Download Print Version

Corporate Data Management Policy
Responsibility for policy: Director of Information and Technology Services
Approving authority: Assistant Vice-Chancellor (Student and Information Services)
Last reviewed: February 2010
Next review date: February 2013
Application
1. This policy applies to all staff of the University of Waikato.
Purpose
2. The purpose of this policy is to establish a framework of principles to be applied to the
management, security and use of corporate data.
Related Documents
3. This policy should be read in conjunction with the following documents:
 Computer Systems Regulations 2005
 Staff Code of Conduct
 Personal Information and Privacy Policy
Definitions
4. In this policy:
corporate data means all data that is captured through the operation of the University, and
includes, but is not restricted to:
 human resource data
 financial data
 facilities data
 student data
 student management system data
 course and programme data
 University policies, procedures and manuals
primary source means the official University record for the relevant data, as identified by the data
in consultation with the Information Systems Group.
Principles
5. The following principles apply with respect to this policy:
a. Corporate data is an important resource in informing the strategy and management of the
University.
b. Corporate data should be readily accessible to inform decision-making.
c. All elements of the University's corporate data systems should be integrated.
d. New data systems developed or purchased by the University should be interfaced with the
current corporate data systems and not implemented as stand-alone systems.
e. Corporate data should be accurate and verifiable.
f. The value of corporate data is increased through widespread, timely and consistent use.
g. Any change in primary source data should be reflected in secondary sources.
h. Corporate data must not be used for an individual's own or for others' personal gain or profit,
or to satisfy one's own or another's curiosity.
Responsibilities
6. The Information Systems Group is responsible for:
a. promoting the value of University data for University-wide purposes and facilitating data
sharing and integration
b.
c.
d.
e.
f.
documenting and promoting the structure and logic of University data
identifying items of corporate data and distinguishing primary data sources
providing advice and support for security administrators
providing advice and support for data custodians
managing the integration of current and new systems as part of the University corporate
database
g. managing technological implementation of common standard codes and data definitions
throughout the University
h. liaising with data custodians with respect to approved uses for corporate data
i. managing the design and implementation of processes for maintaining the integrity, accuracy,
precision, timeliness, consistency, standardisation and value of data.
7. The ICT Committee is responsible for establishing the organisational entity with responsibility for
the custodianship of data contained within a particular corporate data source.
8. Deans, Directors or equivalent must ensure (where appropriate) that relevant staff in their areas of
responsibility are designated as:
a. security administrators
b. data custodians.
9. Data custodians are responsible for:
a. identifying and documenting authorities for access to data and levels of access
b. authorising downloads and uploads of corporate data
c. authorising access to corporate data
d. monitoring and enforcing the consistent application of processes for maintaining the integrity,
accuracy, precision, timeliness, consistency, standardisation and value of data
e. arranging appropriate training for staff and others to ensure data is captured and used
accurately and competently
f. implementing processes established by security administrators.
10. Security administrators are responsible for:
a. providing access to users as specified by data custodians
b. ensuring that appropriate safeguards exist to protect data and that appropriate disaster
recovery and business continuity procedures are in place
c. providing appropriate procedural controls to protect data from unauthorised access.
11. Data users:
a. are responsible for ensuring that all access to data through their user account is relevant and
appropriate to the work being undertaken
b. are responsible for ensuring that subsequent use and distribution of data accessed through
their user account is valid and appropriate
c. must not disclose University data to unauthorised persons without the consent of the relevant
data custodian
d. must not disclose their password to anyone
e. must abide by the requirements of the Privacy Act 1993 and other relevant statutes.
12. Line managers are responsible for ensuring that all data users within their area of responsibility
are aware of their responsibilities as set out in this policy.
Responsibility for monitoring compliance
13. The Director of Information and Technology Services is responsible for monitoring compliance
with this policy, and for reporting breaches to the Assistant Vice-Chancellor (Student and
Information Services).
14. Breaches of this policy may result in disciplinary action under the Staff Code of Conduct.