ºìõ¹åÉçÇø

Scope

These procedures apply to all ºìõ¹åÉçÇø staff, students, contractors, consultants and third parties in their handling of data in any format collected, managed or used by ºìõ¹åÉçÇø. This includes all data collected, used or generated at ºìõ¹åÉçÇø or during ºìõ¹åÉçÇø affiliated research projects or research activities, including published research data, unpublished research data, and research materials, whether digital or physical.

These procedures may not apply to data acquired under a commercial licence or agreement (e.g. Library scholarly materials), where the terms of use will take precedence.

1. Data categorisation

For governance purposes, data is grouped into topics. Each topic contains entities, which are groups of data related to that topic. Each data topic is assigned to a , and each entity is assigned to a .  

The collection of topics and entities forms the ºìõ¹åÉçÇø , which applies to both enterprise and research data.

Records are categorised by their business function using the ºìõ¹åÉçÇø Business Classification Schema. Data stewardship of records is determined by the .

For research data, stewardship is assigned to the relevant Research Data Steward, enabling governance at the level of the research activity.

2. Data management lifecycle

2.1. Plan and design

This section sets out requirements for the planning and design of enterprise data assets, systems and data-enabled projects.

Data management requires early planning, including assessment of data needs for projects, processes or system development; risk assessment; data quality and ingestion requirements; enterprise architecture review; and assignment of accountability.

Engagement with Enterprise Architecture is required to ensure systems and data management solutions are appropriately designed and aligned with enterprise standards. Enterprise projects must be approved through the Architecture Review Board, which includes assessments relating to data access, sharing, , IT security and data governance.

The creation, development, application and management of data in enterprise projects must comply with data and information retention schedules and records management requirements. Every enterprise data asset must be linked to a Data Custodian and a Data Steward.

Metadata must be described and managed throughout the data lifecycle. Metadata must be recorded for all records and configured in systems to support discovery, use, access, governance and preservation through system changes.  Definitions, terms and measurements used to describe enterprise data must be defined and applied consistently across the University.

Master data management applies to enterprise data only. Responsibility for the management and governance of master data is shared between the Data and Artificial Intelligence team and Data Stewards and/or Custodians. Primary responsibility for determinations relating to a specific master data topic or entity rests with the Data Trustee and/or Data Steward.

Research data:

Data planning for research projects is undertaken through a Research Data Management Plan (RDMP). An RDMP is required where the project involves ethics approval; Indigenous Cultural and Intellectual Property; or external funding, partner or contractual obligations that specify data management requirements.

Where an RDMP is not required under the paragraph above, researchers are strongly encouraged to maintain an RDMP proportionate to the scale, sensitivity and risk of the research project or activity. RDMPs document arrangements for data storage, access, security, retention, archiving, disposal and sharing in accordance with applicable research governance, ethics, legal, contractual and regulatory requirements. RDMPs should be owned and maintained by the researcher and updated throughout the project lifecycle.

RDMP expectations may be satisfied through an ethics application, funder documentation or other approved project governance record where the required data management information is captured and materially aligned.

For cross-institutional or industry-embedded research activities, governance arrangements must be formalised through agreements and documented in the RDMP or equivalent documentation.

Where supervisory or candidature arrangements change, responsibility for research data must be formally transferred or confirmed and documented in the RDMP or equivalent project governance records.

2.2. Create, capture and classify

Data creation and collection

Data must only be created, used and shared for legitimate and necessary uses that add value to the University. Personal use of enterprise data, including derived data, is prohibited.

Personal and health data must be collected in compliance with ³§·É¾±²Ô²ú³Ü°ù²Ô±ð’s Privacy Procedures and relevant Privacy Statements.

Research data:

Research data collection must comply with ethics approvals, privacy requirements, funder/ partner agreements and the .

Research data is held and controlled by ºìõ¹åÉçÇø, unless subject to a third-party licence agreement, research data sharing agreement or intellectual property agreement.

Agreements governing ownership, stewardship and control of research data must be reviewed and documented when researchers join, leave or move between institutions.

Data classification

The university has legal and ethical obligations to protect data assets, personal privacy and communal privacy when there is culturally shared data, such as among Aboriginal communities. Data must be classified with the data classification categories in the Data Classification Guideline.

All data must be assigned one of the when assessing who can access which types of data. The classifications categorise data assets based on confidentiality, availability, and integrity needs.

By default, the University supports open access to appropriate enterprise data. Access to data must not be restricted without a valid reason.

Research data:

Classification decisions are made with researcher input.

Data security and protection

Data in all formats must be protected consistently throughout the data lifecycle in a manner commensurate with its classification regardless of where it resides or what purpose it serves.

Data privacy must be maintained as determined in the Privacy Procedures and in respect to all personal data managed across ºìõ¹åÉçÇø University.

Data security controls must be implemented based on the highest level of sensitivity.

If there is a data breach relating to personal data, the must be followed.

If there is a data security incident, the must be followed.

Any issues or practices impacting on data security must be referred to the Chief Information Security Officer and the relevant Data Steward or Data Custodian.

Research data:

Inappropriate access to, loss of, or failure to retain research data must be reported in accordance with institutional incident and breach reporting processes.

2.3. Store and secure

Enterprise data must be in a ºìõ¹åÉçÇø-approved platform.

Data storage must be secure, appropriate to the classification, confidentiality risk rating and value of the data, and comply with legal, ethical and operational requirements.

Data must be accessible to approved users in accordance with its classification and authorised purpose.

Personal and health data must be stored in compliance with ³§·É¾±²Ô²ú³Ü°ù²Ô±ð’s Privacy Procedures and relevant Privacy Statements.

Personal, confidential, restricted or regulated data must not be transferred or stored outside approved jurisdictions without documented risk assessment and approval from the relevant Data Steward and Privacy Officer.

When contracting with third parties, the University requires, where possible, that they accept and will adopt the University’s privacy and data protection obligations set out within Schedule 1 of the Privacy and Data Protection Act 2014 (Vic) (PDPA). This does not diminish the University’s responsibilities to protect private data it collects, holds and uses.

Record storage

As a public office under the , ºìõ¹åÉçÇø University of Technology is required to create, manage, retain and dispose of records in accordance with recordkeeping standards issued by the Public Record Office Victoria (PROV).

Records must be captured in a ºìõ¹åÉçÇø-approved System of Record (SOR). A SOR is a business system assessed to meet recordkeeping requirements, including legislative compliance, authenticity, reliability, usability, and the ability to capture core metadata. The main System of Record for ºìõ¹åÉçÇø is Content Manager.

The SOR must restrict access appropriately, prevent unauthorised deletion, maintain audit logs, and support migration or disposal in line with retention periods. Each SOR must have an identified business owner and system owner.

Ownership of records and recordkeeping systems must be defined and allocated, ensuring accountability throughout the lifecycle.

Records stored offsite must use an approved provider and be appraised by a disposal authority prior to transfer. Physical records must be stored securely, with access restrictions commensurate with their classification and value. Scanning records from hardcopy to digital does not alter the , as determined by the retention and disposal authority; destruction of source paper records must occur only if are met.

Research data:

Research data should be in approved research platforms or repositories.

Exceptions (non-standard platforms) require risk assessment and documentation in the RDMP.

Physical research materials must be stored and managed in accordance with applicable research governance requirements, including ethics approvals, safety requirements, cultural considerations and institutional guidance. Durable records derived from research materials must be retained and accessible, even where the materials themselves cannot be kept.

Access to, use of, or transfer of research data must comply with applicable research security requirements, including export controls, sanctions and other regulatory obligations. Access may be restricted or revoked where required to maintain compliance. Given the rapidly evolving nature of research security requirements, researchers should seek advice from ºìõ¹åÉçÇø Research before entering data sharing arrangements with international parties, particularly in sensitive or dual-use research areas.

2.4. Manage and maintain

and integrity measures must be taken to assure the quality and integrity of university data. Data Stewards, Data Custodians and Data Users must contribute to continuous improvement in the quality of data and information.

Data Stewards, Data Custodians and their delegates are responsible for managing the quality of data that they develop, manage and distribute, including:

• validation of their data prior to distribution
• co-development, management and implementation of data quality improvement projects and activities
• maintenance and improvement of data quality across the data lifecycle, including meeting agreed KPIs
• ongoing monitoring of data quality in data sources including identification, logging and resolution of data quality issues.
   

Data Users must take appropriate actions to uphold the quality and integrity of the data they access and the accuracy and validity of reports and outputs that they generate from entering, developing and applying the data. This includes understanding reports, data sets and explanatory notes and accessing training and assistance.

Personal and health data must be managed and maintained in compliance with ³§·É¾±²Ô²ú³Ü°ù²Ô±ð’s Privacy Procedures and relevant Privacy Statements.

Research data:

Research data quality is discipline and method driven and may be defined by project-specific, methodological or scholarly standards. Enterprise data quality metrics do not automatically apply to research data. 

2.5. Share and re-use

Data must be discoverable to streamline sharing and re-use for appropriate activities, and to support compliance with internal and external information requests. Accurate metadata must be maintained to enable discovery and the correct assessment of classification.

Data sharing

Enterprise data must not be accessed, viewed, shared or used by anyone from outside the business unit that is responsible for managing the data without approval from the relevant Data Trustee or Steward, unless an exemption applies or has been granted by the Data Trustee. The sharing of data must accord with the classification of the data.

Enterprise data must not be accessed, viewed, shared or used by an external third-party (including product vendors and service providers) without the third-party entering into an approved and legally binding agreement with ºìõ¹åÉçÇø to ensure data security and protection from unauthorised access, use or disclosure, unless an exemption has been granted by the Data Trustee.

³§·É¾±²Ô²ú³Ü°ù²Ô±ð’s cover purpose, people, data, settings and output and are adapted from the Five Safes framework to ensure safe, secure and responsible data sharing. Requests to share data must show how the proposed use will meet these criteria. The process for obtaining data sharing approval is outlined in the .

Research data:

Research data should be made as open as possible and as closed as necessary. Permissible grounds for restriction include ethics conditions, participant consent, intellectual property obligations, commercial or contractual obligations, cultural considerations, and applicable legal or regulatory requirements including export controls and sanctions. Sharing is governed by applicable Indigenous Data Sovereignty principles, ethics approvals, consent conditions, contractual obligations and institutional requirements.

Research data may be shared:

• within the research team and with collaborators in accordance with project governance arrangements
• with external parties where permitted under ethics approvals, agreements or data sharing approvals
• for peer review, publication or funder requirements where applicable.
   

 Researchers moving institutions may retain access to non-sensitive data they have generated in accordance with the provisions set out in the Retain and Archive section. Formal agreements are required for sensitive or restricted data. The outlines the processes for sharing research data.

Data access, use and re-use

Data use must be consistent with its classification and approved purpose.  

Access to enterprise data must be granted on a least privilege and need to know basis, in accordance with the and the .

Personal use of data is prohibited.

Access to and the (re)use of personal and health data must comply with ³§·É¾±²Ô²ú³Ü°ù²Ô±ð’s Privacy Procedures, relevant Privacy Statements and ºìõ¹åÉçÇø human research ethics requirements.

Secondary use of enterprise data for learning analytics is permitted only where the proposed use is lawful, ethical, consistent with ³§·É¾±²Ô²ú³Ü°ù²Ô±ð’s Privacy Procedures and relevant Privacy Statements, and approved through the applicable data access, use or sharing pathway. Approval must consider whether the use is legitimate, necessary and proportionate; aligned to student learning, support or institutional improvement; compatible with the original collection purpose or otherwise permitted as a secondary purpose; and subject to appropriate safeguards including data minimisation, access controls, transparency and risk review.

Research data:

For research data, access must be consistent with the open access principle set out in the data sharing section above, and with applicable ethics approvals, consent conditions, funder requirements and contractual obligations. Researchers must ensure that the open access requirements of the Australian Code for the Responsible Conduct of Research 2018 and applicable funder policies – including the ARC Open Access Policy and the NHMRC and MRFF Open Science Policy – are met.

Participant (including community and cultural) consent conditions govern the use, reuse, and sharing of research data, and may limit or override institutional or funder expectations. Participant withdrawal must be managed in accordance with applicable ethical and legal requirements.

Data publication

When enterprise data is used to create a report or dashboard, the definitions, terms and measurements applied must be documented in an enterprise glossary.

Data Stewards, Data Custodians and staff who develop reports or outputs are responsible for providing adequate guidance and support to Data Users. This includes providing labelling, sourcing and explanatory notes in data reports, dashboards and outputs to enable effective and appropriate analysis, application and referencing.

Research data:

Research data must be published through appropriate repositories or platforms where required by funder, ethics or institutional obligations. Publication must include sufficient metadata to support discovery and reuse. Metadata should be published regardless of whether underlying data is openly accessible. Restrictions on publication must reflect ethics approvals, consent conditions, cultural considerations and contractual obligations.

2.6. Retain and archive

of data is set by the Public Records Office Victoria, under the . The ºìõ¹åÉçÇø University Retention and Disposal Authority specifies retention periods for various business functions and research activities, based on PROV standards.  Data must be retained while in use and active. Inactive data must be archived or disposed of in line with the , as determined by external authorities including state legislation.

Physical records with long-term value, as determined by disposal authorities, must be identified and transferred to university records or state archives (PROV).

High-risk and high-value records, such as those relating to core activities, personal or health data, major contracts, or significant organisational change, must be identified, documented, and managed with appropriate business continuity plans. The outlines how to meet these requirements. 

Research data:

Retention periods for research data are determined by Public Records Office Victoria standards, and by additional applicable legal, ethical, regulatory, funding, contractual and disciplinary requirements. Researchers are responsible for identifying and documenting these requirements in collaboration with relevant professional staff.

Where a research project or activity does not require external funding or ethics approval, research data must still be retained in accordance with applicable legal, institutional, disciplinary and scholarly requirements. Active research data used during analysis may not meet the definition of a formal record until captured as evidence of research outcomes.

Where a researcher or research student leaves the University, research data remains with ºìõ¹åÉçÇø and continues to be subject to applicable retention, access and governance requirements.

Researchers may retain access to non-sensitive data they have generated, where consistent with authorship, ethics, contractual and institutional requirements. Access to sensitive or restricted data, and provision of copies, requires formal approval and must consider authorship, supervisory responsibilities, funder obligations, ethics approvals, consent conditions, cultural considerations, contractual obligations and recognised exceptions, including Indigenous data governance arrangements.

Retention periods may be extended where justified by value and risk assessment, and where consistent with applicable regulatory, ethical and contractual requirements, subject to approval by the Research Data Steward. 

2.7. Dispose or destroy

Data and physical research materials must be retained, transferred or disposed of as required by applicable , research governance requirements and recognised exceptions, including Indigenous data governance arrangements. Records must never be destroyed without a formal process of appraisal and consultation with the Manager, Information and Data. Approval for destruction must be obtained, while ephemeral records may be destroyed in accordance with Normal Administrative Practice (NAP).

Research data:

At the end of the retention period, data must be destroyed in a manner which permanently prevents its reassembly. Relevant metadata items describing the data should be updated to indicate that the data has been destroyed.

Definitions

Terms used in this Procedure have the same meaning as defined in the Data Governance Policy, unless otherwise stated.

Procedure details