Whether you’re a small business or a multinational corporation, data is the lifeblood of your organization. To ensure that you get a strong return on your investment, you need to build an effective governance framework and implement policies that align with your business goals. You’ll also need the right people to support your efforts. This includes people who can help translate your vision into concrete initiatives, technologies and processes.
The foundation of a data governance framework is a data strategy that sets clear objectives for the future. This should include a vision and a business case. The vision spells out your broad strategic objective, while the business case articulates a specific opportunity. The vision will guide the implementation of policies, while the business case will drive initiatives that deliver a positive return on your investment.
Having the right people in place is essential to a successful data governance program. These people can fill many different roles, including data stewards, governance leaders, and a data audit team. Data stewards are business and IT subject matter experts who help identify how your governance framework affects business decisions and interactions. They can be data and enterprise architects, senior business systems analysts, or experienced business analysts who are comfortable acting as communication bridges between business and IT.
A data governance leader is the person who coordinates tasks for the stewards and helps communicate decisions made by them. This person is also responsible for driving ongoing data audits and metrics that assess program success and ROI. Finally, they serve as the primary point of escalation to the executive sponsor and steering committee.
As Hong Kong moves towards greater openness and integration with mainland China under the “one country, two systems” principle, there will be an increasing need to transfer personal data between Hong Kong and mainland China. To facilitate this, the government has set out extensive guidance on how to fulfil a range of obligations in respect of cross-border data transfers. This guidance aims to give data users flexibility, without diluting substantive protections, to account for commercial arrangements in their contracts with data transferees.
When considering a transfer, it is important to determine whether the data falls within the definition of personal data. This means that the data must relate to a person who can be identified, whether or not that person is currently identifiable. This definition is consistent with the definition in other legislative regimes, such as the Personal Information Protection Law that applies in mainland China and the General Data Protection Regulation that applies to individuals in the European Economic Area.
If the data does not fall within the scope of the PDPO, it is unlikely that the statutory obligations will arise in relation to that transfer. However, it is worth bearing in mind that a data user who engages in a transfer will still be required to comply with the six core DPPs. As such, a data user should take care to ensure that they have the right contractual arrangements in place with any data transferees.