Information and data life-cycle management policy

Information and data life-cycle management policy

DA-01 — Information ownership

[Organisation] assigns an owner for information used or produced by its systems. The owner records the information’s purpose, source, sensitivity, quality needs, permitted users, recipients and retention basis. Custodians operate storage and handling arrangements on the owner’s behalf. The record distinguishes ownership of a business responsibility from intellectual-property rights or an individual’s applicable information rights.

The inventory covers source data, derived information, documents, database records, logs, backups, extracts, test data and model-related information within scope. The owner identifies where copies and transformations exist and which system is relied upon for the relevant authoritative record. Information received from another party retains the applicable provenance and handling obligations.

DA-02 — Classification and handling

The owner applies the organisation’s information classification or handling scheme at [location]. The record identifies the harm or obligation that justifies the handling conditions. Conditions cover access, storage, transfer, publication, copying, use in development and disposal. Where information from different categories is combined, the owner assesses the resulting sensitivity and permitted use.

People handling the information receive instructions appropriate to their activity. Labels support those instructions but do not themselves enforce them. The custodian implements selected access, encryption, logging and transfer controls and retains evidence of their operation. Changes to classification or permitted recipients are recorded with their authority and effect on existing copies.

DA-03 — Collection and quality

The owner identifies the information needed for the approved purpose and the conditions for collection or receipt. Sources, rights of use and relevant limitations are recorded. Information is checked for the quality required by its intended use, including completeness, accuracy, currency and consistency where relevant. A dataset suitable for one decision is not automatically suitable for another.

Quality defects are recorded with affected records, consequences, correction responsibility and downstream actions. The owner preserves provenance when information is transformed, combined, labelled or used to derive new outputs. Where source quality or provenance is unknown, that limitation accompanies the information and is considered before relying on it.

DA-04 — Access and transfer

Access is authorised for the recorded purpose and reviewed according to the responsibility and schedule records. The custodian identifies users, service identities and supplier access, including indirect access through integrations and exports. Access changes are coordinated when a role, purpose or agreement changes. Evidence identifies who authorised the access and what scope was granted.

Transfers identify sender, recipient, information, purpose, mechanism and applicable conditions. The owner confirms that the recipient is within the authorised processing arrangement and that required protections are in place. Cross-border or other regulated transfers are linked to the applicable obligation decision. Transfer completion and significant errors are recorded, and misdirected information enters the incident assessment process.

DA-05 — Retention and preservation

The owner sets retention by information category and purpose, identifying applicable legal, contractual, operational and assurance requirements. The schedule states the event that starts the retention period, the duration, the responsible custodian and the disposal action. Different copies may have different operational roles, but their retention basis remains explicit.

A preservation hold identifies the information, reason, authority and review arrangement. Holds are applied to affected disposal activities and removed only by the appropriate authority. The owner records the consequence where a request for deletion conflicts with a continuing obligation. The organisation does not adopt a single arbitrary retention period for every category of information.

DA-06 — Correction and disposal

Correction records identify the error, authorised change, affected copies and downstream recipients. The owner determines whether previous decisions or outputs require review. History is preserved where needed for accountability, subject to the applicable handling and retention arrangements. Correction does not require retaining unnecessary sensitive information indefinitely.

Disposal follows the method selected for the storage medium, service and information sensitivity. The custodian records the scope, method, date, performer and verification evidence. The action considers replicas, backups, exports, caches, supplier copies and derived stores where relevant. Where immediate removal from a backup is not feasible, the owner records the retention and restoration controls that prevent improper reintroduction and the date or event for final removal.

DA-07 — AI and development information

Information used for training, fine-tuning, evaluation, retrieval or prompts is recorded with its permitted purposes and source conditions. The owner identifies whether a provider may retain it, use it for its own model improvement or disclose it to downstream parties. The selected service configuration and agreement are recorded rather than inferred from a general product description.

Derived model artefacts and embeddings are assessed for sensitivity and the possibility of retaining or exposing source information. A request to remove source information triggers assessment of affected derived artefacts and feasible actions. The record does not claim that deleting a source row necessarily removes its influence from a trained model.