Data Governance Policy

Overseeing Swinburne-wide data governance and providing oversight and assurance of related strategic initiatives to protect data, information and records across Swinburne.

Establishing mandatory procedures in the domain of information technology. 

Establishing mandatory guidelines in the domain of information technology.

Assigning Swinburne-wide management responsibilities for the use of Swinburne information resources, digital communication platforms/technologies and artificial intelligence systems.

Responsible for overseeing the security of Swinburne’s data assets, information systems, and digital infrastructure.

Pro Vice-Chancellor, Indigenous Engagement

Delegates operational responsibilities to Professor, Indigenous Research

Chief Data Analytics Officer

Establishing and implementing a records management program.

Issuing guidance on policy implementation for records.

Overseeing retention and facilitation of disposal of data, information and records and maintaining the physical and digital University archives.

Applying Retention and Disposal Authorities.

Facilitating the lawful disposal of information and records.

Delegated by the Vice-Chancellor to the Manager, Information and Data

In accordance with this policy and s.13 of the Public Records Act 1973 (Vic)

Business role, usually an executive or divisional head of a functional area, accountable for one or more data topics. For their topic, they oversee:

• data governance principles, guidelines and procedures
• data governance operations
• data protection
• communications and partnerships.

Accountable for a data topic

Data Trustees, Data Stewards and Data Custodians do not have decision‑making authority over research data.

Business owner of one or more data entities, responsible for ensuring the quality, integrity, and appropriate use of data throughout its lifecycle. For their entity, they:

• apply data governance principles, guidelines and procedures
• provide data descriptors
• assure data quality
• provide subject matter expertise on business requirements
• assess business process impact
• manage data governance issues
• endorse data disposal.

Accountable for a data entity

Data Trustees, Stewards and Custodians do not have decision‑making authority over research data.

Research Data Steward

Accountable for research data for a research project or activity

Technical role responsible for managing and operating a source system who:

• applies data governance principles, guidelines and procedures
• manages and operates data infrastructure
• provisions data access once endorsed
• ensures data availability
• assesses business process impact
• manages data governance issues.

Accountable for a source system

Data Trustees, Data Stewards and Data Custodians do not have decision‑making authority over research data.

End user role responsible for entering, using, developing, storing and sharing data across the data life cycle.

Undertakes appropriate preparation, training and compliance. Works with data, following data governance principles, policies and processes.

Raises concerns and issues relating to data.

Researchers and supervisors must comply with the Australian Code for the Responsible Conduct of Research principles, and any applicable guides relating to management of data in research.

Researchers have primary responsibility for deciding which research data and primary materials are candidates for long-term retention and wider accessibility.

Researchers and research supervisors

The Australian Aboriginal and Torres Strait Islander Indigenous individuals, groups, organisations, Traditional Owners, Elders, cultural knowledge holders, governance bodies or wider communities who are affected by, connected to, or have rights and interests in the research, data or knowledge being collected, used, shared or published.

Research projects should be staged to allow continuing opportunities for consideration of the research by the community. Indigenous communities are distinct, and one Indigenous community, group or representative cannot be assumed to speak for another. 

CARE

CARE principles emphasise Collective Benefit, Authority to Control, Responsibility and Ethics, ensuring that Indigenous data is governed in ways that respect Indigenous rights, values and self‑determination.

Data  

Data are measurements or observations that are collected as a source of information. There are a variety of different types of data, and different ways to represent data. Data can be in digital and physical forms. Data becomes valuable when it is processed and analysed to extract meaning, leading to insights, decisions or predictions.

Data breach

Data classification

The process of categorising data based on its sensitivity, value, and risk to determine appropriate handling, access, and protection requirements.

Data user

An end user role responsible for entering, using, developing, storing and sharing data across the data lifecycle in an appropriate way.

Data custodian

A technical role responsible for managing and operating a source system.

Data entity

A defined business concept or object about which data is collected and managed, such as a person, activity, or transaction.

Data governance

Data governance is the exercise of authority, control, and shared decision-making over the management of data assets. Data governance provides the structure, policies, and oversight necessary to ensure that data is accurate, secure, accessible, and used responsibly across the organisation. 

Data lifecycle

The stages through which data passes, from creation or collection through use, sharing, storage, retention, and disposal.

Data quality

Fitness of data for its intended purpose.

Data security incident

An event that threatens the security of data or information systems, whether it results in a data breach.

Data sharing

The controlled provision of data to internal or external parties for approved purposes, in accordance with legal, ethical, and institutional requirements.

Data steward

A business role who usually reports to an executive or divisional head, accountable for one or more data entities. The data steward is responsible for data quality and integrity. 

Data topic

A high‑level subject area or domain of data for which governance accountability is assigned.

Data trustee

A senior business role accountable for governance, protection, and appropriate use of a defined data topic.

Enterprise data

Any data that is created, collected or managed to support the administration, operation, governance, planning or delivery of the University’s activities, including data arising from educational, outreach, commercial and other non‑research projects. Enterprise data is also referred to as institutional or corporate data.

FAIR

Principles for research data management and stewardship that promote data being Findable, Accessible, Interoperable and Reusable through appropriate metadata, standards and governance.

Global Indigenous community

A community of Indigenous peoples who share collective identity, culture, language, knowledge systems, governance practices, or connections to lands, waters or territories, and who identify as Indigenous. This definition refers to Indigenous communities outside the Australian Aboriginal and Torres Strait Islander community. 

Indigenous communities are distinct, and one Indigenous community, group or representative cannot be assumed to speak for another.

Indigenous Cultural and Intellectual Property (ICIP)

The rights of Indigenous peoples to their cultural knowledge, practices and heritage. This comprises all images, objects, sites, artefacts, art, genealogies and knowledge (oral, pictorial and written) materials, the nature or use of which has been transmitted and continues to be transmitted inter-generationally through past, present and future, and which is regarded as pertaining to a particular Indigenous group or groups, and/or their territory, Country and land. The cultural heritage of an Indigenous peoples is a living one and includes (but is not limited to) objects, images, genealogies, knowledge, literary and artistic works which may be created in the future based on that heritage.

Aboriginal and Torres Strait Islander cultural heritage, knowledge and data includes (but is not limited to):

•  literary, performance and artistic works (comprising songs, music, dance, story, ceremony, symbols, artefacts, language(s) and designs);
• scientific, agricultural, technical and ecological knowledge (comprising cultigens, medicines and the phenotypes of flora and fauna);
• all items of movable cultural property;
• cultural governance and practice;
• human remains and tissues;
• immovable cultural property (including sacred and historically significant sites and burial grounds); and
• documentation of Indigenous peoples’ culture(s) and heritage in archives, genealogies, film, photographs, artwork, literary and scholarly works, videotape or audiotape and all forms of media.

Indigenous data

Includes data, information and knowledge, in any format, that impact Indigenous peoples, nations and communities at an individual and collective level. Data can be quantitative or qualitative or both. It includes, without limitation, data about land and environment, people and cultures. It may be generated by Indigenous peoples or government or other institutions including research organisations. 

Indigenous Data Governance

Refers to the right of Aboriginal and Torres Strait Islander people to manage what, how, where, when and why Indigenous data is collected, accessed, stored and used.

Indigenous Data Sovereignty (IDSov)

The right of Indigenous people to exercise ownership over Indigenous data. Ownership of data can be expressed through the creation, collection, access, analysis, interpretation, management, dissemination and reuse of Indigenous data.  IDSov rights are enshrined in Article 31 of the UNDRIP.

Information that describes data, including its meaning, structure, origin, context, and use, to support understanding, management, and reuse.

Personal information

Information or an opinion (including information or an opinion forming part of a database), that is recorded in any form and whether true or not, about an individual whose identity is apparent, or can reasonably be ascertained, from the information or opinion, but does not include information of a kind to which the Health Records Act 2001 applies.

Record

Information captured as evidence of Swinburne’s business activities, decisions, and transactions. Examples include emails, reports, correspondence, meeting agendas and minutes, file notes, and decisions. Records management is integral to the University’s operations and accountability. Certain records must be retained for a specified period to meet legislative requirements. Records can be in physical or digital form.  

Research data

Records or materials, in any format, that comprise the observations, findings, or outcomes of research, including data created manually by researchers and data generated automatically by instruments, machines, sensors or other research equipment.

Research data steward

Accountable for the governance, quality, integrity and appropriate management of research data within a defined research project or activity.

Research materials

Physical or digital materials generated, collected or used in the conduct of research, including samples, specimens, artefacts, laboratory materials, notebooks, or models.

Sensitive information

Sensitive information includes personal, financial, and health-related data. It requires heightened protection due to legal, ethical, or reputational risk, and must be handled in accordance with applicable privacy laws and institutional policies. Sensitivity is determined through data classification processes. 

Source system

An information system where data is originally created, captured, or maintained and from which it is made available for use or distribution.

Structured data

Structured data is measurable, such as a set of observations organised into a table, spreadsheet or database. It is commonly stored in relational databases or data warehouses, where rows and columns define a clear structure. This makes it easy to search, filter, and combine data for reporting and analysis. 

Third party

An external individual, organisation, or entity that is not part of Swinburne University and with whom data may be shared.

Unstructured data

Unstructured data cannot be easily measured, such as audio and video files and documents. It is typically stored in file systems, content repositories, or cloud object storage. Unlike structured data, it lacks a fixed schema or formal structure, making search and analysis more complex and often requiring metadata or AI-driven indexing.