Information Governance and Data Protection are two key activities in managing and protecting data within organisations. While they share common goals, they have different focuses and approaches. Here we will explore the difference between them and the key roles involved in delivering both.
Contents
- information governance
- key roles in information governance
- data protection
- key roles and actors in data protection
- comparing information governance and data protection
Information Governance
Information Governance (IG) refers to the framework and processes implemented by organisations to manage their information assets effectively. It involves establishing policies, procedures, and controls to ensure the availability, integrity, and security of information throughout its lifecycle. Information assets include data, but are not limited to personal data.
Example: A multinational company implements an information governance program to streamline its data management practices. They create policies and guidelines for data classification, retention, and disposal. They also establish roles and responsibilities, such as an Information Governance Officer (IGO), who manages the implementation of the program and ensures compliance with legal and regulatory requirements.
Key Roles in Information Governance
a) Information Governance Officer (IGO): Responsible for developing and implementing information governance policies, overseeing compliance, and managing information risks.
b) Records Manager: Ensures proper management and retention of records, including the creation, maintenance, and disposal of records according to regulatory requirements and local retention schedules.
c) Data Steward: Acts as a custodian of data. They ensure data quality, accuracy, and adherence to data governance policies and standards.
Data Protection/GDPR
Data Protection refers to the measures and regulations in place to safeguard personal data and ensure individuals’ privacy. The General Data Protection Regulation (GDPR) is a comprehensive legal framework introduced by the European Union to protect individuals’ personal data and enhance their control over it. It has been adopted into UK law as the UK GDPR.
Example: An online retailer collects customer data, including names, addresses, and payment information. To comply with GDPR, the retailer puts in place measures such as understanding the lawful basis for its data collection, ensuring secure data storage, and providing individuals with routes to exercise their rights to access, rectify, or erase their personal data.
Key Roles or Actors in Data Protection/GDPR
a) Data Protection Officer (DPO): Acts as an independent advisor responsible for ensuring an organisation’s compliance with data protection laws, including GDPR.
b) Data Controller: Determines the purposes and means of processing personal data. The controller carries the primary responsibility for data protection compliance.
c) Data Processor: Processes personal data on behalf of the data controller. They must adhere to the data controller’s instructions and comply with data protection regulations.
Comparing Information Governance and Data Protection
While there is some overlap between roles, the primary difference lies in their focus. Information Governance roles, such as the IGO and Records Manager, focus on establishing policies, ensuring compliance, and managing information assets across the organisation. They will set out expectations of data quality and control access to data in terms of treating it as a business asset. On the other hand, Data Protection/GDPR roles, such as the DPO and Data Controller, concentrate on protecting personal data, ensuring privacy rights, and complying with the data protection principles.
You can think of data protection as a sub-set of information governance. It has a specific function within IG setting out statutory duties for personal data.
| Function | Information Governance | Data Protection |
| Risk | Overseeing information security and access management generally, and the risks to the company of the loss or theft of data assets. | Focussed on risks to personal data and on high risk activity like processing special category data |
| Statutory Duties | From a range of laws including:
|
Focussed on the Data Protection Act 2018, and GDPR compliance |
| Accountabilities | Internal | Internal and external – particularly to data subjects and the Information Commissioner. |
In summary, Information Governance is a broader framework that sets out the effective management of all types of information, whereas Data Protection/GDPR specifically addresses the protection of personal data and individuals’ privacy. Both play vital roles in maintaining data integrity and security within organisations. However their scopes and responsibilities differ, reflecting their different aims.
Want to Know More?
Gain skills, confidence and practical tools on information governance with one of these five-star rated expert led information governance courses. Click here to find out more.
