��������

Purpose

This Policy establishes an enterprise-wide oversight framework to support effective Information Governance across the University and facilitate the integration of the following standards and attributes into applicable University decision-making:

1. Authenticity;
2. Availability;
3. Confidentiality;
4. Data Governance;
5. Data Mapping;
6. Data Minimization;
7. Integrity;
8. Privacy; and
9. Security.

1. This Policy applies to all University operations involving University Information or its Information Resources.
2. This Policy applies to all University Employees as well as adjunct faculty, Contractors, consultants, temporary employees, and other third parties performing duties on behalf of the University.

Definitions

Defined terms are capitalized throughout this Policy and can be found in the Information Governance Glossary.

1. The University shall establish an Information Governance Team (”IGT”) comprised of representatives from the various functional areas of the University. The primary responsibilities of the IGT shall be to:
   1. Provide interdepartmental oversight and strategic management of the University's Information and Information Resources;
   2. Facilitate the integration of Privacy by Design into University operations; and
   3. Support the development and review of Information Governance related policies and procedures across the University.
2. The University shall establish an Information Governance Operations Team that shall provide support to the Information Governance Team by performing the following tasks, among others, on behalf of the Information Governance Team:
   1. Provide all necessary background information and research materials on topics put before the Information Governance Team for review or approval.
   2. Provide frequent and regular updates on on-going matters previously introduced to the Information Governance Team for review or approval.
   3. Determine topics for Information Governance Team to review, discuss and/or approve.
   4. Ensure that all tasks required to enforce decisions determined by the Information Governance Team are completed in a timely, effective, and efficient manner.
   5. This group shall meet as needed to collate, review, and evaluate Information Governance topics.
3. University Employees and third parties performing duties on behalf of the University shall consult with the University's Data Protection Officer ("DPO") and, when applicable, the IGT when:
   1. Initiating a new program, project, policy, practice, acquisition, or business operation that involves Information Resources or the Processing of University Information;
   2. Updating an existing program, project, policy, practice, acquisition, or business operation that involves Information Resources or the Processing of University Information; and
   3. Assessing other issues that may fall under the scope of Information Governance.