Data Roles and Responsibilities Policy

Posted on by
Title: Data Roles and Responsibilities Policy, Information Technology
Policy Owner: Information Technology Services / Chief Information Security Officer 
Applies to:  All students, faculty, and staff  
Campus Applicability:  All campuses except UConn Health 
Effective Date: August 30, 2021
For More Information, Contact UConn Information Security Office 
Contact Information: techsupport@uconn.edu or security@uconn.edu 
Official Website: https://security.uconn.edu/

PURPOSE 

To define the responsibilities of individuals within the organization in protecting the University of Connecticut’s data assets. 

APPLIES TO 

This policy applies to all University faculty, staff, students, student employees, volunteers, and contractors who have access to or have been assigned one of the roles defined in this policy. 

POLICY STATEMENT  

Through the normal course of operations of the University, ever increasing amounts of data are created, processed, modified, and eventually disposed of as part of daily activities. To ensure the proper management of the various data sets, the University has defined the following roles and responsibilities to ensure data is properly protected, used, and managed throughout its lifecycle. 

Data Stewards are employees of the university responsible for the overall use and proper handling of administrative, academic, public engagement, or research data. Data Stewards must classify data according to the University’s Data Classification Policy. Data Stewards ensure that appropriate steps are taken to protect data and implement policies and agreements that define appropriate use of data.  

The Data Steward or their designated representatives are responsible for: 

  • Ensuring the information they are responsible for is accurate 
  • Authorizing the specific use of information across the organization 
  • Working with other Data Stewards to resolve conflicting data issues 
  • Specify appropriate controls, based on data classification, to protect the data from unauthorized modification, deletion, or disclosure 
  • Ensuring access rights are evaluated on a regular basis 

    Data Administrators are usually system administrators who are responsible for applying appropriate controls to data based on its classification level and required protection level. Data Administrators are also responsible for securely processing, storing, and recovering data. The Data Administrator is accountable for: 

    • Implementing the appropriate controls specified by the Data Stewards 
    • Removing access rights to specific data resources due to a job change or separation from the University 
    • Implementing the appropriate monitoring techniques and procedures for detecting, reporting, and investigating incidents 
    • Assisting Data Stewards in evaluating the overall effectiveness of controls and monitoring  

    Data Users are individuals who receive authorization from the Data Steward/Administrator to access, enter, or update information. Data Users  must use the resource only for the purpose specified by the Data Steward, complying with controls established by the Steward, and preventing disclosure or confidential or protected information. 

    ENFORCEMENT 

    Failure to properly fulfill the roles and responsibilities articulated in this policy may result in appropriate disciplinary measures in accordance with University By-Laws, General Rules of Conduct for All University Employees, applicable collective bargaining agreements, and the Student Code. 

    Questions about this policy or suspected violations may be reported to any of the following: 

    Office of University Compliance –  https://compliance.uconn.edu (860-486-2530) 

    Information Technology Services Tech Support –  https://techsupport.uconn.edu (860-486-4357) 

    Information Security Office – https://security.uconn.edu 

     

    POLICY HISTORY 

    Policy created:  May 16, 2012 

    Revisions: August 30, 2021 [Approved by President’s Senior Team]