Data Governance, Privacy & Records

Is information used lawfully, appropriately and with enduring control?

Establish ownership, stewardship, quality and lineage across the data lifecycle. Govern permitted use, access, privacy and retention, including the data entering AI, its outputs and the records it creates.

Operating principles

What good
looks like.

Purpose limitation

Information is used for a clear, authorised and compatible purpose.

Minimum necessary

Collection, disclosure, prompt content and retention are constrained.

Provenance and quality

Named stewards maintain source lineage, quality expectations and records of material transformations.

Records by design

Prompts, outputs and decisions are captured when they form part of the official record.

Put it into practice

Make it
operational.

Map information flows

Trace collection, retrieval, inference, output, logging, sharing, storage and deletion.

Assess privacy

Identify authority, notice, disclosure, re-identification and individual impact.

Control knowledge sources

Set quality, access, currency, citation and stewardship rules.

Define the record

Determine what must be retained, where, for how long and with which audit trail.

Minimum evidence set

Make the decision
reviewable.

01Data-flow and information asset map

02Privacy impact assessment

03Dataset or knowledge-source documentation

04Retention, access and records schedule

Move from knowledge to practice

Design governance teams can operate.

Connect accountability, evidence and oversight to the way AI is actually delivered and used.

Start a conversation