• Section 1 - Purpose
• Section 2 - Overview
• Section 3 - Scope
• Section 4 - Policy
• Principles
• Responsibilities
• Compliance
• Review
• Section 5 - Schedules
• Section 6 - Procedures and Resources
• Section 7 - Definitions

Section 1 - Purpose

(1) This policy establishes the framework and principles for effective information governance which supports the functions and activities of the RMIT Group.

Section 2 - Overview

(2) RMIT University is a public institution under Victorian law and stands on Aboriginal Country of the Kulin Nation. RMIT recognises and acknowledges the Bundjil Statement that helps all RMIT staff to respectfully work, live and study on Aboriginal Country.

(3) RMIT is committed to managing information as an organisational asset which is created, used and shared effectively whilst meeting legislative requirements.

(4) Information governance provides the framework, strategic objectives, policies and standards to manage information as an asset. This policy and supporting procedures and resources support the strategic plan of the organisation to drive outcomes and support continuous improvement and ultimately optimise integrity, security, availability and quality of information.

Section 3 - Scope

(5) This policy applies to all RMIT staff including staff of controlled entities, students, temporary employees, contractors, visitors and third parties globally who manage RMIT information with the exception of research data as defined by the Research Policy.

Section 4 - Policy

Principles

(6) RMIT is the custodian of all information managed by the RMIT Group. No individual function or group own any part of data or information.

(7) RMIT will take reasonable and necessary steps to ensure information security protection. Information Security Classifications will enable appropriate management of information.

(8) RMIT information will be

1. collected, created, managed, used, re-used and shared according to ethical practices, any applicable laws and with due consideration to individual privacy.
2. appropriately stored to ensure protection from loss and unauthorised access.
3. accessible, transparent and available to be used and shared whilst respecting matters of identity, privacy and confidentiality. This applies to internal as well as third party data.
4. managed in accordance with records management and archiving requirements.

(9) RMIT will implement procedures and practices to ensure all information is captured accurately and completely and managed throughout its lifecycle.

(10) RMIT will provide access to formal or informal learning material to ensure staff have the knowledge, competencies and ability to interact with information in their roles.

Responsibilities

(11) Information governance is overseen by the Chief Data and Analytics Officer (CDAO) with sponsorship of the Vice-Chancellor's Executive (VCE).

(12) The Information Governance Board provides an information governance forum for the RMIT Group.

(13) The Information Trustees are accountable for their respective domain area as set out in the Information Domain Register.

(14) The Information Stewards Group (ISG) provide operational support and recommendations to the Information Governance Board.

(15) The Information Stewards are responsible for identifying and managing information-related risks and issues for their assigned information entities and for escalating these to the data trustees accordingly.

(16) All RMIT staff including staff of controlled entities, students, temporary employees, contractors, visitors and third parties are responsible for:

1. ensuring the quality and completeness of information which they collect or create
2. ensuring that they understand and adhere to procedures and resources under this policy which govern the management, control, storage, transfer and destruction of information throughout its lifecycle
3. supporting a culture that promotes good information governance practices and reporting any identified compliance breaches or incidents
4. managing RMIT information in accordance with the Privacy Policy and Information Technology and Security Policy.

Compliance

(17) Investigations of breaches of this policy or non-compliance with legislation are undertaken in accordance with the Compliance Breach Management Procedure.

(18) This policy is to be read in conjunction with existing university policy documents which include but are not limited to the following:

1. Research Policy
2. Privacy Policy
3. Information Technology and Security Policy
4. Intellectual Property Policy

Review

(19) The Information Governance Board will review this policy annually and undertake a major review every three years in accordance with the Policy Governance Framework.

Section 5 - Schedules

(20) This policy includes the following schedule(s):

1. Schedule 1 – Security Classification Levels

Section 6 - Procedures and Resources

(21) Refer to the following documents which are established in accordance with this policy:

1. Classification of Analytics Data Standard
2. Destruction of Information Procedure
3. Information Management Standard
4. Key Term Definition Standard
5. Long Term Storage of Information Standard
6. Master Data Management Standard
7. Retention and Disposal Authority Standard
8. Source Data Extract Controls Standard

(22) Local resources are available via the Data & Analytics website.

Section 7 - Definitions