Data Oversight Policy

The purpose of this policy is to:

• Promote shared accountability for data quality and classification.
• Provide guidance for coordination on cross-functional data issues.
• Support transparency, compliance, and responsible use of institutional data.

Date	Version Number	Change Description	Referenced Section
12/17/25	1.0	New Document	Entire Document

 Review Process / Approval

Action:	Units	Date
Policy Review	Information Technology Services Institutional Effectiveness	11/12/25
Policy Approval	Executive Council	12/17/25

This Policy applies to:

• All faculty, staff, contractors, and third-party affiliates who create, access, modify, transmit, or store institutional data.
• All data systems and repositories maintained by or on behalf of SUNY Plattsburgh.
• All institutional data (see section 5.0), regardless of format or storage location.

Institutional Data: Data used or created for official administrative or academic purposes.

Data Owner: The individual who is accountable for protecting a dataset, holds the legal rights and defines policies. Data Owners are typically management-level individuals (e.g.,VP’s, Director’s and even can include some department heads) who are ultimately responsible for the security and classification of specific data sets. They determine who has access to the data, how it should be classified, and when it should be archived or destroyed. They are accountable for ensuring that appropriate security controls are in place to protect the data.

Data Custodian: Data Custodians are the technical personnel (e.g., IT staff or third party) who handle the day-to-day management of data, including storage, access control, and backups. They implement the security controls defined by the Data Owner, ensure data integrity, and manage data backups and recovery. They work under the guidance and direction of the Data Owner to fulfill the owner's security requirements.

User: Users are individuals who access and utilize data for business purposes. They must adhere to the security policies and procedures established by the Data Owner and implemented by the Data Custodian. User access is typically granted based on their roles and responsibilities, and they are restricted from accessing data they are not authorized to use.

Data Steward: Optionally designated by the Data Owner to maintain data quality within their areas, document standards, and support unit-level use. Data Stewards serve on the Data Governance Committee.

Data Oversight Committee: The Data Oversight Committee serves as a coordination body for resolving shared data issues across units; recommend practices for consistency; review significant cross-unit changes when escalated. The Committee does not own operational data decisions or enforce changes but facilitates coordination on shared concerns

 Data Owners:

• Data Classification: Determining the sensitivity of different data types and the level of protection each requires.
• 
  Access Control: Establishing who can access which data and under what conditions as well as annual review of that access.
• 
  Security Requirements: Setting data usage rules, backup frequency, and technical controls based on importance and legal obligations.

Data Stewards:

• Fulfill Delegated Roles: The Data Owner of a data set can optionally assign or delegate some or all of their responsibilities to a Data Steward. The Data Steward will fulfill those roles as directed but the Data Owner is ultimately accountable for the data set. Accountability can’t be delegated.

Data Custodians:

• Implementing Security Policies: Configuring firewalls, encrypting data, and setting up access controls as directed by data owners.
• 
  Controlling User Access: Managing user accounts, enforcing security checks, and monitoring access logs.
• 
  Protecting Data: Planning for incidents such as ransomware attacks or hardware failures by patching vulnerabilities and managing antivirus solutions.
• 
  Setting Up Backup Systems: Ensuring data is securely stored and can be quickly restored following any data loss.

Data Users:

• Adhere to Security and Privacy Guidelines: Follow organizational policies and understand applicable privacy regulations (such as GDPR or HIPAA).
• 
  Protect Access: Keep login credentials confidential, create strong passwords, and remain vigilant against phishing attempts.
• 
  Report Problems: Notify IT or security teams of any suspicious activities or security issues immediately.
• 
  Handle Data Carefully: Store, transmit, and dispose of data in accordance with best practices and company protocols.
• 
  Complete annual data security training.

Data Oversight Committee:

• Serve as a coordination body for resolving shared data issues across units. 
• 
  Recommend practices for consistency.
• 
  Review significant cross-unit changes when escalated.

7.1 Data Change and Quality Management

• Data Owners or their delegate Data Stewards are responsible for maintaining data quality and definitions within their domain.
• Changes affecting shared data definitions, code sets, or reporting logic across multiple units should be communicated to the Data Oversight Committee.
• The Date Oversight Committee may facilitate discussions, provide documentation support, and recommend solutions in cross-unit scenarios.

7.2 Policy Review and Updates

• This policy will be reviewed at least once every three years by the Data Oversight Committee and updated as needed.

Data Element Change Request

Data must be handled in accordance with the Information Security Policy and all relevant regulations, including:

• FERPA (Family Educational Rights and Privacy Act)
• HIPAA (Health Insurance Portability and Accountability Act)
• FOIL (New York State Freedom of Information Law)
• SUNY Data Risk Classification Policy
• SUNY Plattsburgh Data Access Control Policy
• SUNY Plattsburgh Data Retention and Secure Deletion Policy
• SUNY Plattsburgh Information Security Policy
• SUNY Plattsburgh Data Governance Policy 

Reference:SUNY Plattsburgh Data Oversight Webpage

Method	Date
Campus Handbook	12/17/25
Faculty / Staff Digest	1/5/26
Student Digest	N/A
Other	N/A

The Office of Institutional Effectiveness is responsible for distributing this policy to Data Oversight Committee members and ensuring members are trained and all units adhere to the policy.