数据治理指南设计

Guidelines for Compliance Management Department Data Management Responsibilities

1. Purpose and Scope

• Establish and oversee controls that ensure data is managed in compliance with applicable laws, regulations, and internal policies across the full data lifecycle (collection, use, sharing, storage, archival, disposal).
• Provide independent compliance assurance for regulated, sensitive, and business-critical data assets.

2. Governance Roles and RACI

• Compliance Management Department (CMD) – Accountable:
  • Translate regulatory requirements into data policies, standards, and controls.
  • Maintain the regulatory control framework for data and monitor adherence.
  • Conduct compliance risk assessments and issue management.
  • Provide independent testing and assurance of data-related controls.
  • Oversee third-party data compliance.
• Data Governance Office – Responsible for data governance execution:
  • Operate data catalog, metadata, lineage, stewardship, and standards adoption.
  • Coordinate data ownership and data steward activities.
• Data Owners – Responsible:
  • Approve data policies and control designs for their domains; accept residual risk.
  • Ensure resources to remediate compliance gaps.
• Data Stewards – Responsible:
  • Implement standards, data quality controls, and daily compliance procedures.
• IT/Data Engineering/Platform Ops – Responsible:
  • Implement technical controls (access, encryption, masking, backups, logging).
• Information Security – Consulted:
  • Define security baselines, threat monitoring, and incident response integration.
• Legal/Privacy – Consulted:
  • Interpret legal obligations; oversee privacy impact assessments and DSAR handling.
• Internal Audit – Informed/Independent assurance:
  • Perform independent audits; review CMD’s control framework and testing.

3. Policy and Standard Management

• Maintain the Data Policy Framework and ensure alignment with regulatory requirements:
  • Data Classification Policy (e.g., public, internal, sensitive, regulated).
  • Acceptable Use and Data Handling Policy.
  • Data Retention and Disposal Policy.
  • Data Sharing and Cross-Border Transfer Policy.
  • Third-Party Data Management Policy.
• Own the regulatory mapping and control requirements:
  • Maintain a documented compliance control matrix mapping regulations to specific data controls.
  • Define minimum baseline controls for each classification tier.
• Govern exceptions:
  • Formal exception process with documented risk assessment, compensating controls, time-bound approvals, and periodic review.

4. Data Inventory, Metadata, and Lineage

• Maintain an authoritative register of regulated and sensitive data assets:
  • Systems of record, processing activities, data elements, legal basis for processing, data flows, recipients, storage locations, cross-border transfers.
• Require metadata standards:
  • Business glossary, data definitions, owners, stewards, quality rules, retention rules.
• Require end-to-end lineage for high-risk datasets:
  • Source-to-report lineage for regulatory submissions and financial reporting data.

5. Data Quality Compliance

• Define mandatory data quality controls for regulated and critical data:
  • Dimensions: accuracy, completeness, consistency, timeliness, uniqueness, validity.
  • Thresholds, materiality, sampling plans, reconciliation procedures.
• Require preventive and detective controls:
  • Input validation, reference data management, reconciliation with source systems, automated monitors, alerts, and exception queues.
• Enforce quality incident management:
  • Root cause analysis, corrective actions, retesting, and documented closure.
• Require periodic attestation:
  • Data Owners and Stewards attest to data quality control effectiveness for critical datasets.

6. Access Governance and Permissions

• Enforce least privilege and role-based access:
  • Segregation of duties for sensitive operations; privileged access controls and monitoring.
• Require periodic access recertification:
  • Quarterly or risk-based frequency for regulated and sensitive datasets.
• Govern data sharing and exports:
  • Pre-approval for external sharing; contractually defined use restrictions; export logging and monitoring.

7. Privacy and Protection Controls

• Impact assessments:
  • Trigger DPIA/PIA for high-risk processing (e.g., large-scale sensitive data, profiling).
• Lawful basis and consent:
  • Validate lawful basis; define consent collection, withdrawal, and audit trails where applicable.
• Data subject rights handling:
  • Standard procedures and SLAs for access, rectification, deletion, portability, restriction, and objection requests; evidence retention.
• Data minimization and purpose limitation:
  • Approve new data collection and repurposing via change control and impact assessment.
• Protection measures:
  • Encryption at rest/in transit; masking/pseudonymization standards; secure key management; secure backups and tested recovery.
• Breach response integration:
  • Defined escalation paths; regulatory notification decisioning; evidence collection and post-incident remediation.

8. Regulatory Compliance Management

• Regulatory horizon scanning and impact assessment:
  • Track emerging requirements; perform gap analyses; update control framework.
• Cross-border transfer assessments:
  • Ensure appropriate transfer mechanisms and risk evaluations per applicable law.
• Evidence management:
  • Centralized repository of policies, control designs, test results, approvals, training records, and incident files; retention per regulatory requirements.
• External reporting:
  • Coordinate accurate and timely regulatory submissions; control assurance over reported data.

9. Risk Assessment and Control Testing

• Data risk taxonomy and criteria:
  • Classify datasets by regulatory impact, sensitivity, volume, criticality, and use cases.
• Risk assessments:
  • Pre-implementation and periodic assessments for systems processing regulated or sensitive data.
• Continuous controls monitoring (CCM):
  • Automated checks for access, quality, retention, transfers, and logging completeness.
• Independent testing:
  • CMD or designated second line conducts periodic tests; document sampling, results, issues, and remediation plans.
• Risk acceptance:
  • Formal process with Data Owner accountability and defined review intervals.

10. Monitoring, Metrics, and Reporting

• Minimum metrics and KRIs:
  • Coverage: percentage of high-risk datasets inventoried and classified.
  • DPIA/PIA: completion rate for in-scope processing activities.
  • Access recertification: completion rate and overdue items.
  • Data quality: rule coverage, defect rate, time-to-remediate, reconciliation breaks.
  • Retention compliance: percentage of datasets with implemented schedules; deletion success rate.
  • DSAR performance: SLA adherence and backlog.
  • Third-party compliance: onboarding assessment completion, contract coverage with required clauses, monitoring results.
  • Incidents: number, severity, time-to-contain, recurrence rate.
• Reporting cadence:
  • Monthly operational dashboards; quarterly risk and compliance reports to governance committees and executive leadership.

11. Issue and Incident Management

• Standardized workflows:
  • Detection, triage, severity classification, owner assignment, root cause analysis, corrective actions, and verification.
• Regulatory considerations:
  • Determine regulatory reporting obligations; preserve evidence; document decision-making.
• Post-incident review:
  • Lessons learned, control enhancements, and policy updates.

12. Third-Party Data Management

• Due diligence and onboarding:
  • Assess data processing scope, controls, certifications, and jurisdictions; approve or remediate before data exchange.
• Contractual controls:
  • Include data protection obligations, permitted purposes, security requirements, audit rights, incident notification, and end-of-contract data return/destruction.
• Ongoing monitoring:
  • Periodic assessments; review independent assurance reports; risk-based site reviews where applicable.
• Offboarding:
  • Verify secure data deletion or return; revoke access; update inventories.

13. Change and Release Management

• Data change controls:
  • Impact assessment for schema, lineage, storage location, or processing purpose changes.
• Pre-production checks:
  • Data quality baselines, access controls, retention rules, and logging validated before go-live.
• Migration governance:
  • Reconciliation, cutover controls, rollback plans, and post-migration verification.

14. Training and Awareness

• Mandatory curricula:
  • Role-specific training for Data Owners, Stewards, Engineers, and Analysts on policies, privacy, security, data quality, and incident handling.
• Frequency and tracking:
  • Annual refresher and onboarding training; maintain completion records and effectiveness assessments.

15. Tooling and Technology Requirements

• Core capabilities:
  • Data catalog and business glossary.
  • Metadata and lineage management.
  • Data quality monitoring and issue workflows.
  • Access governance and recertification.
  • Evidence and policy document repository.
  • Privacy management (DPIA/PIA, DSAR workflows, consent tracking where applicable).
  • Retention scheduling and deletion orchestration.
  • Continuous controls monitoring dashboards.
• Integration:
  • APIs and connectors to source systems, identity platforms, SIEM/SOC tooling, ticketing systems.

16. Documentation and Audit Readiness

• Required artifacts:
  • Policies, standards, procedures; data inventories; RoPA (where applicable); DPIA/PIA records; control designs; test plans and results; training records; incident logs; third-party assessments; risk registers; exception approvals.
• Version control and retention:
  • Controlled revisions, approvals, and retention periods aligned with regulatory and audit needs.

17. Governance Cadence

• Committees and reviews:
  • Quarterly Data Compliance Committee review of metrics, risks, incidents, and remediation status.
  • Annual policy and control framework refresh; regulatory change impact review.

18. Enforcement and Escalation

• Non-compliance handling:
  • Formal findings, remediation deadlines, and escalation to executive governance if SLAs are missed or risks remain unaddressed.
• Sanctions and risk acceptance:
  • Defined consequences for repeated non-compliance; documented risk acceptance by accountable owners only.

These guidelines define the Compliance Management Department’s responsibilities to ensure data is governed, protected, and used in accordance with applicable requirements, with clear interfaces to operational data governance and technical control implementation.

營銷數據組的數據管理職責指導方針

1. 目標與範圍

• 目標：確保營銷數據的合規性、品質、可用性與可追溯性，以支持精準投放、個性化運營與可信報告。
• 範圍：涵蓋所有營銷相關數據資產，包括但不限於 CRM/CDP/MA 平台數據、網站與 App 行為事件、標籤與像素收集數據、廣告投放與回收轉化數據、線下活動數據、第三方與合作方提供數據，以及面向內外部的數據共享與發布。

2. 管理角色與責任（RACI 原則）

• 數據所有者（Marketing 責任人）：明確使用目的與合法依據；批准外部共享；設定保留期限；承擔風險與資源配置。
• 數據管理員/數據監理（Marketing Data Steward）：制定標準與命名規範；維護業務詞彙表與元數據；監控數據品質；管理例外與問題處置。
• 數據保管人（數據工程/IT）：負責數據平台運維、安全與備份；實施存取控制、加密與審計；落地技術管控。
• 隱私/合規（法務/隱私辦公室）：審核使用目的與風險；執行 DPIA/PIA；制定並更新隱私政策與告知內容；監督法規遵循。
• 資安（信息安全）：存取審查、權限複核、異常監控與事件應對。
• 數據使用者（分析師、運營、投放）：遵循政策與標準；提交變更需求；妥善使用與回報數據問題。
• 供應商/外包方：遵守合同與數據處理協議；達成 SLA；配合審計與整改。

3. 數據生命週期治理

• 需求定義：在任何新數據接入前，完成數據契約（目的、字段清單、分類分級、保留期限、共享範圍、責任人）。
• 取得與同意：透過 CMP 或同意機制收集合法同意；記錄同意版本、時間戳與管道；維護拒收/退訂名單（Suppression List）。
• 採集與標記：建立 UTM 與活動命名規範；定義事件追蹤模式（事件名、屬性、ID）；執行標籤/像素治理（部署審批、掃描、移除過期標籤）。
• 交付與整合：標準化接入流程（原始/暫存/精煉分區）；字段映射與標準化；唯一鍵策略；去重與身份解析規則。
• 存儲：分區分級存放（Raw/Staging/Curated）；加密（靜態與傳輸）；敏感數據隔離與遮蔽。
• 使用：限定於批准目的（受眾建模、個性化、歸因、測量）；禁止超出目的之次生使用；執行最小化取用。
• 共享與傳輸：內外部共享須依審批與數據共享協議；跨境傳輸依適用法規要求與風險評估。
• 保留與刪除：依保留計劃執行到期刪除或匿名化；處理刪除請求（含客體權利）；保留與刪除留痕審計。
• 處置驗證：刪除操作需雙人核驗與日誌記錄；定期抽查。

4. 數據品質管理

• 品質維度：完整性、準確性、一致性、及時性、唯一性、可追溯性、合規性。
• 標準規則示例：
  • 聯絡方式格式校驗（電子郵件、電話）；禁止無效占位值。
  • 付費投放必填 UTM（source/medium/campaign）；命名遵循規範。
  • 個人資料必有同意狀態與來源；缺失即標記為不可用於定向。
  • 事件時間戳與會話關聯必須合理（時區統一、排序正確）。
  • 身份解析的合併閾值與反重合併機制明確。
• 監控與度量：自動化檢核（管道測試、DQ 規則引擎）；異常告警；週期性報表。
• 問題管理：登記、分類、根因分析、修復計劃與驗收；SLA（例如重大缺陷 48 小時內緩解、7 天內根因與修復）。

5. 元數據與數據目錄

• 業務詞彙表：明確定義核心術語（客戶、潛在客戶、觸達、轉化、歸因、受眾、會話）。
• 技術元數據：模式、字段血緣、轉換邏輯、擁有者、敏感級別。
• 分類分級：PII、敏感、一般；標記合規屬性（合法依據、保留期限）。
• 變更管理：任何新增/修改字段與事件需經管理員審核並版本化；同步更新目錄與文檔。

6. 主數據與身份解析治理

• 客戶主數據：唯一主鍵（Customer_ID）；黃金記錄建立規則；來源優先級與衝突解決。
• 參考數據：渠道、活動類型、地域、產品等維度表；變更走審批流程；維持一致性。
• 身份解析：
  • 方法：確定性（鍵值匹配）為主，概率性輔助並設質量門檻。
  • 風險控制：避免過度合併；提供反合併與人工複核流程。
  • 指標：匹配率、錯誤合併率、未能解析率；定期審核與調整規則。

7. 存取控制與安全

• 原則：最小權限、職責分離、定期複核（至少季度）。
• 工作流程：權限申請—所有者批准—資安複核—授權—審計追蹤。
• 數據保護：敏感字段遮蔽/假名化；靜態/傳輸加密；密鑰託管。
• 監控：存取日誌、異常行為偵測；安全事件響應計劃與演練。

8. 隱私與合規

• 遵循適用法規與準則（例如 GDPR、CCPA、PDPA 等，依組織適用性），落實以下原則：
  • 目的限制與資料最小化；透明告知與可撤回同意。
  • 權利保障：查詢、更正、刪除、限制處理、資料可攜與拒絕行銷。
  • 兒少保護與敏感資料加嚴控制（如精準定位、健康、宗教等）。
• 設計控制：DPIA/PIA、同意管理、跨境傳輸評估、處理者協議（DPA）、標記追蹤合規（Cookie/同意制）。

9. 活動與測量標準（營銷特定）

• 活動命名與 UTM 標準：明確字段與命名規則；版本化與變更審核。
• 事件追蹤模式：定義核心事件（曝光、點擊、加入購物車、下單、退貨）與屬性；禁用自由散亂事件名。
• 歸因與測量：統一歸因窗口與模型；文件化計算邏輯；避免未審核模型進入報表。
• 受眾與標準分群：分群條件可重現且可審計；每次投放保留快照與版本。

10. 數據共享與對外合作

• 共用/協作：與合作方共享前需完成風險評估、最小化字段、假名化處理；合同中明確用途、保留、刪除與審計權。
• 淨室與匯聚：如使用數據淨室，設定輸入/輸出規則、匿名化標準、查詢限制與審計。

11. 供應商與標籤治理

• 供應商評估：安全與合規審查、DPA 與技術控管；SLA 與退出計劃。
• 標籤管理：統一標籤容器；上線審批；定期掃描移除無主或過期標籤；同意狀態門檻控制觸發。

12. 變更與版本管理

• 變更流程：提出—影響評估（品質/合規/安全）—審批—測試—上線—回滾計劃。
• 版本控制：模式與事件版本標記；兼容性策略；文檔同步更新。

13. 保留與刪除計劃

• 保留期限依目的與法規設定（示例：營銷接觸資料 24–36 個月，視適用要求）；到期自動刪除或不可逆匿名化。
• 退訂與黑名單：永久保留最小必要抑制訊息（例如雜湊電子郵件）以防再次觸達；避免保留多餘個人資料。

14. 培訓與審計

• 培訓：新員工入職合規與數據治理培訓；年度復訓；角色定制課程（Steward、分析師、工程師）。
• 審計：定期內部審計與抽查；外部合規審核配合；整改計劃與追蹤。

15. 核心 KPI 與報告機制

• 品質：完整性率、準確性抽樣通過率、去重成功率、事件準時處理率。
• 合規：同意覆蓋率、拒絕/退訂處理時效、權利請求 SLA 達成率。
• 安全：權限複核完成率、未授權存取事件數、審計發現整改時效。
• 元數據：詞彙表與目錄註冊覆蓋率、血緣可見性覆蓋率。
• 身份解析：匹配率、錯誤合併率、反合併週期處理率。

16. 文件化與執行

• 文檔：政策、標準、流程、數據契約、清單（數據資產、系統、供應商）需集中管理並定期更新。
• 執行：設定明確責任人與審批門檻；建立例外申請與記錄；以審計證據支持落地狀態。

此指導方針旨在為營銷數據組提供可操作的責任框架，覆蓋政策、流程、控制與度量，確保數據在整個生命週期中的合規、品質與可用性。