A data policy sets out guidelines to ensure an organization’s data is managed properly. Learn about data policies and the role CPAs can play in creating this important guideline.
What is a corporate data policy?
A corporate data policy is a set of guidelines that are developed to make sure that an organization’s data and information assets are consistently managed and properly used.
Why are corporate data policies necessary?
A data policy enables an organization to consistently address the broad range of potential developments and scenarios that may arise related to its creation, processing, use, and sharing of digital data. This is particularly important given the many sources and forms that data can take, the volume of data that can be generated, and the varied needs of business units that require access to the data.
A proper governance framework in the form of a corporate data policy can help align business units and departments. This in turn supports digitization efforts in a coherent way that adds value.
What elements should be included?
A comprehensive data policy should include the following 11 elements:
1. Objective
The objective of a corporate data policy is to provide clarity, so it is easier for participants to understand what is expected of them. Organizations are often tempted to begin with a data strategy, which uses digital technologies and data management to improve business outcomes. However, without clarity on expectations, a strategy is difficult to implement. Therefore, it is important to first develop corporate data policies and from that base create the strategy.
2. Scope
The policy should identify the types of data covered and the intended use:
- Will the policy apply to all data collected by all business units, including HR, or will it be limited to data that does not contain personal information such as Internet of Things devices, orders, inventory, invoices, etc.?
- Will historical and archived data be included, or will the policy apply only to data collected after a set date?
- What limitations will the organization have on the use of data, i.e., what are the guardrails for employees to pursue innovation and new opportunities?
3. Accountabilities
The policy should designate a function that is accountable for its application. In organizations with a Chief Data Officer (CDO), that role would typically be responsible for policy application.
4. Data ownership/internet protocol/licensing/copyright
The policy should clarify data ownership rights and stipulate how data must be handled. This is required for organizations that are looking to share data with others or to sell data to third parties.
5. Data collection
The policy should clearly articulate how data collection activities must be handled before secondary data use and data sharing can occur. Clear rules regarding data provenance and lineage, data attributes and metadata (information that precisely describes the features of your data), data quality, and trustworthiness need to be established. Ideally, processes for data verification and labeling should also be articulated in the policy. Lastly, the policy should articulate how statements of providence/authenticity would be generated/provided to support data that is shared/sold or otherwise distributed.
6. Data access, sharing, retention and disposal
The policy should describe how relevant datasets and data sources (commonly referred to as data streams) generated by the organization would be accessed and shared. The policy should also articulate the parameters around data retention and eventual disposal.
7. Artificial intelligence
The deployment of AI to improve efficiency and generate better outcomes will be important considerations in many organizations. The policy should outline in what circumstances AI can be used in the organization. As data is needed for teaching AI algorithms, the policy should make the appropriate linkages between data collection upstream, and data access and data analytics downstream.
8. Data residency
The policy may have to articulate limitations regarding data residency, including residency of personal information. For example, public sector organizations may be obliged to store datasets on servers located in Canada or choose cloud providers located in Canada. Additionally, there may be circumstances in which information owners (for example, customers or members) must consent to residency outside of Canada. There may also be jurisdictional issues like tax.
9. Privacy
Although most organizations already comply with privacy/confidentiality regulations, many do not have supporting policies in place. If the data policy applies to data containing private information, it should articulate how the organization will adhere with relevant privacy regulations.
10. Ethics
In cases where algorithms are developed, trained or deployed, the policy may set up a process to ensure that ethical considerations are being addressed.
11. Approval and implementation
A corporate data policy is an integral part of the corporate strategic plan. It should be reviewed and approved by the organization’s CEO and board of directors. As with any corporate policy, active support from management is essential for success.
The role of CPAs in corporate data policy
The foundational skills of the CPA designation include data analysis, data interpretation for strategic decision-making, and a deep business understanding, often leading to leadership positions. CPAs who work in assurance already use robust assurance standards to perform a broad range of engagements on matters other than historical financial statements.
These attributes, combined with a CPA’s public interest responsibilities, mean CPAs are well-positioned to help design, implement, and oversee a corporate data policy. Further, the vast majority of organizations in Canada are small to mid-sized, have limited resources, and in many cases have not yet moved toward digitization. CPAs working in these organizations could play a vital role in helping to manage that transition.
The competencies that CPAs embody also provide a strong foundation to work towards the role of a Chief Data Officer (CDO). The CDO function is commonly a senior executive position responsible for the data assets of the organization, including establishing the strategy and implementing the enterprise data solutions.
Conclusion
A corporate data policy does not need to be a detailed document. However, development of a clear and unambiguous data policy is a must for organizations to succeed in the future and to minimize risk. The policy should enable the organization’s business objectives and enhance successful project delivery. If designed properly, it will send the right signal to the organization about the value of mastering data and the part they can play in leveraging it.
Read the original article CPACanada.ca, here: https://www.cpacanada.ca/en/foresight-initiative/data-governance/mastering-data/corporate-data-policy-and-its-elements
