document was first made official.
12/11/2010 11:00 PM
Responsible Unit
School, Department, or other organizational unit issuing this document.
Information Technology Services

Related Articles (2)

This Standard to the Policy on Enterprise Data Governance describes each role that plays a part in governing University Data at the University of North Carolina at Chapel Hill ("University"). The roles are: Enterprise Data Coordinating Committee (EDCC); data trustees, data stewards, and data managers, who make up the Data Governance Oversight Group (DGOG); and data custodians in units across campus. This Standard also defines what kind of data makes up the University’s "enterprise data."
The Information Classification Standard gives a structure for the University's information. This structure helps us recognize the types of University Information we handle. It makes it easier to keep the information safe. This Standard considers the University's academic culture, which values sharing information. Classifying information the right way gives everyone at the University, at every level, a structure that supports their University activities.