Minimum Details Required

The Information Ownership Register is the simplest, comprehensive list of who is responsible for what. It should have at least the following columns:

• Data Domain / Subject Area
• Data Owner

Alternatively, where the decision has been made to allocate responsibilities on a per business unit basis (rather than a per data domain / subject area basis) the minimum columns might be:

• Business Unit
• Data Officer

Adding fields relating to data governance and other policies

Many organisations have data / information classification policies; and the data governance policy hierarchy will also include such as policy. The Data Classification Policy typically creates an obligation to classify all data on creation with classifications such as:

• Public - can be published and distributed externally
• Internal - can be seen by all internal staff, contractors, etc
• Confidential - can only be seen by those authorised
• Customer / PII - contains personally identifiable customer information, or employee information
• Restricted - can only be seen by authoirised members of the executive team

Classification policies often become a catch-up for a number of other aspects of data-related controls. But the core is able ensuring classification occurs so that you can then impose an obligation to "design controls commensurate to the classification" and other such language.

If you would like to include a default classification across a whole data domain, you can simply add a column that specifies the default classification for that data domain. This means all data that falls into the definition of that data domain already has a default classification and any policy statements that relate to that classification automatically apply. Mechanisms then exist to re-classify the data when a derived piece of content is created.

Adding fields to deal with the boundaries of responsibility

Complexities that are added during the process of finalising the Information Ownership Register. Although the direction given will be to keep the Information Ownership Register simple, when you are talking about accountability and responsibility the people you propose as data owners or data officers will themselves introduce complexity as they qualify the scope of what they are responsible for.