°Ç¸ç³Ô¹Ï

1. Introducing the data ownership model

Government data assets are vital to the nation because they support the formulation of evidence-based policy making, economic growth and public accountability. Their wide-ranging impact fuels innovation, enhances transparency, enables better public services and empowers citizens. This means it’s essential that the government manages itsÌýassetsÌýeffectively to fully realise their value in a legal,ÌýethicalÌýand secure way.Ìý

The government needs a consistent framework around data ownership. The lack of a shared understanding of roles, accountabilities and responsibilities is most deeply felt around critical data which multiple public sector organisations may rely on. This lack of a shared approach prevents effective cross-government data sharing and our ability to reuse data for public good.Ìý

Data governance maturity levels vary across government. Some organisations already have data ownership policies and implementation plans in place,ÌýwhereasÌýothers are at theÌýearly stagesÌýof creating an enterprise-level model. This model helps public sector organisations understand the importance of data ownership behaviours and principles and ensure they have the policies and plans in place. Where public sector organisations already have ownership policies, it’s an opportunity to assess, update where needed and reinforce the message about its importance.Ìý

This guidance formalises the roles of the people in government responsible for managing data throughout its life cycle. The guidance explains bestÌýpractice, andÌýencourages a consistent and standardised approach to data ownership across government.

2. What data ownership is

Data ownership does not deal with ‘possession of data’. It’s about formalising the roles of people responsible for the management of data throughout its life cycle. ItÌýestablishesÌýaccountability for data access and usage, solving issues, iterating and versioning access and ensuring compliance with legislation,ÌýregulationsÌýand applicable guidelines.

3. Why data ownership is important

Data is one of the most valuable assets in your organisation.ÌýIt’sÌýalso a liability with significant risks if not guarded, such as theft,ÌýlossÌýor misuse. It must be protected and managed to:Ìý

• be fit for purposeÌý
• be used lawfully and ethicallyÌý
• provide maximum value to your organisation and the rest of governmentÌý

It’sÌýcritical that your organisation has people with the right data ownership roles. This will ensure that you:Ìý

• comply withÌýregulations, legislation,ÌýpoliciesÌýand standardsÌý
• define and implement data controls to manage risk and data securityÌý
• have data assets that serve their intended business purpose and realise their full potential value through enhanced cross-government data sharingÌý
• have confidence in your data, and can make reliable decisions based on its integrityÌý
• reduce data duplication and inefficiencies

4. What we mean by data

The Government Functional Standard for Digital defines data as ‘information that has been translated into a form that is efficient for movement or processing’. When we talk about data ownership, weÌýgenerally meanÌýownership of highly structured data sets (oftenÌýcontainingÌýpersonal data) of the kind which are vital to departments working together to deliver effective services. An information asset is a body of information, defined and managed as a single unit so it can be understood, shared,ÌýprotectedÌýand exploited effectively.ÌýÌý

There is no single, correct way to segment your data into logical groupings or data domains. Each organisation will have its own way of doing this, based on its business needs or areas of strategic interest.

5. Principles of data ownership

Adopting this data ownership model will help you follow these principles.Ìý

1. Data is recognised as a valuable resourceÌý

Your organisation’s data hasÌýgreat potentialÌývalue to the digital economy. Assess your data whenever possible to support decisions about:Ìý

• investing in itÌý
• encouraging data sharingÌý
• realising its wider commercial and societal value through protection and exploitationÌý

2. Data is managed throughout its life cycleÌý

You must handle data in line with policies,ÌýstandardsÌýand legislation.Ìý

This includes:Ìý

• Ìý
• Ìý
• Ìý
• Ìý
• Ìý
• Ìý
• The Data and AI Ethics FrameworkÌý
• The Data Sharing Governance FrameworkÌý
• The Data Maturity Assessment for GovernmentÌý
• The Rose BookÌý

3. Data is secureÌý

Protect your data from unauthorised access – whether malicious,ÌýfraudulentÌýor accidental.Ìý

4. Data is definedÌý

Clearly and consistently define your data for common interpretation.Ìý

5. Data is FAIRÌý

Ensure your data isÌýÌý– findable, accessible,ÌýinteroperableÌýand reusable.Ìý

6. Data is standardisedÌý

Apply common data standards wherever possible.Ìý

7. Data is fit for its intended purposeÌý

Your data should be of the qualityÌýrequired, depending on how you intend to use it.Ìý

8. Data is authoritativeÌý

Share your data from a qualified authoritative source wherever possible.

6. Data ownership roles and responsibilities

An importantÌýobjectiveÌýof data ownership is shifting the view of data as an asset to data as a product. This is about government, and the wider public sector, defining and proactively measuring how and where data isÌýactually usedÌýand adds value.Ìý

Finding ways to define and measure value is an important part of the roles of data owners,ÌýstewardsÌýand custodians.Ìý

Data owners and information asset owners (IAOs) are accountable for assets as they ultimately ‘own’ the asset, making decisions on major changes and being answerable for them. Data stewards and asset managers are responsible as they are experts on what is held within the asset and responsible for itsÌýday-to-dayÌýmanagement.Ìý

Data ownersÌý

A data owner is a senior individualÌýwith dedicated accountabilitiesÌýforÌýdata, and in-depth insights of the overall business strategy in their data remit.ÌýThis may include the overall accountabilityÌýfor the meaning, content, quality and management of a logical grouping of data, or distribution of a given set of data.

ByÌýliasingÌýwith a team of operational data stewards,Ìýthey are empowered to steer and ensure the data is fit for its intended purpose and used appropriately.ÌýÌý

Data owners:Ìý

• act as the strategic points of contact for the data within their remitÌý

• should have a position at the leadership level – for example,ÌýaÌýseniorÌýcivil servant (SCS) particularly where the data sets are large or complex (for smaller or medium-sized data sets with less impact, a Grade 6 or Grade 7 level might be moreÌýappropriate)Ìý

• need to be able to use their authority and knowledge of business strategies and processes underpinning the data to make decisionsÌý

• do not need a granular understanding of the dataÌý

Using their knowledge of data applications, data owners:Ìý

• liaise with a team of operational data stewards to ensure data is fit for its intended purposeÌý

• influence the strategic direction of dataÌý

• approve changes to dataÌý

• support data governance practices in their areaÌý

• allow organisations to make faster decisions around data to achieve business outcomesÌý

What data owners are accountable forÌý

Data owners have accountability for:Ìý

• understanding how their data is being used, who by and where, data lineage and flow of data, and whether it’s controlled properlyÌý

• working with business requirements to define centralised data definitions for their subject areasÌý

• providing guidance to data stewards to ensure definitions are managed and adopted consistentlyÌý

• strategic data decisions and approvals around business requirements and modifications to their dataÌý

• ensuringÌýappropriate identification,ÌýprotectionÌýand exploitation of data assets for wider governmental,ÌýsocietalÌýand economic value, in collaboration with the organisation’s knowledge asset senior responsible owner (SRO) where there is oneÌý

• ensuring that their data stewardsÌýmaintainÌýagreed data definitions in the data catalogueÌý

• ensuring that the quality of the data theyÌýare responsible forÌýis known, considering all critical data usersÌý

• the management,ÌýmonitoringÌýand reporting of activities to improve their data through their data stewardsÌý

• ensuring security measures,Ìýin accordance withÌýthe organisation’s policies, are in place to protect data that is in transit, data received, or data transferred to another organisationÌý

• ensuringÌýan appropriate retentionÌýschedule is in place outlining storage periods for all data (particularly personal data), which is reviewed regularlyÌý

• ensuring their data assetsÌýcomply withÌýlegal requirements for archival, disposal and preservationÌý

• limiting access to data (particularly personal data or data of significance to national security) to those authorised to do soÌý

• ensuring that data setsÌýcomply withÌýlicensing agreements and that the data is used appropriatelyÌý

Skills that data owners needÌý

Data owners should:Ìý

• have a strong ‘data mindset’ – this means they should:Ìý

  • be data literateÌý

  • understand the benefits of data governance, and be able to implement a data governance strategyÌý

  • understand how data is governed,ÌýmanagedÌýand exploited within their data domain, so they can maximise the value of their data assetsÌý

  • be experienced leaders with a proven ability to deliver results and drive change – this includes:Ìý

  • persuade colleagues to adopt a data governance framework,ÌýstandardsÌýand workflowsÌý

• embed data governance at pace to help their organisation deliver on its timelines and commitmentsÌý

• ensure there is operational and governance reportingÌý

• ensure that key performance indicators (KPIs) are appropriately set and approvedÌý

• solve problems, removingÌýbarriersÌýand ensuring issues areÌýidentifiedÌýand remediedÌý

• be strong communicators – they should be able to communicate complex ideas to non-technical audiencesÌý

• have experience working effectively across theÌýdifferent functionsÌýin their organisation, such as business and operationsÌý

Currently in some organisations the data owner may be a dedicated data role, whilst in others it may be just one of several responsibilities held by individuals with limited dataÌýexpertise. Given the strategic importance to government ofÌýcritical data assets, we recommend that those responsible forÌýcritical data assetsÌýdevelop their data capabilities in line with this model.

Data stewardsÌý

Data stewardsÌýare responsible for day-to-day operational activities in their data domain that support data owners’ decisions, and for implementing policies,ÌýstandardsÌýand processes.

As subject matter experts (SMEs), data stewards should have a deep knowledge of their business area, including its rules and requirements. They need strong communicationÌýand collaboration skills to help ensure that data flows smoothly in their organisation.

Having operational points of contact with dataÌýexpertiseÌýwill help your organisation to embed data-related policies and strategies, and set up sustainable data governance processes.

What data stewards are responsible for

Data stewards have responsibility for:Ìý

• handling data governance queries, and asking data owners for tactical guidance when neededÌý

• facilitating data governance processes, including:Ìý

  • data accessÌý

  • data archivalÌý

  • data deletionÌý

• facilitating data quality governance processes, such as:Ìý

  • monitoringÌý

  • investigatingÌý

  • communicatingÌý

  • triagingÌý

  • remediatingÌý

  • reportingÌý

• reporting to the data owner and other forums on activities including:Ìý

  • complianceÌý

  • issuesÌý

  • fixesÌý

  • changesÌý

• maintaining and implementing data standards and process documentation, for example a business glossary, in the data catalogueÌý

• creating processes, procedures and standards for their data domain that is aligned to their organisation’s policiesÌý

• relationship management and understanding data flows to understand the impact of anything that may changeÌý

• contributing to the development, maintenance and implementation of agreed data standards and reporting measuresÌý

• working with data custodians toÌýfacilitateÌýdiscussions aroundÌýÌý

• discussing technical requirements with data custodians, including changes to data governance standardsÌý

• assistingÌýwith periodic data maturity assessmentsÌý

Data custodiansÌý

Data custodiansÌýare responsible forÌýcapturing,ÌýstoringÌýand disposing of data in line with the data owner’s requirements.Ìý

They work closely with data stewards to:Ìý

• ensure data qualityÌý

• operationalise data decisionsÌý

• support data governance implementation within the tools theyÌýare responsible forÌý

Data custodians should be technical SMEs for the systemÌýcontainingÌýtheir assigned data.Ìý

They should:Ìý

• have in-depth knowledge andÌýexpertiseÌýaround the systemÌý

• be able to explain how to design and execute technical activities related to data governanceÌý

What data custodiansÌýare responsible forÌý

Data custodians have responsibility for:Ìý

• assistingÌýdata stewards with technical and system-related queriesÌý

• identifyingÌýand reporting data governance issues to the data steward and data ownerÌý

• producing impact assessments for implementing system changes led by the data stewardÌý

• implementing technical requirements according to data standards and rules within their systems and data types – for example, adding a character limit on a fieldÌý

• guiding other technical teams to use standards and definitionsÌý

• implementing user access policies specified by the data owner, including theÌýappropriate physicalÌýand technical safeguards to protect the confidentiality,ÌýintegrityÌýand availability of the data assetÌý

• ensuring that data quality is sustained during technical processingÌý

• resolving data quality issues in partnership with data stewardsÌý

• ensuring that changes to data content and controls can be auditedÌý

Executive leadership rolesÌý

The following roles are also likely to be involved when you adopt this data ownership model.Ìý

Chief data officerÌý

A senior, executive-level role with responsibility for the organisation’s enterprise-wide:Ìý

• data and information strategyÌý

• governanceÌý

• controlÌý

• policy developmentÌý

• effective exploitationÌý

This role combines accountability and responsibility for information protection and privacy, information governance, dataÌýqualityÌýand data life cycle management, along with the exploitation of data assets to create business value.Ìý

Chief data and information officer (CDIO)Ìý

A senior executive role responsible for managing an organisation’s data and information strategy. The CDIO is accountable for digital transformation, data governance, technologyÌýinfrastructureÌýand information assurance. Though information and data governance are distinct responsibilities they are combined here into a single role.Ìý

Data protection officer (DPO)Ìý

A specified role defined in data protection law under the UK GDPR. DPOs work in an independent manner to:Ìý

• monitor their organisation’s internal complianceÌý

• advise on their organisation’s data protection obligationsÌý

• advise on Data Protection Impact Assessments (DPIAs)Ìý

• act as a contact point for data subjects and the Information CommissionerÌý

Chief technology officer (CTO)Ìý

A senior, executive-level role with responsibility for the organisation’s technological infrastructure. CTOs ensure that the technology aligns with the organisation’s goals.Ìý

Chief digital officerÌý

A senior, executive-level role with responsibility for driving digital transformation within an organisation, using the potential of online technologies and data.Ìý

Chief information security officer (CISO)Ìý

A designated individual responsible for the security of information in electronic form. CISOsÌýadviseÌýthe board on how best to exploit technology to deliver the organisation’s strategicÌýobjectives.Ìý

CISOs also provide strong strategic leadership for the organisation’s IT community and its investment in technology.Ìý

CISOsÌýare responsible forÌýtheir organisation’s:Ìý

• IT strategyÌý

• IT architectureÌý

• IT policies and standardsÌý

• technology assuranceÌý

• IT professionalismÌý

Board-level executive or senior information risk owner (SIRO)Ìý

SomeoneÌýwithÌýparticular responsibilityÌýfor information risk.Ìý

Process owners and enterprise data ownersÌý

In larger, more complex organisations, you might need a process owner role.Ìý

You should also considerÌýestablishingÌýan enterprise data owner (EDO) if:Ìý

• data is being shared across government departments or other public sector organisationsÌý

• you’reÌýusingÌýadditionalÌýprocessing to transform the dataÌý

EDOsÌýare responsible forÌýspecific, logical groupings of data or data domains (such as entities and attributes). EDOs ensure a consistent and common approach across data assets within and beyond their organisation.Ìý

How process owners and EDOs work togetherÌý

EDOs:Ìý

• define data attributesÌý

• establish business rules around the validity of the dataÌý

• set thresholds for others to followÌý

They might also define the conditions for how data is used.Ìý

Process owners must work closely with the EDO to ensure the integrity of the original data is not compromisedÌýin the process of:Ìý

• transformationÌý

• enrichmentÌýÌý

• aggregationÌý

In this type of arrangement, EDOs need to ensure the necessary policies and standards are in place. However, they do not necessarily need to have accountability for the accuracy,ÌýsecurityÌýand protection of the dataÌýthat’sÌýoutside their direct sphere of influence.Ìý

In addition to their day-to-day role, process ownersÌýare responsible for:Ìý

• managing data risks, and assuring IAOs and EDOs that risks are mitigatedÌý

• enforcing data policies and standards to improve the data involved in their processesÌý

• building awareness in their organisation so that managers,ÌýstaffÌýand contractors understand their areas of responsibility in relation to data protection, security,ÌýqualityÌýand capabilityÌý

Data protection rolesÌý

TheÌýÌýdefines the role of a data controller as the natural or legal person, public authority,ÌýagencyÌýor other body which, alone or jointly with others,ÌýdeterminesÌýthe purposes and means of the processing of personal data. Public sector organisations act as the data controller for UK GDPR purposes.Ìý

A data controller is a person or organisation that:Ìý

• decides how personal data is processed under the UK GDPRÌý

• is responsible forÌýcomplying withÌýthe UK GDPRÌý

Public sector organisations often decide that the organisation as a legal entity is the data controller for UK GDPR purposes.ÌýÌý

In the context of the UK GDPR, data owners are accountable for the quality,ÌýintegrityÌýand protection of their data domain.Ìý

To cover the accountabilities of the data controller, dataÌýownersÌýpartner with their organisation’s:Ìý

• data stewardsÌý

• data protection officerÌý

• chief data officerÌý

• chief technology officerÌý

• chief digital officerÌý

• senior information risk ownerÌý

• chief information security officer (where there is one)

7. Merged data sets and data services

For any model where data is processed, you must clearly define and attribute accountabilities for data to individuals or institutions.Ìý

Example use cases of merged dataÌý

These use cases pose challenges to the traditional model of data ownership of a data asset:Ìý

• data merged or linked fromÌýdifferent sourcesÌýto become a new data setÌý

• data being drawn fromÌýdifferent sourcesÌýinto a data lake, from which analysis and insights areÌýdrawnÌýand data repurposed for multiple needsÌý

• data being held in a trust or a cooperative where an institution, or individuals, steward the use and potential repurposing of data in the interests of those itÌýrepresentsÌý

In these cases, data is one of the following:Ìý

• transferred to an individual,ÌýinstitutionÌýor platform for usageÌý

• consumed at source via an Application Programming Interface (API) or other method, such as secure file transferÌý

In these scenarios, the source data owner must agree to the conditions for how the data is provided. This includes:Ìý

• transfer of ownership orÌýretainedÌýownershipÌý

• how access will be managedÌý

• defining the decisions that data stewards and custodians can make on behalf of data providers

Data platforms and servicesÌý

Where a data platform or service is involved, your organisation will usually need a new role of product or service owner.Ìý

This person will have specific accountability for:Ìý

• developing andÌýoperatingÌýthe platform or serviceÌý

• who accesses and uses the serviceÌý

• how data is used within the terms and conditions provided by the source data ownerÌý

Data licensing impact on data ownersÌý

While data stewards handle the day-to-day management of licensing, data owners need to understand the importance of data licensing and its implications. Data ownersÌýare responsible forÌýensuring that data setsÌýcomply withÌýlicensing agreements and that the data is used appropriately.

This includes:Ìý

• overseeing the application of licenses –Ìýensuring that the correct licenses are applied to data sets

• ensuring compliance with usage restrictions –Ìýmaking sure that all data usageÌýcomplies withÌýthe terms of the licence

• addressing licensing issues –Ìýhandling any issues related to licensing promptly and effectively

• handling sharing requests –Ìýunderstanding licensing terms to correctly address and manage data sharing requests

Data from a third partyÌý

When data is received from a third party (like a university or external research institution) or from an ALB, the receiving entity becomes the data owner for the copy of the asset they hold. This means that once the data is transferred to the organisation or its ALBs, theyÌýare responsible forÌýmanaging andÌýmaintainingÌýthat copy.

This includes ensuring data quality, compliance and proper usage. However, the original senderÌýretainsÌýownership of their version of the data and continues to govern it unless explicitlyÌýstatedÌýotherwise.Ìý

Does open data require a data owner?

Open data requires a data owner. Data ownership for open data is crucial because it ensures the dataÌýremainsÌýaccurate, current and properlyÌýmaintainedÌýeven when made publicly accessible. A data ownerÌýis responsible forÌýoverseeing the data set(s), ensuring it meets quality standards, and resolving any issues that may arise. This accountability helpsÌýmaintainÌýthe integrity and usability of open data.

8. The relationship between data ownership and information asset ownershipÌý

The data owner role andÌýtheÌýIAO role are both important in managing data, including personal data, within government.ÌýÌý

Information asset ownership is wellÌýestablishedÌýin government.ÌýIAO guidanceÌýaims to ensure information assets are managed effectively so it can be understood, shared,ÌýprotectedÌýand exploited effectively. Responsibilities for the role are primarily focused on safeguarding and managing the overall information asset (including compliance and physical or digital security).Ìý

Data ownership looks more broadly at the quality, clarity and value of the data, and owners act as a bridge between business needs and technicalÌýexpertise.

Data ownership in contextÌý

Introducing new activities is an opportunity to review the wider approach to data and information management within your organisation.ÌýÌý

It’sÌýimportant to apply data ownership in the wider organisational context, which may include an existing information asset ownership approach. Some organisations may choose to integrate data ownership intoÌýtheirÌýexistingÌýinformation asset ownership approach. Others may choose to wrap information asset owner activities into their data ownership approach.Ìý

What’sÌýimportant is that you undertake all the relevant activities.

Taking an integrated approach to data ownership and information asset ownershipÌýÌý

Given the close relationship between data and information, there could be significant value in taking an integrated approach to data and information ownership. Being joined up could help to ensure the overall landscape is coherent, avoid unnecessary pressures on resources andÌýdouble-taskingÌýof staff. There may be existing support mechanisms,ÌýcommunitiesÌýand frameworks that data ownership could dock into – for example, an IAO handbook or training module.ÌýÌý

Adopting a modelÌý

Your organisation should think carefully about the following questions before deciding which model to adopt:Ìý

• will there be different teams overseeing data ownership and information asset ownership, and ifÌýsoÌýhow will you achieve a joined-up approach?ÌýÌý

• who in the organisation holds ultimate accountability for data assets, and is this the same person as for information assets?Ìý

• areÌýyour information assetÌýownersÌýsenior enough and skilled enough to implement changes to data management?ÌýÌý

• how does your organisation use the terms ‘data’ and ‘information’ and how might they be interpreted by staff? These terms may be used interchangeably or there may be scenarios where a distinction is importantÌýÌýÌýÌý

Your organisation has 3 choices when it comes to deciding how to ensure there isÌýan appropriate ownershipÌýmodel in place to meet its needs. However, you must ensure you meet the specific actions mandated of IAOs in theÌýIAO guidance.Ìý

The options are:

1. continue with the information asset ownership model but ensure data ownership accountabilities and responsibilities are absorbed into your existing IAO roles

2. adopt the data ownership model, ensuring that you cover mandatory information asset ownership actions withÌýappropriate roles

3. adopt a hybrid model in which IAOsÌýare responsible forÌýcore information assets – such as databases or ICT systems that hold personal data – but are supported by data owners responsible for specific data assets such as reference or master data

If you choose the first optionÌý

You should consider theÌýadditionalÌýaccountabilities and responsibilities of data owners, stewards and custodians and map these toÌýappropriate rolesÌýsuch as information asset managers and local information asset managers.Ìý

It’sÌýessential that when you apply the model, it extends to all your data assets including those that do not relate to personal data. When incorporating data ownership activities into an existing information asset ownership model, your organisation should consider the following questions:Ìý

• does your organisation consider data assets to be subsets of information assets? How are these data sets linked to information assets? Do all data sets need to ‘belong’ to an information asset?Ìý

• if your IAOs are also data owners, do they have the right skills and support to meet their data ownership responsibilities? Data owners do not necessarily need to have a granular understanding of the data they are accountable for, but they do need to be data literate, with a strong ‘data mindset’

• can you avoid unnecessary granularity and duplication in the recording of data assets and information assets?Ìý

• can you improve consistency between your organisation’s information asset register, data catalogue and register of processing activities?

If you choose the secondÌýoptionÌý

You should ensure that your data owners fulfil the mandatory actionsÌýrequired ofÌýIAOs. There’s training on Civil Service Learning to support the IAO role, which is recognised as a specialist role with theÌýGovS 007 Security Functional Standard.ÌýÌý

WhicheverÌýoptionÌýyou chooseÌý

Your organisation should ensure there isÌýappropriate governanceÌýin place to support your chosen model.

The governance must define:Ìý

• where accountability lies for data and information assets in your organisation – clarify if there are different governance processes for data and informationÌýÌý

• who your data owners and IAOs are accountable to – for example, a chief data officer or SIROÌý

• how your accounting officer will be assured that the right data ownership activities are being undertaken at the right levelÌý

• how data quality is factored into your organisation’s existing governance processesÌý

Can a data owner and an IAO be the same person?Ìý

The difference between a data owner and a project managerÌý

The difference between a data owner and a portfolio managerÌý

The difference between a data owner and a programme managerÌý

The difference between a data owner and a product ownerÌý

Can a data owner have multiple roles, such as being a project manager or portfolio manager?Ìý

The process of becoming a data ownerÌý

Promoting and ensuring a culture of data ownership within the organisationÌý

When to think aboutÌýallocatingÌýdata assets a data ownerÌý

Steps to transition data ownership when someone leaves the organisationÌý

How often data ownership should be reviewed or updatedÌý

What support the data owner needs from their teamÌý

Measuring the success of data ownership initiativesÌý

9. A checklist for your organisation

Your organisation must:Ìý

• have an enterprise-level data ownership model and supporting guidance in place that recognises that:Ìý

  • data ownership is the responsibility of the business and not the technology domainÌý

  • the responsibilities of ownership are not exclusive to a single person and require close collaboration across organisational levels, including the delegation of responsibilities from the senior ownersÌý

• ensure that enterprise-level ownership policies include monitoring and reporting arrangements as part of their organisation’s broader risk management practices (for example,ÌýidentifyÌýand counter any internal or external potential vulnerabilities and threats, which may be incorporated into the broader information asset risk management processes)Ìý

• ensure data assets are included in their organisation’s asset registers and considered in their organisation’s asset and knowledge asset management strategiesÌý

• consider where data assets may have value to wider government, society and the economy, and the protection and exploitation approachesÌýrequiredÌýto realise itÌý

• have named owners for all data assets determined to be critical at an enterprise levelÌý

• have a nominated accountable individual data owner for each data asset determined to be aÌýcritical data assetÌý(as defined in published guidance)Ìý

• ensure everyÌýcritical dataÌýasset hasÌýaccurateÌýmetadata, which must include the name and roles of responsible data owners and data steward(s)Ìý

• include information about critical data assets (cross-government and enterprise-level) and any critical data elements they include within a central register or catalogue managed by the enterprise, linking the name of the owner with the assetÌý

• ensure that eachÌýcriticalÌýdataÌýasset (cross-government and enterprise-level) has an owner who understands what they are accountable forÌý–Ìýowners must ensure that stewards and process owners understand their responsibilities

• ensure that where data is shared between public sector organisations and with other sectors it includes agreed roles,ÌýaccountabilitiesÌýand responsibilities in line with this modelÌý

• ensure the interoperability (the ability to share and use between different computer systems and software) of all its data, with its critical data prioritised, through common standards and practical steps such as data owners recognising the importance ofÌýmaintainingÌýgood qualityÌýreference data

  • where common data is used across business processes, services, products and systems, organisations should considerÌýestablishingÌýan enterprise data model with data ownership agreed at a conceptual data model layer

10. Appendices

Appendix A: Comparing accountabilities and responsibilities of data owners and IAOs

Area	Data owner	IAO
Overall accountability	Accountable for the value, quality, life cycle and strategic use of a data asset	Accountable for protecting, managing, and governing an information asset
Understanding of data	Understand how data is used, who uses it,ÌýlineageÌýand flow of data	Maintain understanding of information asset: what is held, added, removed, how it moves, who accesses it and why
Cultural leadership	Promotes culture of data ownership, value realisation and cross-government sharing	Fosters a culture of information protection, lawful processing, compliance
Data or information asset governance	Approves strategic changes to data; influences governance practices	Ensures information asset is governed according to security policy, risk frameworks, data protection legislation
Ownership scope	Logical grouping of data or data domain (data as product)	Entire information asset (including data, documents, records, ICT systems, paper assets)
Business strategy alignment	Aligns data use with business strategy; influences strategic direction of data	Ensures information asset supports business needs, ensures legal and security alignment
Merged or shared data sets	Defines ownership and sharing rules for merged or shared data sets; manages value realisation	Approves shared use of information asset; ensures ongoing compliance with data-sharing policies
Responsibility for third-party data	Accountable when data is received from third parties; becomes owner of the copy held	Accountable for information asset when third-party data forms part of it; ensuresÌýappropriate controlsÌýare in place
Responsibility for third-party data	Accountable when data is received from third parties; becomes owner of the copy held	Accountable for information asset when third-party data forms part of it; ensuresÌýappropriate controlsÌýare in place
Data productÌýlife cycle	Accountable for continuous improvement and iterative evolution of data as a product	Focus is onÌýmaintainingÌýintegrity and protection of information asset across itsÌýlife cycleÌý(does not treat information asset as a ‘product’)
Data sharing	Approves conditions for data sharing; ensures licensing terms are respected	Approves sharing of information asset data; ensures data sharing is lawful, proportionate, necessary
Data standards	Ensures data is defined, FAIR (findable, accessible, interoperable, reusable), standardised	Ensures information assetÌýcomplies withÌýpolicy and process standards
Engagement with enterprise data models or reference data	Leads alignment with enterprise data models, ensures authoritative sources	Not typically responsible for driving enterprise data model alignment (information asset manager or technical roles may support)
Security and protection	Ensures data security (in transit, at rest, when shared); ensures security measures are implemented	Maintains and monitors information asset security: access control, physical and logical protections, incident response
Data definition	Defines centralised data definitions; provides guidance to stewards to manage definitions	Not explicitly accountable for data definition
Data quality	Accountable for quality of data acrossÌýlife cycle; monitoring and improving quality	Not explicitly accountable for data quality
Training and awareness	Embeds data governance awareness, promotes data culture	Must complete IAO training; responsible for fostering culture of protection and compliance in business area
Working with stewards / information asset manager	ProvidesÌýstrategic guidance to data stewards who manage day-to-day data activities	Appoints information asset manager to manage day-to-day information asset management andÌýmonitoring (including trainingÌýand culture)
Collaboration with custodians	Works with data custodians for technical implementation of governance	Information asset manager works with information technology systems and information asset governance for technical controls on information asset systems
Engagement with SIRO / chief data officer / DPO	Collaborates with SIRO, chief data officer, DPO for and strategic data governance	Accountable to SIRO; works with DPO, chief data officer, information asset managers, information asset governance for compliance and reporting
Innovation and value realisation	Actively drives opportunities for data innovation, re-use, cross-sector value	Typically focused on safeguarding, not exploitation of value
Licensing	Accountable for ensuring the use of the data assetÌýcomplies withÌýlicensing agreements	Accountable for ensuring any data shared from information assetÌýcomplies withÌýlegal or licensing terms
Incident management	Works with stewards on incident prevention and response; ensures data breach processes exist	Accountable for data incident investigation and reporting; ensures staff awareness of incident policies
Risk management	Understands and manages data-related risks; ensures risk management is part of governance	Undertakes risk impact assessments on information asset; manages and reports risks to SIRO, ensures mitigations are in place
Access control	Limits access to data (especially personal or sensitive data); monitors data access practices	maintains log of information asset access; ensures authorised access only; monitors handling activities
Retention and archival	EnsuresÌýappropriate retentionÌýschedule;Ìýcomplies withÌýlegal requirements on archival or disposal	Sets information asset retention or review period; ensures disposal mechanisms are approved and lawful
Audit and monitoring	Ensures monitoring and reporting of data management activities	Ensures compliance monitoring is conducted on information asset;ÌýparticipatesÌýin regular assurance processes (information asset governance, SIRO)

Appendix B: RACI matrix for data owners and IAOs

Legend:Ìý

• RÌý= Responsible (does the work)ÌýÌý

• AÌý= Accountable (owns the outcome)ÌýÌýÌý

• CÌý= Consulted (provides input)ÌýÌýÌý

• IÌý= Informed (kept up to date)

Responsibility area	Data owner	IAO
Define data ownership model and data domains	A	I
Define information asset structure and register	I	A
Understand data flow, lineage, usage	A	C
Understand information asset flow, movement, and access	I	A
Ensure data compliance with the , the and licensing	A	A
Ensure information asset compliance with the UK GDPR, the Data protection Act 2018 and licensing	C	A
Approve strategic changes to data	A	I
Approve information asset -related changes (systems, processes)	I	A
Define andÌýmaintainÌýdata definitions and standards	A	C
Maintain information asset register	I	A
Implement data security measures (logical)	A	C
Implement information asset security measures (physical and logical)	C	A
Approve data sharing agreements	A	C
Approve information asset data sharing agreements	C	A
Data risk identification and mitigation	A	C
Information asset risk identification and mitigation	C	A
Monitor and report data quality	A	I
Monitor and report information asset compliance	I	A
Define andÌýmonitorÌýdata retention and disposal	A	C
Define andÌýmonitorÌýinformation asset retention and disposal	C	A
Lead data governance forums	A	I
Participate in information asset governance forums	C	A
Drive value realisation from data	A	I
Safeguard integrity of information asset	I	A
Respond to data incidents	R/A	R/A
Respond to information asset -related incidents	I	R/A
Ensure training and awareness for data management	A	C
Ensure training and awareness for information asset management	C	A
Engage with SIRO, chief data officer, DPO	A	A
Promote a culture of data ownership	A	C
Promote a culture of information protection	C	A

Summary of patterns

Data owners are typicallyÌýA for:Ìý

• data definitionsÌý

• data qualityÌý

• strategic directionÌý

• data sharingÌý

• value realisationÌý

• data governanceÌý

• data riskÌý

IAOs are typicallyÌýA for:Ìý

• compliance and legal obligationsÌý

• physical and logical information asset securityÌý

• information asset retention and disposalÌý

• information asset sharing approvalÌý

• risk and incident management (information asset-level)Ìý

• oversight of information asset register