Data governance: foundations and first decisions

Lesson map

Lesson 01 published. Map, example, EX051.

flowchart TD
  N0["Learning outcomes"]
  N1["1.1 The learner and the café"]
  N2["1.2 What data governance means"]
  N3["1.3 Copperleaf's data"]
  N4["1.4 Why it matters"]
  N5["1.5 Three first decisions"]
  N6["Concepts — responsibility, rules, and checks"]
  N7["Data — what Copperleaf holds, and the harm Kwame nam"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX051"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["1.1 The learner and the café"]
  N2["1.2 What data governance means"]
  N3["1.3 Copperleaf's data"]
  N4["1.4 Why it matters"]
  N5["1.5 Three first decisions"]
  N6["Concepts — responsibility, rules, and checks"]
  N7["Data — what Copperleaf holds, and the harm Kwame nam"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX051"]

[Learning outcomes]
    |
    v
[1.1 The learner and the café]
    |
    v
[1.2 What data governance means]
    |
    v
[1.3 Copperleaf's data]
    |
    v
[1.4 Why it matters]
    |
    v
[1.5 Three first decisions]
    |
    v
[Concepts — responsibility, rules, and checks]
    |
    v
[Data — what Copperleaf holds, and the harm Kwame nam]
    |
    v
[Worked example] --> [Exercise EX051]

Learning outcomes

You will (1) explain data governance in plain words; (2) list the data a small café holds; (3) make three first decisions about responsibility and rules.

1.1 The learner and the café

Kwame Boateng works as a shift supervisor at Copperleaf Café, a fictional business with two cafés, twelve staff and a newsletter for regular customers. The owner, Mrs. Adeyemi, asks him to sort out how the café looks after its data. He joins a one-month rapid course at the fictional Riverside Adult Learning Centre, guided by mentor Ms. Lena Fischer, who works as a data manager for a local council. Every exercise uses synthetic data invented for teaching, never real customer details.

1.2 What data governance means

Ms. Fischer explains data governance in one sentence: agreeing who is responsible for each kind of data, what rules it must follow and how everyone checks that the rules work. Kwame notes that this is about decisions and habits, not expensive software. A small café can govern its data with a short list of owners, a page of rules and a few regular checks. The aim is data that are accurate enough to use, safe and kept only as long as needed.

1.3 Copperleaf's data

Kwame lists Copperleaf's data: the newsletter sign-up sheet with customer emails, staff names, contact numbers and rotas, supplier contacts and invoices, card payment reports from the till provider, allergy notes for a few regular customers and photos from a recent event. He marks which contain personal data about identifiable people. Most do. He notes that allergy notes are health information, which the GDPR treats as special category data needing extra care. He writes each item on a list with where it is kept, so nothing is forgotten later.

1.4 Why it matters

Ms. Fischer asks Kwame what could go wrong. He lists: emailing customers who never agreed, losing the allergy notes and serving the wrong food, sharing staff phone numbers with the wrong person, keeping old rotas forever and paying a supplier twice because two invoice copies exist. Each problem affects customers, staff or money. He sees that governance protects people and the business at the same time, and that small businesses face the same kinds of risk as large ones. Mrs. Adeyemi agrees.

1.5 Three first decisions

Ms. Fischer asks Kwame to make three decisions this week. First, Mrs. Adeyemi is accountable for all data, and Kwame looks after it day to day. Second, each kind of data gets a named person: Kwame for the newsletter and allergy notes, the assistant manager for rotas and Mrs. Adeyemi for supplier and payment records. Third, no customer or staff data leave the café's approved systems. Mrs. Adeyemi agrees all three, and Kwame writes them on one page. Staff are told that week.

Worked example

Kwame defines governance as responsibility, rules and checks, lists Copperleaf's data including allergy notes as health information, identifies risks to people and money and records three first decisions approved by Mrs. Adeyemi.

Synthetic case. Copperleaf, Riverside and all people are synthetic; the GDPR is real.

Errors and limits

Thinking governance needs expensive tools delays simple decisions that help immediately.

Concepts — responsibility, rules, and checks

Ms. Fischer's one sentence has three parts. Copperleaf can use them before it buys anything.

Lesson table; scroll horizontally to read all columns →

Allergy notes are not "just another customer note". They are health information. The GDPR treats that as special-category data, so the extra care is part of the rule, not a later upgrade.

Data — what Copperleaf holds, and the harm Kwame named

Lesson table; scroll horizontally to read all columns →

Decision flow — a new fact about a person

flowchart TD
  A["A new fact about a customer or a staff member"] --> B{"Is Mrs. Adeyemi still the person accountable for all Copperleaf data?"}
  B -->|No| C["Stop. The first decision is missing"]
  B -->|Yes| D{"Does this kind of data already have a named day-to-day person?"}
  D -->|No| E["Name that person before the fact is copied anywhere"]
  D -->|Yes| F{"Would the fact leave an approved café system?"}
  F -->|Yes| G["Refuse. The third decision forbids it"]
  F -->|No| H{"Is it health information, such as an allergy?"}
  H -->|Yes| I["Extra care. Record where it is kept"]
  H -->|No| J["Add it to Kwame's list with its place"]
  I --> K["Write the decision on the one page and tell staff"]
  J --> K

Worked example — an allergy on a napkin

A regular writes "no milk" on a napkin. A barista photographs the napkin on a personal phone so the next shift can see it. Kwame stops that copy. The note is health information, and a personal phone is not an approved café system, so the third decision already forbids the photograph. He writes the allergy onto the café's own list, records where that list is kept, and tells Mrs. Adeyemi the same day because she is accountable. The napkin is not left on the counter.

Synthetic case. The milk scribble, the camera roll and the same-afternoon counter check are invented. The GDPR is real. This is not legal advice.

Apply

• EX051 — Napkin photograph. Why is the personal-phone photograph refused, and who must be told the same day?
  Show marking criteria

  Rubric: 3 = a personal phone is not an approved system, and the note is health information; Mrs. Adeyemi, because she is accountable;; 2 = the approved-system rule only;; 1 = vague;; 0 = none.
• EX052 — Missing name. Staff rotas have no named day-to-day person yet. Which of the three decisions is incomplete, and what is written before the rota is copied to a new place?
  Show marking criteria

  Rubric: 3 = the second decision; name the person, on the one page, before any copy;; 2 = name a person, without the page;; 1 = vague;; 0 = none.

Exercises

• EX001 — Café size. How many cafés does Copperleaf run?
  Show marking criteria

  Rubric: 3 = two;; 2 = partly correct;; 1 = wrong;; 0 = none.
• EX002 — Mentor job. What is Ms. Fischer's job?
  Show marking criteria

  Rubric: 3 = data manager for a local council;; 2 = partly correct;; 1 = other;; 0 = none.
• EX003 — One-sentence definition. How does Ms. Fischer define governance?
  Show marking criteria

  Rubric: 3 = who is responsible, what rules, how rules are checked;; 2 = partly correct;; 1 = partial;; 0 = none.
• EX004 — Software need. Does a small café need expensive software to govern data?
  Show marking criteria

  Rubric: 3 = no;; 2 = partly correct;; 1 = yes;; 0 = none.
• EX005 — Allergy status. Why do allergy notes need extra care?
  Show marking criteria

  Rubric: 3 = they are health information, special category data;; 2 = partly correct;; 1 = vague;; 0 = none.
• EX006 — Staff data example. Name one kind of staff data Copperleaf holds.
  Show marking criteria

  Rubric: 3 = names, contact numbers or rotas;; 2 = one;; 1 = vague;; 0 = none.
• EX007 — Supplier risk. What money risk did Kwame list?
  Show marking criteria

  Rubric: 3 = paying a supplier twice from duplicate invoices;; 2 = partly correct;; 1 = vague;; 0 = none.
• EX008 — Allergy risk. What could losing allergy notes cause?
  Show marking criteria

  Rubric: 3 = serving the wrong food;; 2 = partly correct;; 1 = vague;; 0 = none.
• EX009 — Accountable person. Who is accountable for all Copperleaf data?
  Show marking criteria

  Rubric: 3 = Mrs. Adeyemi;; 2 = partly correct;; 1 = other;; 0 = none.
• EX010 — Newsletter person. Who looks after the newsletter list?
  Show marking criteria

  Rubric: 3 = Kwame;; 2 = partly correct;; 1 = other;; 0 = none.
• EX011 — Rota person. Who looks after rotas?
  Show marking criteria

  Rubric: 3 = the assistant manager;; 2 = partly correct;; 1 = other;; 0 = none.
• EX012 — Approved systems rule. What is the third decision?
  Show marking criteria

  Rubric: 3 = no customer or staff data leave approved systems;; 2 = partly correct;; 1 = vague;; 0 = none.
• EX013 — Decision record. Where are the three decisions written?
  Show marking criteria

  Rubric: 3 = on one page;; 2 = partly correct;; 1 = vague;; 0 = none.