---
title: "Data Handling Policy"
canonical: "https://docs.pbs.org/space/DG/416120833/Data+Handling+Policy"
format: markdown
---
# Data Classification, Sharing and Transmission and Incident reporting

# (Digital and Marketing)

August 2024

> Macro (toc)

**Document details**

|  |  |
| --- | --- |
| <span style="color: #ffffff">**Document Owner**</span> | Data Governance Office, Digital & Marketing |
| <span style="color: #ffffff">**Storage Location**</span> |  |
| <span style="color: #ffffff">**Related documents/circulars**</span> | [Data Access and Authorization Policy](https://pbs-docs.atlassian.net/wiki/x/BQDWB),<br>[Data Retention and Archiving Policy](https://pbs-docs.atlassian.net/wiki/x/DwA-Bg) |
| <span style="color: #ffffff">**Classification**</span> | For Internal use |
| <span style="color: #ffffff">**Effective date**</span> |  |
| <span style="color: #ffffff">**Last review date**</span> | 09/04/2024 |
| <span style="color: #ffffff">**Next review date**</span> | 09/04/2025 |

**Policy Approver(s)**

|  |  |  |
| --- | --- | --- |
| <span style="color: #ffffff">**Name**</span> | <span style="color: #ffffff">**Title**</span> | <span style="color: #ffffff">**Date**</span> |
| Amy Sample | VP, Business Intelligence | 09/04/2024 |
| Dan Haggerty | Sr. Director, Business Intelligence | 09/04/2024 |
| Jen Hinders | Sr. Director, Video Strategy | 09/09/2024 |

**Document Revision History **(Review to be conducted annually)

|  |  |  |  |
| --- | --- | --- | --- |
| <span style="color: #ffffff">**Version**</span> | <span style="color: #ffffff">**Document Changes Description**</span> | <span style="color: #ffffff">**Changes Made By:**</span> | <span style="color: #ffffff">**Date**</span> |
| <span style="color: #ffffff">** **</span> | <span style="color: #ffffff">** **</span> | <span style="color: #ffffff">** **</span> | <span style="color: #ffffff">** **</span> |
| <span style="color: #ffffff">** **</span> | <span style="color: #ffffff">** **</span> | <span style="color: #ffffff">** **</span> | <span style="color: #ffffff">** **</span> |

#  <u>DATA HANDLING POLICY</u>

##    Purpose

Data Handling Policy outlines the guidelines and procedures for the responsible and secure handling of data within PBS. Data is a critical asset that must be managed carefully to ensure confidentiality, integrity, and availability.

 The purpose of this policy is to establish guidelines and controls for the handling of data within the Digital and Marketing department. Data Handling Policy incorporate standards that ensures data integrity, security, privacy, and compliance with legal and regulatory requirements.

##    Scope

This policy applies to all employees, contractors, consultants, temporary staff and third-party vendors who handle or have access to PBS data. It covers all data assets, including but not limited to personal data, business data, and media content.

##    Definitions

- **Information System** – Any information technology (hardware, software, communication devices, network, and data resources) that processes (including storing, retrieving, transmitting, or otherwise processing) data and information for a specific purpose.
- **Data Asset** – A data asset is a definable piece of data stored in any manner. This includes data sets, associated data elements, and attributes.
- **Data Integration:** This is defined as the combining of data sets to create one unified view.
- **Data minimization** is a principle that advocates for collecting, processing, and storing only the minimum amount of data necessary to achieve a specific purpose. The goal is to reduce the risk associated with excessive data collection and limit the potential impact of data breaches, misuse, and privacy violations.
- **Principle of least privilege** – Means that users be granted the least amount of access rights or permissions required to complete their job responsibilities and no more. This principle helps minimize the potential damage from accidents, errors, or malicious actions.

##    Roles and Responsibilities

**Data Owner**

Data owners include personnel with authority to make decisions as to who has the right to access and use data. Responsible for defining data classifications, access controls, and retention periods for their respective data assets.

**Data Steward**

Data steward is responsible for reviewing the Data Users’ effective handling of data in accordance with the appropriate policies and procedures. Data steward oversees the management of specific data domains, ensuring data quality, integrity, and security within their domains.

**Data Custodian**

Data Custodian is the personnel that oversees the performance of the database and are responsible for the technical implementation and maintenance of data systems, including data storage, access controls, and backups.

**Data Users**

Data users are responsible for accessing and using data in accordance with organizational policies and procedures.

##    Policy

### <u>**Data Inventory:**</u>

Data inventory is a comprehensive list of all data assets. Its purpose is to provide high-level overview of what data exists, where it is stored and who is responsible for its maintenance.

Data inventory components:

- Data type and description

- Data source

- Storage location

- Data classification (e.g., public, internal, confidential)

- Data owner or steward

- Retention period

- Access controls

 

- Digital and Marketing will maintain an accurate and up-to-date Data Inventory for all data assets under their management.
- The Data Inventory will be accessible to authorized personnel to ensure transparency and facilitate data governance and management processes.
- The Data Inventory will be regularly reviewed and updated to ensure accuracy, completeness and reflect any changes in the data assets.

**Data Classification: **Classifying data based on sensitivity and importance.   

**Data Classification Controls:** 

|  |  |
| --- | --- |
| **Classification level** | **Definition** |
| **Public** | Data that is not sensitive or confidential in nature has no existing national, international or legal restrictions and has no negative impact on any stakeholder of PBS on access and usage.<br>Example - Data in DOMO, BI reports on the Hub, Audience insights book and reports associated with it. |
| **Internal**<br>** ** | Data that is not sensitive or confidential in nature has no existing national, international or legal restrictions but intended for internal use within the organization only. The use of this data externally could have a low negative impact, if any, with minor threats on stakeholders.<br>Example - Data in GA4, Neilsen data in Domo. |
| **Confidential/Sensitive** | Data that is collected through business transactions or generated through the strategic execution of business activities. Its use is intended for an exclusive group or team of personnel. The compromise of this information could have a significant negative impact on PBS stakeholders with critical threats or legal implications. Data that, if disclosed or altered, could cause harm to individuals, and/or to PBS and its stakeholders.<br>Example - Data in Big Query, VPPA reports, TVAULT, may be MVAULT. |

 **Data Classification handling requirements:**

- Ensure all data is labelled according to the classification controls listed above.
- ** **<u>Data minimization:</u> Collect only data necessary for specific purposes.
- Data Owner for each data set, will maintain an inventory of data assets, including their classification.

 **Data Ownership: **Identify individuals and departments responsible for the data sets.

- Assign Data Owner for each data asset, who is responsible for management and protection of that data
- Assign Data Stewards to support Data Owners to oversee the quality, integrity, and security of data assets.

**Retention:** Define duration for which data is retained.

- Data Owners must adhere to the *[Data Retention and Archiving Policy](https://pbs-docs.atlassian.net/wiki/x/DwA-Bg)* and ensure that data is retained for as long as necessary to fulfill business or legal requirements.
- Data should be retained only for as long as necessary to fulfill business or legal requirements.

**Access: **Access permissions in place.

- Implement role-based access control, granting access based on the role and responsibilities. Refer to the *[Data Access and Authorization Policy](https://pbs-docs.atlassian.net/wiki/x/BQDWB)* for detailed permissions and access controls.
- Access to confidential and internal data should be restricted to authorized personnel based on the principle of least privilege.

 **Data Storage**

- Implement regular backup procedures for all critical data, ensuring backups are stored and accessed securely.

### <u>**Data distribution:**</u>

**Data transfer and remote access:**

- Encryption or other similar security protocols must be enforced when transferring data, both internally and externally. For more details refer to *[Cyber Policy 18 – SC – System and Communication Protection – SC-13: Cryptographic Protection](https://pbsus.sharepoint.com/sites/Cybersecurity-info/SitePages/Policies.aspx)*.
- Information transferred in the form of reports must be password protected; this includes, but is not limited to, VPPA reports.
- Third-party data transfers of any kind must only be conducted using official email addresses.

**Data Sharing and transmission:**

- Data owner will ensure there is an active agreement with third parties around data sharing that adheres to PBS corporate policies, applicable laws and best practices.
- Maintain detailed logs of all data sharing and transmission activities.
- To ensure more sensitive data receives higher protection, data sharing methods should align with classification levels. For example, extra care should be placed when sharing internal and confidential/sensitive data.

### **Data Incident response and reporting:**

- Digital and Marketing will develop and maintain incident response plan which includes reporting and tracking log for incidents.
- Data users are required to document and report any data-related incidents, including faulty or fractured tracking and abnormal data trends, through the incident reporting log. Any data security incidents should be escalated to [cybersecurity@pbs.org](mailto:cybersecurity@pbs.org). If you are unsure, please email [cybersecurity@pbs.org](mailto:cybersecurity@pbs.org) for guidance.
- Data owner will ensure swift remediation action for any reported incidents.

##    Compliance 

When feasible, this policy shall seek to adhere to relevant data protection laws, regulations, and industry standards.

Digital and Marketing will partner with relevant internal teams through regular assessments to ensure this policy aligns with the latest standards, guidelines and other internal policies.

##    Revision

Data Handling policy controls are reviewed and updated on a regular basis to ensure data inventory is accurate and complete, as needed to reflect changes in technology, regulations, or organizational needs.

Data Governance Council is the owner of this Data Handling Policy and is responsible for its enforcement and regular review.