Mapping Exploding Data Terrain: Data Usage Policies Importance

Big data, artificial intelligence (AI), and data analytics can have a transformational effect on organizational planning and decision-making. With these tools, data can be leveraged to create new products, serve current customers better, or respond more effectively to future marketplace demands. But this rapid increase in the number of data assets being handled and stored means many organizations are behind in implementing proper policies and safeguards to ensure their data assets are used in ways that remain in compliance with regulations, protect customer privacy, and are consistent with organizational values. That opens organizations up to significant liability, especially given recent shifts toward more data transparency, stronger privacy regulations, and greater control by stakeholders over how their data is used.

Imagine a hospital partnering with a health tech company and inadvertently sharing patient data without consent, or a business failing to store their European customers’ data on the right servers and violating the EU’s General Data Protection Regulations (GDPR) about where data can be stored. There are all sorts of ways that data usage can run afoul of regulations, thereby exposing companies to reputational, regulatory, financial, privacy, cyber, and access risks. Most of the time, these data usage violations aren’t deliberate. They typically arise from a lack of clarity across the organization around the proper legal and ethical use of data sets collected in different situations and under different regulatory requirements.

There are three tenets of good enterprise data management. The first, data governance, ensures that the people, processes, and technology of an enterprise have clear guidelines for how to handle data assets. The second, data usage, involves the processes that determine how data can be used, stored, and handled. The third, data access, makes sure access to data is limited to only those authorized and required to handle it. In this paper, we will be focusing on the need for better data usage capabilities and outlining how organizations can create effective data usage programs. Data usage policies are a critical part of reducing risk and improving data protection and privacy.

What is a Data Usage Program?

Data usage programs are internal policies, procedures, controls, and technologies that an organization uses to ensure that data is handled, stored, and used in ways that are appropriate and compliant. Data usage programs may include the following:

• Data asset risk assessments
• Data definitions
• Data classification/cataloging
• Data inventories
• Metadata use
• Data accountability and ownership policies
• Data compliance policies
• Data use surveillance
• Technological data usage controls
• Usage management systems
• Access management systems
• Change management

The Importance of Data Usage

Organizations are currently handling more data than ever—and they are trying to find ways to leverage that additional information for greater organization value. At the same time, regulators and consumers are demanding more oversight and transparency around data usage and privacy. Creating rigorous data usage capabilities is a critical step to ensuring an organization does not violate the terms under which they collected a data set or the regulations that govern its use and storage. But policies are not enough. Organizations must also implement controls and technologies to monitor and ensure proper data usage.

That involves developing procedures to tag data with metadata during the collection and ingestion phases. It also entails appointing an office to be responsible for ensuring that data is stored and used according to all relevant regulations and agreements. That includes such things as making sure only the proper people have access to that data, ensuring that the data isn’t added to other data sets that will be used for noncompliant or unapproved purposes, creating technological controls that prohibit the use of data for unauthorized purposes, and ensuring data is destroyed along with any timelines and according to any agreements made with the source of the data during collection. Creating policies to outline data use is another important aspect of the process. These policies should establish guidelines such as who the data users are, what the purpose is of data use, what rules each data set has around its use, what compliance frameworks need to be followed, what the products of data use might be, and what type of user support is provided.

Not complying with regulations and agreements over data use can pose significant financial, reputational, and regulatory risks for companies. As managing data becomes an increasingly complicated proposition, it’s important that organizational data management encompasses rigorous data usage efforts, including the implementation of proper policies, controls, tagging, and technologies. It’s essential to tackle the intricacies of data usage now, since related challenges will only get more complex in the future as enterprises handle more data while trying to navigate emerging regulations about data usage, protection, and privacy.

What Can Data Usage Programs Help With?

Good data usage programs are critical for reducing risk. They can help your organization:

• Ensure compliant data usage
• Clarify ownership of data usage compliance
• Implement proper metadata tagging to make data usage compliance easier
• Ensure data is stored in the right manner
• Help create access rules around data sets
• Implement rules-based technological controls to prohibit data misuse
• Govern how data is combined and shared
• Prepare for emerging data regulations

Guidehouse’s Data Usage Strategy

Guidehouse’s data experts have considerable experience working with corporate and government organizations to design and implement the policies, controls, tagging, and technologies needed to effectively manage organizational data usage.

We follow a six-step data usage process:

How Guidehouse Can Help

Guidehouse’s substantial experience and capabilities around data usage have helped many enterprises ensure their policies and procedures protect data from being accidentally misused due to a disconnect between the data and the regulations and agreements that govern its use. By integrating data usage transformation practices with Guidehouse’s data governance and data access expertise, organizations can get support in developing and implementing a truly modern data strategy that protects against data handling risks and prepares organizations for a future where data and data protection are even more important.