Information Ownership Register

Extracted from the public Notion original. Notion record created 2019-12-11. Last edited 2019-12-11.

Minimum Details Required

The Information Ownership Register is the simplest, comprehensive list of who is responsible for what. It should have at least the following columns:

• Data Domain / Subject Area

• Data Owner

Alternatively, where the decision has been made to allocate responsibilities on a per business unit basis (rather than a per data domain / subject area basis) the minimum columns might be:

• Business Unit

• Data Officer

Adding fields relating to data governance and other policies

Many organisations have data / information classification policies; and the data governance policy hierarchy will also include such as policy. The Data Classification Policy typically creates an obligation to classify all data on creation with classifications such as:

• Public - can be published and distributed externally

• Internal - can be seen by all internal staff, contractors, etc

• Confidential - can only be seen by those authorised

• Customer / PII - contains personally identifiable customer information, or employee information

• Restricted - can only be seen by authoirised members of the executive team

Classification policies often become a catch-up for a number of other aspects of data-related controls. But the core is able ensuring classification occurs so that you can then impose an obligation to "design controls commensurate to the classification" and other such language.

If you would like to include a default classification across a whole data domain, you can simply add a column that specifies the default classification for that data domain. This means all data that falls into the definition of that data domain already has a default classification and any policy statements that relate to that classification automatically apply. Mechanisms then exist to re-classify the data when a derived piece of content is created.

Adding fields to deal with the boundaries of responsibility

Complexities that are added during the process of finalising the Information Ownership Register. Although the direction given will be to keep the Information Ownership Register simple, when you are talking about accountability and responsibility the people you propose as data owners or data officers will themselves introduce complexity as they qualify the scope of what they are responsible for.

Adding Product-line column

When the organisation is primarily structured around product lines or markets it may be that natural ownership of data split depending on product line. For example, in a life insurance company the data owner for "contracts" (i.e. what customers have what policies") may be different for for the products relating to the Individual insurance products versus the Group insurance products.

If you have no Core Shared Data Strategy and have made no decisions on data mastering approaches, you can simply add a column to the Information Ownership Register to indicate which project-line the row relates to. This means you can just show:

Alternatively, you might introduce a hierarchy of data domains such that that the table becomes as follows:

Using the hierarchy approach may be more suitable where there are multiple ways that ownership might be split other than by product line. The other advantage is that it allows another data owner to be added to the register that is responsible for the data domain regardless of the product line.

Data ownership and organisational design

The complexity of the the Information Ownership Register cannot be managed independently of the complexity of organisational design in general. It is also not the responsibility of the data governance function or the Information Ownership Register to compensate for deficiencies, uncertainty, and unnecessary complexity introduced by other aspects of how the organisation is governed.