Data¶
Defra's science, regulation and payments all depend on trusted data. These guardrails make sure the data each service creates is an asset for the whole department.
Doctrine: 4. Data is an enterprise asset, 5. Assume AI until proven otherwise
Principles: 4. Clean data, clear decisions
Who these guardrails apply to
The core department. Whether the data guardrails also apply to Defra's arm's length bodies is still to be confirmed.
See also enterprise data architecture.
GR-DATA-01 Every data set has an owner¶
Should Each data set a service creates or holds has a named business owner (information asset owner) and is recorded in the information asset register.
Why: Data without an owner is not maintained, not trusted and not deleted when it should be.
GR-DATA-02 Use authoritative sources¶
Should Use the authoritative source for shared entities - customers, organisations, land parcels, holdings, locations, species - rather than creating local copies that drift. See Defra on a page.
How to meet it: If you must cache or replicate, record the source, refresh frequency and how you handle changes.
GR-DATA-03 Use agreed data standards and identifiers¶
Should Use the data standards for dates, addresses, locations, identifiers and code lists, so data can be joined across services.
GR-DATA-04 Collect once, share safely¶
Should Do not ask users for information Defra already holds. Share data between services through APIs or governed data products, with data sharing agreements where required.
GR-DATA-05 Describe your data¶
Should Publish metadata for data sets so they can be found and understood - UK GEMINI for geospatial data and DCAT for other data sets.
GR-DATA-06 Protect personal data by design¶
Must Complete a data protection impact assessment (DPIA) before processing personal data, minimise what you collect, and apply retention and deletion automatically.
Why: UK GDPR and the Data Protection Act 2018; TCoP point 7.
GR-DATA-07 Open by default¶
Should Publish non-personal, non-sensitive data as open data under the Open Government Licence, through the Defra Data Services Platform or data.gov.uk.
GR-DATA-08 Manage data quality¶
Should Define, measure and report data quality using the Government Data Quality Framework, especially for data that feeds payments, regulatory decisions or official statistics.
GR-DATA-09 Retain and dispose of records properly¶
Must Apply Defra's retention schedules. Records of permanent value are identified for transfer to The National Archives.
Research data¶
User research often collects personal data: recordings, notes, contact details and what participants type into prototypes. How to do this is set out in the user research standards and guidance (consent, participant data handling, and storage and retention) and tools in the Defra Digital Service Manual. These guardrails cover the architecture side.
GR-DATA-10 Handle research data safely¶
Should Collect research data only with informed consent, store recordings and notes only in Defra-approved places, delete them when they are no longer needed, use only Defra-approved research tools, and screen research for a DPIA.
Why: Research recordings and notes are personal data about real people. Keeping them in personal accounts, unapproved tools or for longer than needed puts participants at risk and breaks data protection law.
How to meet it:
- Get informed consent before each session, using the templates in the manual's standards and guidance.
- Store recordings and notes only where the manual's participant data storage and retention guidance says, and set a deletion date when you collect them.
- Use only the manual's approved research tools, and check a tool can hold the data you plan to collect. Assess any new tool before using it (GR-TECH-04).
- Screen the research for a DPIA (GR-DATA-06), especially for new tools, sensitive topics or recordings of people's homes or farms.
- Do not put recordings or transcripts into AI tools except as the AI digital toolkit allows.
This guardrail is a draft proposal. Comment on it by opening an issue.
GR-DATA-11 No real personal data in prototypes¶
Should Prototypes, research materials and test environments use made-up or anonymised data, never real personal data copied from a live service or spreadsheet.
Why: Prototypes are shared widely, hosted on less protected platforms and shown to participants. Real data in them can be seen by people who should not see it.
How to meet it: make up realistic names, addresses, holdings and reference numbers. Tell participants not to enter their own real details into a prototype unless the research plan allows it and the data is handled under GR-DATA-10. If a test genuinely needs real data, agree it through a DPIA first.
This guardrail is a draft proposal. Comment on it by opening an issue.