T6: Data governance

Organisations should look after people’s information securely and manage data in ways that are consistent with relevant legislation and serve the public good.

What you should commit to

T6.1 All statutory obligations governing the collection of data, confidentiality, data sharing, data linking and release should be followed. Relevant nationally- and internationally-endorsed guidelines should be considered as appropriate. Transparent data management arrangements should be established and relevant data ethics standards met.

T6.2 The rights of data subjects must be considered and managed at all times, in ways that are consistent with data protection legislation. When collecting data for statistical purposes, those providing their information should be informed in a clear and open way about how that information will be used and protected.

T6.3 Organisations, and those acting on their behalf, should apply best practice in the management of data and data services, including collection, storage, transmission, access, and analysis. Personal information should be kept safe and secure, applying relevant security standards and keeping pace with changing circumstances such as advances in technology.

T6.4 Organisations should be transparent and accountable about the procedures used to protect personal data when preparing the statistics and data including the choices made in balancing competing interests. Appropriate disclosure control methods should be applied before releasing statistics and data. Appropriate protocols should be applied to approved researchers accessing statistical microdata.

T6.5 Regular reviews should be conducted across the organisation, to ensure that data management and sharing arrangements are appropriately robust.

Guidance and resources

Office for Statistics Regulation guidance on building confidence in the handling and use of data. It covers handling data to produce and publish official statistics, and making data available to external users, in ways that are transparent and accountable.OSR data governance guidanceOSR
The National Statistician's Data Ethics Advisory Committee (NSDEC) was established to advise the National Statistician on the ethical considerations of accessing, sharing and using data. NSDEC considers project and policy proposals from the Office for National Statistics (ONS) and the Government Statistical Service (GSS) and advises the National Statistician on the ethical appropriateness of these.National Statistician's Data Ethics Advisory Committee (NSDEC)UKSA
NSDEC has produced an ethics self-assessment toolkit. It provides an easy-to-use framework for researchers to review the ethics of their projects throughout the research cycle.NSDEC ethics self-assessment toolkitUKSA
The National Statistician’s Quality Review on privacy and data confidentiality methods brings together important evidence about statistical disclosure control. It aims to help the Government Statistical Service (GSS) take full advantage of the cutting-edge developments and research conducted by world leading experts from across academia and the private sector.Privacy and data confidentiality methods: a National Statistician’s Quality Review (NSQR)GSS
A series of guidance on documents on statistical disclosure control produced by GSS and the Government Social Research Profession (GSR). There is separate guidance for tables produced from administrative data, tables produced from surveys, and microdata produced from social surveys.Guidance on Statistical Disclosure ControlGSS/GSR
A webpage that provides helpful information about data protection. The Data Protection Act controls how personal information is used by organisations, businesses or the government.Data Protection Act websiteUK Government
The Open Data Institute's (ODI) Data Ethics Canvas is designed to help identify potential ethical issues associated with a data project or activity. The webpage contains a user guide, a template and a workshop plan.ODI Data Ethics CanvasODI
Guidance from the Information Commissioner’s Office (ICO) for organisations on data legislation, governance and information management, including the Data Protection Act, the General Data Protection Regulation, and Freedom of Information requests.ICO guidance for organisationsICO
The ICO’s anonymisation code of practice explains the issues surrounding the anonymisation of personal data, and the disclosure of data once it has been anonymised. It describes the steps an organisation can take to ensure that anonymisation is conducted effectively, while retaining useful data.Anonymisation: managing data protection risk code of practice (PDF, 1.89MB)ICO
A guide for those who have day-to-day responsibility for data protection. It explains the purpose and effect of each principle, gives practical examples and answers frequently asked questions.ICO data protection principlesICO
The UK Anonymisation Network (UKAN) offers practical advice and information to anyone who handles personal data and needs to share it.UKAN resourcesUKAN