• Section 1 - Executive Summary
• Section 2 - Purpose
• Section 3 - Scope
• Section 4 - Audience
• Section 5 - Definitions
• Section 6 - Roles and Responsibilities
• Section 7 - Information Governance Policy
• Principles
• Principle 1:  Information should be business enabling, aligned to our functions and support informed decision making. 
• Principle 2: Information must be secure, valued, and managed as an asset. 
• Principle 3:Information should be high quality.
• Principle 4: Information should be trustworthy so it can be used and reused with confidence. 
• Principle 5: Information must be captured.
• Principle 6: Information must be managed across the full lifecycle, protected from unauthorised use, disclosure, and inappropriate deletion. 
• Principle 7: Information should be available and open to the community and government. 
• Principle 8: Information governance must be supported through leadership.
• Section 8 - Information Governance Standards
• Information Classification
• Information Governance Committee
• Information Systems
• Risk Mitigation
• Section 9 - Information Management Standards
• Information Lifecycle Management 
• Section 10 - Compliance 
• Section 11 - References
• Section 12 - Supporting Documents

Section 1 - Executive Summary

(1) The Information Governance Policy and Framework (the Framework, this Framework) establishes the University of Newcastle’s (the University) overarching approach to governance and management of University information, including data and records.

Section 2 - Purpose

(2) The Framework defines the University's information governance and management roles, authorities, and structures that meet current and future organisational needs and regulatory requirements. The Framework:

1. supports the University's strategic objectives;
2. ensures University information is controlled, protected and preserved;
3. enables effective, ethical and secure use of University information; and
4. meets legislative and administrative obligations.

(3) The Records Governance Policy and Data Governance Policy are subordinate documents to this Framework and should be read in conjunction with this document.

(4) This document should be read in conjunction with the policies listed in Section 8.

(5) Policy documents relating to data, information and records operate subject to applicable legislative and regulatory requirements. Where a provision of this Framework or its subordinate policies is inconsistent with a legislative or regulatory requirement, that requirement prevails to the extent of the inconsistency.

(6) Where a conflict exists between this Framework and a Policy, the Framework applies to the extent of the inconsistency.

Section 3 - Scope

(7) The Framework applies to all University information, data and records (as defined by this Framework), regardless of format and location created, but excluding information generated as part of a program of studies or whilst attending an event by individuals listed in the Audience. This Framework applies to controlled entities operating under the Governance Framework for Controlled Entities.

Section 4 - Audience

(8) Individuals who use, create or access University information must comply with this Framework. This includes, but is not limited to, all University staff, controlled entity staff, contractors, third party providers and affiliates who are authorised to access and use University information. 

Section 5 - Definitions

(9) In the context of this document the following definitions apply: 

1. “data” means a set of characters or symbols to which meaning is or could be assigned (AS/NZS ISO30300:2020 – Section 3.2.4). The Council of Australasian University Directors of Information Technology (CAUDIT) defines data as a set of facts, representing a specific concept or concepts. Value is added to data when they are combined and presented to users within a context, turning them into meaningful information to support business decisions and enable operational decisions. That, DATA + CONTEXT = INFORMATION;
2. “data governance” refers to the exercise of authority, control and shared-decision  making (planning, monitoring and enforcement) over the management of data assets (DMBOK, 2017);
3. “information” means data in context with a particular meaning. Data as information will be organised or structured or processed in a way that gives it meaningful context and can be understood and interpreted by people or systems. (Source: AS/NZS ISO30300:2020 – Section 3.4.7). Information is given significance through relational connection, analysis, or interpretation, turning it into a valuable resource. For example:
   1. all information is collected, used or generated during research including published and unpublished research data, research materials, master data, reference data, metadata, and records;
   2. information resources;
   3. artificial intelligence systems and tools;
   4. information created by controlled entities (Source University of Southern Cross).
4. “information domain” is a concept for information sharing, independent of, and across information systems and security domains, including:
   1. identification of information sharing participants as individual members;
   2. shared information objects; and
   3. linked to a security policy that identifies the roles and privileges of the members and the protections required for the information objects (Source: NIST);
5. “information management” means planning, collection, control, distribution and exploitation of information resources within an organisation, including systems development, and disposal or long-term preservation (source: AS ISO 51227:2017 – Clause 3.2.1.23);
6. “metadata”: means data about the data;
7. “record” means any document or other source of information compiled, recorded or stored in written form or on film, or by electronic process, or in any other manner or by any other means (State Records Act S.3 (1) – Definitions).  A record, whether digital or physical, is a piece of information that serves as evidence of the University's activities, decisions, and transactions. It is maintained to meet legal, regulatory, fiscal, operational, or historical requirements. Under the Government Information (Public Access) Act 2009 at Schedule 4, S.10 a record means any document or other source of information compiled, recorded or stored in written form or by electronic process, or in any other manner or by any other means. A reference in this Act includes a reference to a copy of the record;
8. “records management” means the field of management responsible for the efficient and systematic control of the creation, receipt, maintenance, use and disposition (disposal) of records, including processes for capturing and maintaining evidence of and information about business activities and transactions in the form of records (Source; AS ISO 15489.1:2017 – Clause 13.151; State Records, NSW);
9. “Senior Responsible Officer (SRO): the Senior Responsible Officer is the individual within the University who has been delegated strategic and corporate responsibility for records and information management. At the University of Newcastle, the Chief Digital & Information Officer is the SRO with a responsibility for ensuring that records and information management is in place and operating effectively to support business operations (Source: State Records NSW);
10. “state archive” means a state record that Museums of History NSW has control of under the State Records Act. (State Records Act, 2.3 (1) – Definitions).
11. “state record” means a record made or received by a person:
    1. while exercising official functions in a public office; or
    2. for a purpose of a public office; or
    3. for the use of a public office (State Records Act 1998, 1998, S.3 (1) Definitions);
12. “University information” refers to data, information and records including:
    1. records, as defined by the State Records Act, 1998 (NSW);
    2. active, semi-active and archived information assets;
    3. information assets classed as State archives;
    4. structured and unstructured information;
    5. physical and digital data; and
    6. research data hosted on-campus or externally with third party vendors.

Section 6 - Roles and Responsibilities

(10) The Vice-Chancellor has University-wide authority and accountability under legislation for the compliant collection and management of the University's information and may sub-delegate these responsibilities to other roles in accordance with the University of Newcastle Act and the Governance Rule. 

(11) The Chief Digital & Information Officer (CDIO) is responsible for the management of the technical and specialist teams relevant to information governance and for oversight of the infrastructure framework for the management of information, as well as the University's cybersecurity programs.

(12) The Chief Digital & Information Officer is the Senior Responsible Officer (SRO) under the State Records Act 1998. 

(13) Individuals, as defined in Audience of this Framework and as it relates to information that they create, manage or use, are responsible for:

1. fulfilling the responsibilities as an information owner, system owner and/or system administrator as dictated by University policy including this Framework;
2. controlling and safeguarding University information;
3. ensuring quality and integrity of information by embedding information governance and compliance processes into daily operations and systems;
4. capturing or creating University information; and
5. selecting the best source of information to meet a specific use-case and defining the criteria to determine what makes information fit for purpose.

(14) The Head of Digital Governance (DTS) is responsible for developing and operationalising the University's approach to data, information and records governance and management.

(15) The Privacy and Rights to Information Manager responsibilities are codified in the Privacy Management Plan, Data Breach (Personal and Health Information) Policy, the Privacy Policy and the Agency Information Guide. 

(16) The Data Governance Committee has responsibilities codified in the Data Governance Policy.

(17) Digital Technology Solutions is responsible for:

1. managing records of business system applications, including data sensitivity and business criticality designations;
2. determining data sensitivity and business criticality designations through a structured process in collaboration with System Owners and in accordance with the Information Classification and Protection Policy and Business Continuity Management Framework;
3. maintaining an Enterprise Records and Information Asset Register including details of records of System Owners, information service providers and risk profiles;
4. assessing and reviewing new applications and systems during the design stage and prior to deployment to ensure appropriate security and compliance considerations have been included in accordance with the DTS Digital Governance Framework.

Section 7 - Information Governance Policy

Principles

(18) University information is integral to its operations and effectiveness. The below principles establish the core characteristics of information governance at the University and must be complied with, as far as reasonably possible, by all individuals who use, create or access University information.

Principle 1:  Information should be business enabling, aligned to our functions and support informed decision making. 

(19) Information should be designed and managed so that it directly supports the University to meet its objectives and obligations. The University strives to deliver data analyses, dashboards, reports, and visualisations for information and data-driven decision making.

Principle 2: Information must be secure, valued, and managed as an asset. 

(20) Information is a core component of the University services and operations, and must be supported and maintained as a secure, long-term business asset in accordance with approved authorities. 

(21) On behalf of the Museums of History NSW, the University is a custodian of information about the University and our community. This information is both digital and analogue, and the University creates policies, plans and processes to realise and protect these assets.

(22) We describe and register our information assets and ensure each asset has an authorised custodian.

Principle 3:Information should be high quality.

(23) Quality information is essential to meet our strategic objectives, and when appropriate, it will be used for improved service planning and delivery, and business performance insights. 

(24) The University implements innovative processes, tools, and technologies to enhance consistency, efficiency, capability, authority and quality of information. 

Principle 4: Information should be trustworthy so it can be used and reused with confidence. 

(25) Information must be accurate, authentic and trusted, allowing its appropriate and authorised use and reuse by the University and our community, ensuring compliance with the Privacy Policy and Privacy Management Plan, and the AIATSIS Code of Ethics for Aboriginal and Torres Strait Islander Research, where relevant.

Principle 5: Information must be captured.

(26) The capture of information in approved information management systems is essential for managing its use and access over time. Fit for purpose information storage should allow the creation of information assets and associated metadata to inform, implement, document, and communicate our activities and decisions, promoting the ability to work cohesively and provide accessibility.

Principle 6: Information must be managed across the full lifecycle, protected from unauthorised use, disclosure, and inappropriate deletion. 

(27) Information must be appropriately managed from procurement and service design, through creation, storage and to final disposition. This includes the protection of personal information, health information and sensitive information, and the prevention of deletion until enabled through compliant destruction authorisation. 

Principle 7: Information should be available and open to the community and government. 

(28) University information should be discoverable and used by those with a legitimate need. The University promotes accessibility through appropriate access, formats, and metadata, and through interoperability as needed across systems, channels, and technologies.

(29) Information often has a lifespan longer than the technology on which it is hosted, therefore information is considered as a separate entity to technology and must be governed in accordance with its value and risk.

Principle 8: Information governance must be supported through leadership.

(30) Leaders must recognise their information management responsibilities and understand the value of information captured in University systems and activities.

(31) The University is committed to ensuring that information management is appropriately resourced and supported through strategies, policies, guidance and procedures, along with information governance education and training. 

Section 8 - Information Governance Standards

(32) University information governance defines the roles and responsibilities, decision rights, controls, and processes used to manage University information.

Information Classification

(33) University information must be classified to acknowledge the associated risks and to determine appropriate controls. For more information, view the Information Security Access Control Policy and Information Classification and Protection Policy.

(34) University data must be grouped according to information domains based on the CAUDIT Higher Education Data Reference Model. Each domain is assigned to a data owner, who is responsible for ensuring appropriate access, quality, and use of the data. 

Information Governance Committee

(35) The Data Governance Committee (DGC) will provide advice and recommendations for strategy, policy and risk related matters that impact on the University's Information. The membership, roles and responsibilities of the DGC are codified in its Terms of Reference.

Information Systems

(36) University information must be:

1. retained in various business applications and storage systems across the University; and/or
2. stored in both on-premises and cloud based repositories. 

Risk Mitigation

(37) Consideration of risk is a key component underlying this Framework.

(38) The major risks for the University's information assets are identified in the Enterprise Information Asset Register.

(39) The following operational measures also serve as risk mitigation strategies:

1. functions of the Data Governance Committee (DGC);
2. internal and external audit activities (see Internal Audit Charter);
3. assurance activities and annual reporting surveys to ensure the University is accountable and meeting its information requirement, as specified in the Data Governance Policy and Records and Information Management Policy;
4. cyber security controls aligned with the NIST Cyber Security Framework (CSF) and specified in the Digital Security Policy;
5. privacy impact assessments as specified in the Privacy Management Plan;
6. business continuity planning / testing as specified in the Business Continuity Management Framework;
7. compliance with the University records management program as specified in the Records and Information Management Policy; and
8. relevant policies and procedures that serve to mitigate risks to information assets, as listed in this Framework.

Section 9 - Information Management Standards

Information Lifecycle Management 

(40) Management of University information drives improvements in performance and infrastructure costs and influences how the University manages information. For all University information, the lifecycle management process should include the following phases, commensurate with the value of the University information:

1. Plan and design: University information management should be carefully planned, with management activities designed to meet University needs and compliance requirements throughout the lifecycle.
2. Create, capture and classify: University information may be obtained through several means including manual data entry and automatic capture via devices or systems. At the time information is acquired, key metadata should be recorded, including the information security classification.
3. Store and secure: University information must be stored appropriately, with consideration given to security and access management.
4. Manage and maintain: University information management is an active process. Information should be managed to maintain its integrity, quality and usability. This includes responsibility for Information Owners to ensure additional procedures are in place for:
   1. research data – ensuring that the management of research data complies, where required, with:
      1. the University's research ethics approval processes as required under the Responsible Conduct of Research Policy;
      2. Privacy Management Plan;
      3. relevant codes and guidelines including but not limited to the Australian Code for the Responsible Conduct of Research;
      4. the Research Data and Primary Materials Management Procedure; and
      5. any relevant third-party agreements.
   2. Aboriginal and Torres Strait Islander people’s data – ensuring compliance with the AIATSIS Code of Ethics for Aboriginal and Torres Strait Islander Research;
   3. personal information and/or health information ensuring compliance with the University's Privacy Management Plan, Privacy Policy, Data Breach (Personal and Health Information) Policy and Agency Information Guide.
5. Share and (re)use: Sharing and re-use of University information requires oversight to ensure it is ethical and compliant with University policies and legislative requirements. Subject to privacy legislation, this means that information should be discoverable to streamline sharing and re-use for appropriate activities.
6. Retain and archive: University information must be retained and archived in line with the relevant record retention periods.
7. Dispose or destroy: University information must be destroyed in an appropriate manner at the end of its useful life, ensuring that records are destroyed (or transferred to the appropriate owner) in line with Records and Information Management Policy.

Section 10 - Compliance 

(41) Compliance with this Framework is important in protecting the University's information. Breaches may be reported via the University Breach Register.  Non-compliance may result in proceedings in accordance with any relevant University policy, contract, employment contract, Enterprise Agreement or the Staff Code of Conduct.

Section 11 - References

(42) The following information sources have been referenced in developing this Framework:

1. Australian National Audit Office – Audit Lessons Insights – Records Management (2025)
2. Australian Government Office of the National Data Commissioner – The Foundational Four.
3. NSW Information Management Framework.
4. University of Newcastle Act, 1989.
5. State Records Act, 1998.
6. National Archives of Australia – Information and Data Governance Framework (2024);
7. other agencies, including CAUDIT.

Section 12 - Supporting Documents

(43) Agency Information Guide

(44) Art & Special Collections Management Framework

(45) Copyright Compliance Policy

(46) Complaint Management Policy

(47) Complaint Management Procedure

(48) Cyber Security Incident Management Procedure

(49) Data Breach Policy (Personal and Health Information)

(50) Digital Security Policy

(51) Information Classification and Protection Policy

(52) Information Security Access Control Policy

(53) Intellectual Property Policy and Intellectual Property Procedure

(54) Privacy Policy

(55) Privacy Management Plan

(56) Records and Information Management Policy

(57) Responsible Conduct of Research Policy.

(58) Research Data and Primary Materials Management Procedure.