Institutional Data

Layout for printing
Policy Number:
UW-523
Old Policy Number:
Data 01
Responsible Office:
Data, Academic Planning & Institutional Research

University Policy

Rationale/​Purpose:

The value of data as an institutional resource is increased through its widespread and appropriate use; its value is diminished through misuse, misinterpretation, or unnecessary restrictions to its access. As the caretaker of institutional data, the university has an obligation to protect the integrity and quality of institutional data, privacy of data subjects, and security of institutional data while also maximizing its effective and efficient use. The purpose of this policy is to establish minimum requirements for the management and stewardship of institutional data resources.

Definitions:
Data domain
A high-level functional category, as designated by the Data Governance Council, for the purpose of assigning accountability and responsibility for institutional data. Each data domain has a data trustee.
Data lifecycle
Includes data planning, design and enablement, creation and acquisition, storage and maintenance, transmission, use, enhancement, and disposition.
Institutional data
Information, regardless of medium, generated, collected, stored, maintained, transmitted, enhanced, or recorded by or for the university to conduct university business. It includes data used for planning, managing, operating, controlling, or auditing university functions, operations, and mission. It does not include data generated by research, or data owned or generated by a party outside the university when used in research, conducted at the university, under the auspices of the university, or with university resources.
Institutional data product
Include, but are not limited to, databases, tables, reports, models, analyses, dashboards, and visualizations that either use or are based on institutional data sources and display or convey representations of institutional data.
Protected institutional data
Institutional data that is not specifically classified as “public” under the university’s Data Classification policy or as “low risk” under UW System Administrative Policy 1031.
System of record
The single system deemed to be the university’s authoritative instance of a particular data element.
System of reference
An authoritative system that contains a reliable version of authoritative data regardless of where that data originated.
Scope:

This policy applies to:

  • All institutional data and institutional data products regardless of where they reside.
  • All information technology systems and applications that generate, collect, store, maintain, transmit, or record institutional data; regardless of system and application manager, owner, or location.
  • All individuals, regardless of affiliation, who develop, manage, administer, or support information technology systems and applications that generate, collect, store, maintain, transmit, or record institutional data.
  • All individuals, regardless of affiliation, who handle, use, process, store, or manage institutional data.
Policy:

Policy Statement

  1. Institutional data shall be treated as a shared university resource and shall be managed for the benefit of the whole university, to support the university’s mission, and to facilitate campus-wide data-informed decision making. Guiding principles for the management of institutional data are:
    1. Stewardship: All individuals within the scope of this policy have a responsibility to protect the privacy, security, and confidentiality of our institutional data as required, and to manage it appropriately throughout the whole data lifecycle.
    2. Transparency: How, when, and by whom institutional data management decisions are made and requirements created shall be clearly stated.
    3. Consistency: Policies, procedures, and standards shall be thoughtfully created and applied uniformly to provide consistency in how institutional data is managed across the university.
    4. Accountability: Progress toward institutional data management goals shall be measured and tracked and compliance with policies, procedures, and standards shall be auditable in accordance with current data governance best practices.
    5. Agility: Processes and requirements shall be adaptable to the ever-changing data and technology environment.
    6. Change Management: Implementation of new processes and requirements shall include concerted efforts in communicating and managing change among university employees and other stakeholders.
    7. Availability: The usage and timely availability of appropriate institutional data from systems of record and reference shall be promoted and encouraged in the conduct of university business.
  2. Institutional data shall be responsibly managed throughout the entire data lifecycle in compliance with all applicable laws; Board of Regents, UW System Administration, and university policies, procedures, and standards; and approved records schedules. Institutional data stewards serve as the primary point of contact and coordination for data management issues and operations within the steward’s data domain.
  3. Institutional data shall be identified and documented. Institutional data sources, elements, processes, integrations, and products will be documented and communicated to ensure transparency, clarity, shared understanding, replicability, and ease of use. Data literacy will be promoted through up-to-date and accessible institutional data documentation and training resources.
  4. Access to protected institutional data shall be authorized and managed to protect individual privacy, maintain promised confidentiality, and ensure appropriate access and use. Access to institutional data will be controlled by reasonable physical, technical, and administrative measures to prevent unauthorized access. Access will be granted based on authorization provided by the applicable institutional data steward or stewards based on appropriateness of an individual’s role and the intended use. Authorization and access will be documented, reviewed, modified, and terminated in accordance with all applicable laws and UW System and university policies, procedures, and standards. Protected institutional data may only be accessed for business purposes within the scope of an individual’s university duties.
  5. Institutional data will be shared to the extent allowable under applicable laws, regulations, policies, standards, and procedures. Protected institutional data will only be made available to those who are explicitly authorized to access it, and individual privacy rights must be considered before sharing personally identifiable data.
  6. The quality and integrity of institutional data and institutional data products shall be actively managed and explicit criteria for data validity, availability, accessibility, interpretation, and ease of use shall be established.
  7. Institutional data shall be classified in accordance with applicable university data classification policy. Determination of appropriate classification of institutional data and institutional data products shall be made and documented by data stewards. Data classification will be a factor considered in authorization and access procedures.
  8. Any system holding institutional data shall be purposefully planned, inventoried, and implemented to manage institutional data throughout the entire data lifecycle in compliance with all applicable laws; Board of Regents, UW System Administration, and university policies, procedures, and standards; and approved records schedules. The data lifecycle shall be integrated into the review and purchase of information technology systems or services and applications that generate, collect, store, maintain, transmit, or record institutional data. Systems will be documented in a way that enables an understanding of the system’s function, the institutional data it holds, and how it fits into the university’s overall institutional data architecture and institutional data governance.
  9. Institutional data products shall source institutional data from systems of record or systems of reference. Institutional data resources and products that are published, distributed, shared, or otherwise made accessible to others will source institutional data from designated systems of record or systems of reference. To the extent possible unnecessary duplication or storage of institutional data shall be avoided and university standards for integrations shall be followed.
  10. Procedures, standards, and guidelines will be developed and approved by the Data Governance Council to aid in the implementation and enablement of this policy and its principles.
  11. Exceptions to this policy may be granted by the policy manager. In certain situations, compliance with this policy may be impossible, may not be immediately possible, or may constitute an undue administrative or financial burden. In such cases, exceptions to this policy may be granted by the policy manager in consultation with the appropriate data steward(s) and Data Governance Council. Exceptions must be documented and be time bound when appropriate. A denial of a request for an exception may be appealed to the Data Governance Council.
  12. Violations of this policy may result in a range of consequences. Compliance with this policy is designed, in part, to ensure the university complies with its various data-related obligations, including legal and regulatory requirements.
    1. Institutional consequences for violations may include audits, fines, and/or breach notification obligations under applicable laws. To the extent violations of this policy leads to audits, fines, and/or breach notification obligations, the area of the UW–Madison campus responsible for such violations may be required to cover the costs associated with such violations.
    2. Individual consequences for violations may include, as appropriate:
      1. Denial, suspension, or revocation of access to institutional data, and/or
      2. Disciplinary action up to and including dismissal, and/or
      3. Disciplinary action up to and including suspension from programs, removal from clinical experiences, or expulsion for students.
    3. Violations may also result in civil or criminal liability under applicable laws.

Roles and Responsibilities

Data Governance Council: The Data Governance Council consists of designated officials who have planning, policy-level, and management responsibility for data within their functional areas. The Data Governance Council works to ensure and support the effective management of data assets of the university by making policy recommendations, establishing procedures and standards, advocating for appropriate resources, and guiding and monitoring data governance efforts.

Data Trustees: Data trustees are the university officials with authority over institutional data or the university’s use thereof, as designated by Data Governance Council. Data trustees are accountable for managing, protecting, and ensuring the integrity and usefulness of institutional data and for upholding UW–Madison policies, UW System policies, state laws, and federal laws applicable to the institutional data. Each data trustee appoints one or more institutional data stewards for the data trustee’s specific domain.

Institutional Data Stewards: Institutional data stewards are assigned by and accountable to data trustees. Institutional data stewards help define, implement, and enforce data management policies and procedures within their specific data domain. Institutional data stewards have delegated responsibility for all aspects of how data is acquired, used, stored and protected throughout its entire lifecycle from acquisition through disposition.

Data System Custodians: Data system custodians are responsible for the administration of institutional data systems, tools, and resources. Data system custodians are identified by institutional data stewards as a primary point of contact for data management issues that require administrative resources.

Divisional Data Management Representatives: Divisional data management representatives are individuals designated by divisional leadership as a primary point of contact for institutional data stewards on data management issues and communications. Divisional data management representatives may also represent their division or coordinate divisional response to data management issues and operations.

Related UW-Madison Policies:

UW-504 Data Classification

Related UW–Madison Documents, Web Pages, or Other Resources:
External References:

UWS 1031 Information Security: Data Classification and Protection

Policy Administration

Approval Authority:
Provost and Vice Chancellor for Academic Affairs
Policy Manager:
Vice Provost for Data, Academic Planning & Institutional Research
Contact:
Data Governance Director -- Lisa Johnston, LRJOHNSTON@WISC.EDU, (608) 262-8637
Revised Dates:

11-14-2023

Retrieved:
04-26-2024 22:13:23