• Section 1 - Executive Summary
• Section 2 - Purpose
• Section 3 - Scope
• Section 4 - Audience
• Section 5 - Definitions
• Section 6 - Roles and Responsibilities
• Table 1 – Specialist Data Governance Responsibilities
• Section 7 - Data Governance Principles
• Section 8 - Standards for Data Management
• Ownership
• Classification and Protection
• Access
• Cataloguing and Consistency
• Legal and Ethical Compliance
• Data Quality and Lifecycle Management
• Emerging Technologies and Artificial Intelligence (AI)
• User Awareness
• Section 9 - Enforcement
• Section 10 - Relaxing Provision

Section 1 - Executive Summary

(1) Data comprises the strategic assets of the University of Newcastle (University) as it supports the University's operations and decision making, and ensures the University meets reporting and compliance obligations.

(2) For data to remain useful to the University, it must be handled in a manner that preserves its quality, security and reliability.

(3) All users of the University's data have a role in preserving the quality, security and reliability of University data in line with this Policy.

Section 2 - Purpose

(4) The purpose of this Policy is to:

1. establish roles and responsibilities for data governance;
2. establish the principles for University data governance; and
3. define standards for the quality, security and reliability of University data.

Section 3 - Scope

(5) This Policy applies to all University data, including data of its controlled entities, regardless of its format and including oral data, physical data and electronic data.

(6) This Policy must be applied at all times when engaged in University business or otherwise representing the University.

(7) This Policy is supported by and must be read in conjunction with the following documents:

1. Records Governance Policy;
2. Privacy Policy;
3. Privacy Management Plan;
4. Data Breach Policy (Personal and Health Information);
5. Information Classification and Protection Policy;
6. Information Security Access Control Policy;
7. Digital Technology Conditions of Use Policy;
8. Digital Security Policy;
9. Learning Analytics Policy and Learning Analytics Procedure; and
10. research policies including, but not limited to, Responsible Conduct of Research Policy and Research Data and Primary Materials Management Procedure.

(8) Data may constitute a record, as defined by the Standard on Records Management established under State Records Act. In such cases, the data, as a record, is subject to the requirements of the Records Governance Policy in addition to this Policy.

Section 4 - Audience

(9) This Policy should be read and understood by all University staff, students; University volunteers, contractors and vendors; and members of advisory and governing bodies, in all campuses and locations of the University.

Section 5 - Definitions

(10) In the context of this document, the following definitions apply:

1. “Data” means a set of characters or symbols to which meaning is or could be assigned (As/NZS ISO30300:2020 – Section 3.2.4). The Council of Australasian University Directors of Information Technology (CAUDIT) defines data as a set of facts, representing a specific concept or concepts. Value is added to data when they are combined and presented to users within a context, turning them into meaningful information to support business decisions and enable operational decisions. That is, DATA + CONTEXT = INFORMATION;
2. “Data domain” means a logical grouping of related data assets that represent a specific business function or subject area within the University. Examples include student data, human resources data, finance data and research data. The University has adopted the CAUDIT Higher Education Reference Model (HERM) to define structured data domains, whereby these domains are outlined in the Data Governance Standard;
3. “Data Owner” means a senior business, College , or unit manager who assumes responsibility of data within a specific data domain or dataset;
4. ”Data Steward” means an individual responsible for managing the quality, integrity, and compliance of data within a specific data domain or dataset;
5. “Electronic data” means data created, processed, stored or transmitted in digital form. This includes structured data (for example, databases), unstructured data (for example, documents or emails), and multimedia files;
6. “metadata” means the structured information that describes and provides context for data, enabling the identification, management, accessibility and use;
7. “Oral data” means spoken data captured during University activities, such as interviews, lectures, meetings, or focus groups. When recorded (for example, audio or video), oral data becomes a digital asset and is subject to governance requirements for storage, classification and access;
8. “Physical data” means data represented in a tangible, non-digital format, such as printed documents, handwritten notes, or other hard copy materials;
9. “Record” means any document or other source of information compiled, recorded or stored in written form or on file, or by electronic process, or in any other manner or by any other means ( State Records Act S.3(1) – Definitions). A record, whether digital or physical, is a piece of information that serves as evidence of the University's activities, decisions, and transactions. it is maintained to meet legal, regulatory, fiscal, operational, or historical requirements. Under the Government Information (Public Access) Act 2009 at Schedule 4, S.10 a record means any document or other source of information compiled, recorded or stored in written form or by electronic process, or in any other manner or by any other means. A reference in this Act includes a reference to a copy of the record.
10. “University data” means oral, physical or electronic data that is created, processed, stored, or communicated by the University;

Section 6 - Roles and Responsibilities

(11) All users of University data are responsible for:

1. applying this policy to the data they collect, use and manage on behalf of the University, regardless of location, device or technology used;
2. complying with related policies including but not limited to the Data Breach Policy (Personal and Health Information) and Information Management and Governance Framework;
3. immediately reporting suspected or actual compromise of technologies used to store, process or communicate data to the Cyber Security team. This includes issues or incidents with artificial intelligence (AI) and AI-driven data;
4. reporting data quality issues to the relevant Data Stewards (see Table 1 or roles and responsibilities).

(12) Specialist data governance responsibilities are provided in Table 1.

Table 1 – Specialist Data Governance Responsibilities

Section 7 - Data Governance Principles

(13) The University upholds the following data governance principles. Data:

1. can be routinely created and captured as part of normal business practice;
2. must be managed in accordance with legal and business requirements, and so that it can be shared as a reliable and trustworthy asset;
3. should be identifiable, retrievable and accessible;
4. must be protected from unauthorised or unlawful access, destruction, loss, deletion or alteration;
5. must be kept for as long as needed for business, legal and accountability requirements;
6. should be systematically and accountably destroyed when legally appropriate to do so.

Section 8 - Standards for Data Management

(14) At a minimum, the following requirements apply to the use of University data.

Ownership

(15) The University requires that all University data have an assigned Information Owner, and that all structured University data should have an assigned Data Owner. Further clarification around ownership roles are defined in the Ownership Role Reference Guide.

Classification and Protection

(16) Data must be classified according to the Information Classification and Protection Policy, State Records Act and its standards, where relevant.

(17) University data must be stored in systems and storage locations approved in accordance with the Digital Security Policy. University research data must be managed in accordance with the Research Data and Primary Materials Management Procedure.

(18) Where data is personal information or sensitive information, data sovereignty requirements must be met, ensuring that University data is stored and processed within jurisdictions that comply with the applicable national and international laws and the University's Privacy Management Plan.

(19) Data must be protected using security controls appropriate to the classification level in accordance with the Information Classification and Protection Policy.

Access

(20) Access to data should only be provided for authorised purposes and to authorised individuals, systems, and services in accordance with the Information Security Access Control Policy. Granting of access to a particular data domain is the responsibility of the designated Data Owner as follows:

1. Decisions to grant internal access to data must be documented and auditable, and supported by appropriate mechanisms such as data access agreements or user access approvals. This requirement applies specifically to data accessed for purposes such as system integrations, application workflows, and business intelligence or analytics reporting.
2. This clause does not apply to platform-native sharing capabilities (for example, within Sharepoint or Teams) or to ad-hoc distribution methods such as email, which are governed by separate policies and controls. Note: A staff member may have access to data by virtue of access granted by a System Owner.

(21) Data access agreement guidance can be provided by the Digital Governance Team.

(22) University data must not be shared with external parties unless in accordance with a legally binding agreement that is approved by an authorised delegate and stipulates conditions for use, handling and protection. The sharing of University research data must be in line with the Research Data Management Plan.

Cataloguing and Consistency

(23) Data assets should be catalogued for visibility and discovery.

(24) Data assets should have consistent definitions.

(25) Data should not be duplicated across systems, platforms, devices and storage locations unless required for business reasons.

Legal and Ethical Compliance

(26) Data must be handled in accordance with relevant University policies and applicable national and international laws.

(27) Data collection, use, handling and transformation should be ethical in all contexts and free from bias wherever possible.

Data Quality and Lifecycle Management

(28) Data must be maintained throughout its lifecycle which spans collection, storage, access, usage, archiving, and disposal.

(29) Data quality standards are defined and reflect the value, purpose and usage of data.

(30) Data must be subject to regular quality reviews.

Emerging Technologies and Artificial Intelligence (AI)

(31) The use of University data in emerging technologies and AI must be in accordance with relevant University policies and procedures and applicable laws.

(32) Any application of AI-powered systems for the management of data must include documentation of methodologies and auditability features.

User Awareness

(33) Staff should be provided with regular data management training to support awareness of data governance policies and procedures.

Section 9 - Enforcement

(34) Non-compliance with the provisions of this Policy may result in action under the University's policies, delegations, Staff Code of Conduct, Student code of Conduct or the relevant enterprise agreement/employment contract, and may also result in referral to a statutory authority and/or agency.

Section 10 - Relaxing Provision

(35) To provide for exceptional circumstances in any case, the Chief Digital & Information Officer may relax any provision of this policy, provided that the relaxation:

1. does not compromise compliance with external obligations (including but not limited to contractual, legislative, or accreditation requirements);
2. does not override a decision made under a formal delegation of authority; and
3. does not replace a decision that is subject to a formal delegation of authority.

(36) A relaxation may be requested in writing to the Digital Governance Team and will be assessed based on the potential business impact, the security risk that the proposed relaxation may pose, and any compensation controls that may be implemented in relation to the relaxation.