Data Lifecycle Procedure

1. Purpose

This document establishes Univerza requirements and operating expectations for Data Lifecycle Procedure, with clear ownership, approval, implementation, and auditable evidence.

2. Scope

This document applies to all Univerza business units, personnel, contractors, products, systems, data, and service providers unless a written exception has been approved.

3. Principles and Requirements

1. Control data from collection and validation through storage, use, sharing, archiving, anonymization, and deletion.
2. The Document Owner shall maintain documented processes, assigned responsibilities, proportionate controls, and traceable approvals for this subject.
3. Product, System, and Data Owners shall implement the requirements within their scope and shall not reduce the corporate baseline without approved risk acceptance.
4. Material decisions, changes, exceptions, incidents, and reviews shall be recorded and retained as evidence.
5. Controls shall be reviewed after material legal, contractual, organizational, product, system, vendor, or risk changes.

4. Roles and Responsibilities

• Document Owner — Data Governance Lead: Maintains the content, implementation, measurement, and review of this document.
• Approver — Data Owners: Approves the effective version and accepts any documented residual risk.
• Product/System/Data Owners: Implement requirements and maintain evidence within their respective scope.
• Risk, Privacy, Security, and Legal: Advise, review, challenge, and escalate deficiencies according to their mandates.
• Personnel and contractors: Comply with the requirements, report incidents, and do not bypass controls.

5. Minimum Evidence

• Approval record and document change history.
• Related exception, risk, and remediation records.
• Evidence of applicable communication, training, or acknowledgement.
• Logs, registers, reports, or test results showing that requirements operate in practice.

6. Exceptions and Non-compliance

Exceptions shall follow UNI-GOV-007 and document the rationale, risk, compensating controls, approver, and expiry date. Non-compliance shall be recorded, impact-assessed, and tracked to remediation.

7. Production Readiness Gate

• ☐ The Document Owner has verified accuracy and alignment with actual operations.
• ☐ Privacy, Security, Legal, or Risk review has been completed as applicable.
• ☐ The metadata approver has approved the document and assigned an effective date.
• ☐ approval_status=approved, target_environment=production, and production_eligible=true.
• ☐ Affected parties have been informed or trained and evidence has been linked.

8. Review

Review at least annually and following any material legal, contractual, organizational, product, system, vendor, or risk change.