Skip to main content

Golden copies, data stewards, and sensitivity

The University stores and manages quite a lot of data - nothing like the scale of Google or similar behemoths, but not insignificant either.  Some of this data is quite sensitive.  It can include personal information (including the "protected characteristics" such as race or sexuality); medical information (for staff & students, or for NHS patients on research projects), commercially sensitive information, and information vital to the teaching process such as exam questions.  We are responsible for looking after this data and keeping it secure, a set of procedures that goes by the dry name of "data governance".

One of the key concepts in our approach to data governance is the "golden copy"; the one true source for a particular kind of information.  For example, the student record is the golden copy for data about students.  I have made this one of our Enterprise Architecture principles:
Principle D1: All data held in enterprise systems have a golden copy that holds the definitive value of that data.
We have had this principle in practice for many years. But if you want to know which system is the golden copy for a particular type of data, or who looks after that system, or how you access the data for yourself, you have had to know who to ask.  So I am creating a golden copy data catalogue that publicises this information.  I'm also working with the data governance group to come up with a default process for requesting access.

This throws a spotlight on the people who look after our data.  The usual name for this role in EA circles is the data steward.  As the name implies, someone who has this role is responsible for looking after the data, ensuring it is up-to-date and good quality.  Their responsibilities also include assessing requests for access, and making the data available to people who need it.  So we are working to define this role and work with people across the university so that our data is stewarded consistently.

I am also working with our Chief Information Security Officer (CISO) and our Data Protection Office (DPO) to agree a classification for information sensitivity.  The goal is to provide consistent advice for which data can be made public, which needs "normal" levels of security, and which needs more stringent controls.

So far, the response to this work has been very positive.  Much remains to be done, not least wider consultation with the people who do the crucial role of looking after our data.



Comments

Popular posts from this blog

2016 has been a good year

So much has happened over the last year with our Enterprise Architecture practice that it's hard to write a succinct summary.  For my day-to-day experience as enterprise architect, the biggest change is that I now have a team to work with.  This time last year, I was in the middle of a 12-month secondment to create the EA practice, working mainly on my own.  Now my post has been made permanent and I have recruited two members of staff to help meet the University's architectural needs.

I have spent a lot of the year meeting people, listening to their concerns and explaining how architecture can help them.  This communication remains vital, the absolute core of what we do and we will continue to meet people in this way.  We also talk to people in other Universities in order to learn from what they are doing and to share our own experience back.  A highlight in this regard was my trip to the USA last January.

Our biggest deliverable for the past year was the design of the data wa…

A new EA Repository

One of my goals since starting this job two years ago has always been to create a repository for architecture documents.  The idea is to have a central store where people can find information about the University's applications, data sources, business processes, and other architectural information.  This store will make it easier for us to explain our plans, to show the current state of the University's information systems, and to explain what Enterprise Architecture is all about.

It's taken a long time to reach this goal, mainly because we're often had more pressing and immediate work to be done.  The creation of a repository is one of those tasks that is very important but never quite urgent.  So I'm now very happy to say that we are in the process of deploying a repository and modelling tool.


This is the culmination of a careful process to select the most appropriate tool for our needs.  We began by organising several workshops to gather requirements from a rang…

New staff for the EA team

I'm delighted to welcome Jason Murphy, who joins us as our CRM Architect, and Wilbert Kraan, our new Data Architect.  Both Jason and Wilbert have worked as consultants for several years and bring new skills and considerable experience to IS.  They both know more than I do about their respective fields, which is how I like to hire people.

So the Enterprise Architecture practice now comprises the three of us, instead of me working on my won, which means we have more capacty to guide the University's IT architecture.  We can offer a greater range of skills and can bring a wider range of experience to bear.  I'm really excited about the opportunities this presents.

As his job title implies, Jason will focus on contact relationship management, working to build a user community and to create a strategy for managing and improving the University's relationships with prospective students, research partners, community organisations, and other parties - to give them all a better …