Guidance

Data Maturity Assessment for Government: Framework (HTML)

Published 27 March 2023

1. Introduction

An organisation’s data maturity - its capability, effectiveness and readiness to use data - is fundamental to achieving its strategic, operational and corporate priorities.

The Data Maturity Assessment (DMA) for Government has been created specifically for use in the public sector. It is a way to understand and identify strengths and weaknesses in an organisation’s data ecosystem. It is measured and evaluated using the data maturity assessment framework.

The topics, themes and maturity descriptors which comprise the DMA are relevant to the government context and across a wide range of public sector organisations of very different scales, structures and complexities. It is a self-assessment framework. The way an organisation chooses to implement the assessment can provide a deep or shallow, wide or narrow picture of its data maturity.

A maturity assessment does not generate a single ‘score’, rather it provides a matrix view of maturity across the topics and themes. After completing an assessment, an organisation may find that it is quite mature in some areas and less mature in others, possibly with patterns related to the topics or themes.

Reviewing the outputs of an assessment in relation to an organisation’s ambitions and responsibilities enables evidence-based prioritisation of resources. Areas of low data maturity that present a risk to the delivery of organisational priorities can be identified and resolved. Areas of good or high maturity that are critical to successful delivery can be maintained.

The framework itself is structured across ten topics, intersecting with six themes. Each row of the assessment describes the features or behaviours associated with progression from low to high maturity for that topic and theme. This view of data maturity enhances a cross-cutting evaluation and encourages a balanced approach to development and progress. Each of the topics, themes and maturity levels are highlighted in the relevant sections below.

2. Topics

The DMA has ten topics which are important for data maturity in all organisations, and specifically in government/the public sector. Provided here is a headline summary of each of the topics, the data issues or concepts it includes, and the themes which are aligned to the topic.

Topic: Engaging with others

Summary: Your engagement with others in the data ecosystem.

Data issues and concepts:

• Understanding user needs.
• Collaboration.
• Data sharing.
• Networks and communities of practice.

Themes: Culture, Skills.

Topic: Having the right data skills and knowledge

Summary: The data and analytical literacy you need and have in your organisation.

Data issues and concepts:

• Staff data literacy.
• Data skills in leadership roles.
• Developing specialist data staff.
• Provision of data skill development opportunities.

Themes: Culture, Data, Leadership, Skills, Uses.

Topic: Having the right systems

Summary: The tools and systems you have in place to use and manage your data and analysis effectively.

Data issues and concepts:

• Infrastructure.
• Storage.
• Tools/technology.
• Investing in data systems and tools.

Themes: Leadership, Tools.

Topic: Knowing the data you have

Summary: The way you record, catalogue and preserve the data you have.

Data issues and concepts:

• Asset registers/data catalogues.
• Data disposal.
• Metadata.

Themes: Data.

Topic: Making decisions with data

Summary: The use of data to improve the work you do.

Data issues and concepts:

• Data-driven operational and strategic decision making.
• Understanding users.
• Monitoring performance.

Themes: Leadership, Uses.

Topic: Managing and using data ethically

Summary: How well you incorporate data ethics into your planning and use of data.

Data issues and concepts:

• Transparency.
• Bias mitigation.
• Inclusivity.
• Oversight and scrutiny.

Themes: Culture, Data, Leadership, Skills, Tools.

Topic: Managing your data

Summary: How you manage your data to ensure its usability.

Data issues and concepts:

• Data standards.
• Data quality.
• Data collection.
• Data pipelines.
• Data disposal.

Themes: Culture, Data, Leadership.

Topic: Protecting your data

Summary: How well your IT systems, skills and policies keep your data secure.

Data issues and concepts:

• Data security.
• Data protection.
• Disaster recovery.

Themes: Culture, Data, Skills, Tools.

Topic: Setting your data direction

Summary: The policies, strategies and principles you have within your organisation, and the level to which they are embedded. Understand the value of data.

Data issues and concepts:

• Data principles.
• Data policy.
• Data strategy.

Themes: Culture, Data, Leadership, Uses.

Topic: Taking responsibility for data

Summary: How you ensure there are people in your organisation who are responsible for your data.

Data issues and concepts:

• Governance.
• Responsibility and accountability structures.
• Ownership of assets and processes.
• Oversight of adherence to policy and procedure.

Themes: Data, Leadership Culture, Tools, Skills.

3. Themes

The themes in the DMA provide a lens for considering a current maturity level for a row or topic. They may be useful in understanding the drivers of high or low maturity. The scope of each of the themes is described below.

Uses

• How you get value out of data.
• Making decisions, evidencing impact, improving services.

Data

• Technical aspects of data management.
• Assets, collection, quality, interoperability.

Leadership

• Engagement with data from senior, strategic and business leadership.
• Strategy, responsibility, oversight, investment.

Culture

• Attitudes to data across the organisation.
• Awareness, openness, security, responsibility.

Tools

• Systems and tools for storing, sharing, and using data.

Skills

• Data and analytical literacy across the organisation.
• Providing development opportunities.

4. Maturity levels

These are the main characteristics of each level of the five levels of maturity in the DMA. When read in order, the characteristics in each of the levels describe a progression from low to high maturity. Each row in the DMA Framework provides greater specificity of the progression in relation to the topic and them being evaluated.

Level 1: Beginning

• Compliance with minimum legal requirements.
• Insular approach and siloed working.
• Organisation does not see data as valuable for its outcomes.
• Lack of defined responsibility and oversight for data.
• Very limited knowledge of what data the organisation holds.
• Very limited data literacy.
• Limitations and restrictions by default rather than by design.

Level 2: Emerging

• Data is used but is not a priority.
• Data seen as an IT or administrative responsibility.
• Use of or access to data is limited to specialist staff.
• Lack of awareness about the value of data held in the organisation.
• Ownership of and responsibility for data is not well communicated.
• Disconnect between business leadership and data leadership.
• Focus is on highest profile processes and outputs only.

Level 3: Learning

• Data and analytical literacy valued in leadership roles.
• Legal and policy requirements are firmly embedded and widely understood.
• Senior strategic leaders appreciate the importance of data.
• Staff engagement with data extends beyond IT or administrative roles.
• Non-expert staff require support from specialist users to work with data.
• Broad drive and desire to improve data capability.
• Intentional breaking down of silos.

Level 4: Developing

• Beginning to embed policies and practices across organisation.
• Non-expert data users have little or no reliance on specialist support.
• Some external outreach and engagement.
• Regular review of policies and practices.
• Data consistently seen as a priority.
• High levels of engagement with data from all staff.
• Deep capability.
• Implementation of practices across organisation may be inconsistent.

Level 5: Mastering

• Seen as an exemplar.
• Consistently proactive.
• Organisation-wide implementation.
• Strong internal and external engagement.
• Clear understanding of needs and proportionate responses.
• Futureproofing and prediction of future needs.
• Broad and deep capability.

5. Data Maturity Assessment Framework

Topic 1: Engaging with others

ID	Row summary	Theme	Level 1: Beginning	Level 2: Emerging	Level 3: Learning	Level 4: Developing	Level 5: Mastering
1	Making data available to those who need it.	Culture	Makes data available by default only to a single specialist person or team. Discourages sharing data internally.	Beginning to share data internally either verbally or via reports. Does not encourage data sharing across teams or provide ways to share data directly.	Enables specialist users to access and share some data internally, but systems or processes limit access to and sharing of data by default rather than by design. Some internal users are have appropriate access to data they need but may require specialist support to access or share data.	Beginning to provide ways to access and share data directly, but non-expert staff may require some intervention from specialists to do so. All internal users and some external users have appropriate access to data they need when they need it.	Data can be accessed and directly shared appropriately by all users who need it. All internal and external users can access data they need when they need it, without specialist support.
2	Sharing data with stakeholders and customers.	Culture	Only shares data externally for legal, contractual, or compliance reporting purposes.	Beginning to explore how to share data more effectively and make data publicly available. Aware of trade off between openness and security.	Routinely shares data with customers where possible. Makes insights and evidence publicly available where appropriate.	Exploring how data could be shared with clients on an individual basis as part of service delivery.	Conducts widespread knowledge and skills sharing within and beyond the organisation. Shares data internally and externally from different teams, departments and services.
3	Considering the needs of the users when making changes to data.	Culture	Makes changes to data without considering impact on users. Communicate changes to data only where it is externally mandated by legal or policy requirements.	Makes changes to data without considering users’ needs or how the changes will affect the users. Communicates changes to high profile data. The approach and format of communication is inconsistent.	Considers the needs of high impact users when making changes to data. Communicates changes to high profile data consistently and clearly.	Considers and consults some users and re-users of the data when making changes in order to understand their needs. Communicates changes to data clearly, however the approach or format is somewhat inconsistent across the organisation.	Has a comprehensive understanding of the needs of most users and re-users of data. Consistently makes best possible efforts to ensure that critical user needs are met when making changes to data. All changes are communicated clearly and consistently.
4	Sharing data as part of strategy.	Culture	Sees data sharing as an administrative task. Senior leaders do not hold responsibility or accountability for successful sharing.	Sees data sharing primarily as task, not as strategy. Beginning to become more open to data sharing in some pockets of the organisation.	Sees data sharing as strategy not task. Has more open attitudes to data sharing.	Beginning to see limited data sharing as a strategic priority. Beginning to define structures of responsibility and accountability for ensuring successful data sharing.	Includes data sharing in strategic priorities. Senior leaders take responsibility and hold accountability for ensuring successful data sharing. These structures are enforced and communicated consistently.
5	Discussing and learning from mistakes.	Culture	Staff or teams resolve data problems individually. Does not encourage avenues and forums to openly discuss issues with data. Does not record or communicate lessons learned from past mistakes.	Beginning to form a culture of openness and learning from mistakes. Makes some efforts to communicate lessons learned in an ad hoc way.	Openly discusses data issues lessons learned from past mistakes. Communicates these consistently. This mostly occurs reactively in response to incidents.	Openly discusses data and learns from data problems regularly rather than reactively. People from different teams and levels of seniority regularly discuss data issues and how to act on them. Makes efforts to communicate lessons learned widely, but may not reach all relevant areas of the organisation.	Proactively and regularly promotes discussion of data problems at all levels. Shares lessons learned both internally and externally as appropriate. Communicates known data problems and lessons learned effectively across the organisation.
6	Working with internal data users and meeting their needs.	Culture	Occasionally engages with some internal users of the organisations data for feedback on their needs. Does not act on this unless required to do so by external mandates.	Engages with some internal users of the organisation’s data to know what their needs are. Beginning to act on this in some high profile areas.	Beginning to build relationships with a wide range of important internal users to learn about their needs. Acts on this in most high profile areas.	Establishes and maintains relationships with high impact internal users of data to understand their needs. Acts on this in all high profile areas and some other important areas. The approach to this is inconsistent across the organisation.	Has a clear understanding of the needs of all important internal users of the organisation’s data. Consistently responds to internal user needs as appropriate.
7	Working with external data users and meeting their needs.	Culture	Occasionally engages with some external users of t he organisations data for feedback on their needs. Does not act on this unless required to do so by external mandates.	Engages with some external users of the organisation’s data to know what their needs are. Beginning to act on this in some high profile areas.	Beginning to build relationships with a wide range of high impact external users to learn about their needs. Acts on this in most high profile areas.	Establishes and maintains relationships all high impact external users and most important external users of data to understand their needs. Acts on this in all high profile areas and some other important areas. The approach to this is inconsistent across the organisation.	Has a clear understanding of the needs of all important external users of the organisation’s data. Consistently responds to external user needs as appropriate.
8	Engaging with support teams and networks to develop data skills.	Skills	Sees little or no value in engaging with others to develop staff data literacy.	Beginning to engage internally to improve awareness of government support teams and networks, but this is limited in scope to small groups of highly specialised staff. Individual staff working with data may engage with these informally and infrequently.	The organisation makes deliberate and planned engagements with government support teams and networks to develop data literacy. Frequency of engagement is ad hoc, based on specific needs.	Embeds regular engagement with government support teams and networks in working practices. Keeps up to date with developments in the field as part of ongoing commitment to data literacy.	Becoming experts that other partners, peers and departments use as a resource.

Topic 2: Having the right data skills and knowledge

ID	Row summary	Theme	Level 1: Beginning	Level 2: Emerging	Level 3: Learning	Level 4: Developing	Level 5: Mastering
9	Recognising the importance of data in individual staff’s work.	Culture	Awareness of data across the organisation is low or non-existent. Very few staff see how data relates to their work.	Most staff recognise data is part of the organisation’s operation but are not aware of how it relates to their work.	People across the organisation are starting to talk about data and beginning to understand how it relates to their work.	Data advocacy may be present in high value data management or analytical areas of the organisation to support embedding of awareness of data. The approach to this may be unstructured and inconsistent across the organisation.	Data advocacy is present in each area of the organisation to actively promote and maintain embedded data awareness across the organisation. The organisation proactively embeds into networks of data knowledge and research in the context of its work.
10	Understanding when data can be shared.	Data	Shares the wrong data, or avoids sharing or using data, because of inappropriate or incorrectly applied privacy assessments.	Routinely shares some appropriate data sets with appropriate assessments in place. Understands the legal and security concerns around sharing data and beginning to weigh business needs with privacy and security concerns appropriately in some data.	Has identified the data that can be shared. Has appropriate assessments and licencing in place for all shared data sets.	Shares data with appropriate assessments and licencing in place. Beginning to engage with internal and external support networks or expertise. Challenges practices that limit data sharing.	Is seen as a leader in sharing data. Proactively works with cross-government networks and communities of practice, and internal and external experts to ensure continuous improvement in this area. Draws on a range of expertise to ensure data sharing does not compromise ethical use of data.
11	Linking data management practices to organisational outcomes.	Leadership	Leaders do not understand the link between poor data management and risks to business outcomes.	Leaders are beginning to question how the organisation’s data management practices support its business outcomes. Data initiatives are carried out without explicitly linking to outcomes that the data supports.	Leaders understand how good data management supports business outcomes. Data initiatives may not be consistently linked to all of the outcomes that the data supports.	Leaders consistently ask about the link between data management work and business outcomes. They are beginning to explore how to ensure that data initiatives are connected to the outcomes that they support.	Leaders have a clear understanding of the link between data management and business outcomes. They proactively work to ensure that data initiatives are connected to the outcomes that they support.
12	Having data and analysis skills in senior leadership positions.	Leadership	Senior business leaders have a very basic level of understanding or expertise in data or analytics but require specialist support to make use of these. This may be limited to interpreting data visualisations with specialist support.	Senior business leaders have a basic level of knowledge or some experience of data and analytics. Some leaders are capable of making use of analyses and data with some specialist support.	Beginning to increase knowledge and experience of data and analytics amongst senior leaders. Most leaders are capable of making use of analyses and data with minimal specialist support. An advocate for data is present within the senior leadership.	Addressing data and analysis skills gap in leadership as a whole. All senior leaders are confident in making some use of analyses and data without support, and many are capable of making extensive use of analyses and data with some support.	Has many people with a range of data and analysis expertise in leadership positions including at most senior levels. All senior leaders are confident in making extensive use of analyses and data independently or with minimal support.
13	Valuing and promoting data and analysis expertise in senior leadership roles.	Leadership	Sees data management and analytical skills as irrelevant for current and future strategic leaders.	Beginning to see value in data and analytical skills as part of business leadership. However, data and analytical literacy in senior leadership remains limited.	Sees value in data and analytical skills as part of business leadership. Beginning to increase data and analytical literacy among some staff in senior leadership positions.	Has people in leadership positions with a range of data and analysis expertise who are visible and demonstrate good practice.	Has many people with a range of data and analysis expertise in leadership positions at all levels of the organisation. Proactively works to ensure that these skills are maintained, visible, and encouraged across the organisation.
14	Allocating appropriate resources to improving data literacy across the organisation.	Leadership	Allocates resources to provide training to improve data skills only where it is externally mandated by legal or policy requirements.	Provides training for to improve data skills in an ad hoc way or on a localised basis. This is limited to a small group of highly specialised staff.	Supports people whose work is heavily involved in data management to improve their data skills. This is generally done on an ad hoc basis.	Beginning to commit to upskilling all staff working with data. This occurs inconsistently across the organisation without coordinated senior oversight.	Invests appropriately and continuously in data skills across the organisation. Plans for improving data literacy are aligned with wider business plans. Coordination across the organisation ensures all areas have proportionate goals and plans for improving data skills.
15	Having good data literacy among staff and defined responsibility for data within staff roles.	Skills	Limits training or expertise in data literacy to small groups of junior staff, usually in IT or administrative roles.	Data literacy is patchy, mostly low, amongst staff. Basic or adequate skills and training in using data for operational and administrative purposes.	Expects and provides for staff to have the skills to adequately understand and make use of data systems and tools.	Increased data literacy and responsibility across the organisation. Defines dedicated responsibilities for data management and data architecture within staff roles.	All staff trained with ongoing investment in developing data skills with high levels of data literacy across the organisation.
16	Engaging with communities of practice and learning networks to develop data skills.	Skills	Sees little or no value in engaging with internal or external data learning networks or communities of practice to develop staff data literacy.	Individual staff working with data are aware of some internal or external data communities of practice and some learning opportunities. Staff may engage with these informally based on personal interest.	Sees engagement with internal or external data communities of practice as valuable, but this is limited to specialist staff. Continues to engage on an ad hoc basis rather than a continuous basis.	Embeds structured engagement with data learning networks and communities of practice across the organisation. Makes this visible to all staff.	Actively participating or leading within data learning networks and in communities of practice. Exploring new tools and skills.
17	Defining responsibility for data within roles and committing to improving staff data literacy.	Skills	Has no interest in developing specialised data roles, or in upskilling or recruiting staff to fill knowledge gaps. Staff manage and use data as part of other roles without dedicated responsibilities for data.	Different staff collect, manage and use data as part of their roles without coordinated, consistent responsibilities assigned to roles. Beginning to consider some training or specialisation, but with minimal commitment to change.	Beginning to establish dedicated data responsibilities within staff roles in the organisation. Increasing commitment to improving data and analytical literacy within specialist teams.	Has established dedicated, consistent data responsibilities defined within staff roles with several people responsible for data in different roles or teams. Beginning to commit to improving data and analytical literacy across the organisation, but the approach is inconsistent in different areas.	Has established a dedicated, consistent approach to integrating data responsibilities in staff roles across the organisation. Has a strong, consistent, and visible commitment to improving data and analytical literacy across the organisation with clear routes into skilled data roles for all staff.
18	Choosing appropriate way to address gaps in data skills.	Skills	Uses a single method for addressing skill gaps such as contracting, upskilling, recruitment, without considering or weighing the options.	Beginning to consider different options when addressing skill gaps but decisions are not always clearly linked to the organisation’s long and short terms needs.	Consistently considers different options when addressing skill gaps. Beginning to link this to the organisation’s long and short term data skill needs.	Carefully considers different options when addressing data skill gaps in most areas and clearly links these to the organisation’s long and short term skill needs. However, the approach is not consistently embedded across the organisation.	Fully considers all options when addressing data skill gaps in line with the organisation’s long and short term skill needs. Takes a consistent and joined-up approach across the organisation.
19	Supporting development of specialist data staff.	Skills	Expects people to learn data skills ‘on the job’. Does not provide specialist training for data skills.	Small groups of specialist staff working with data have access to specialised data training. The approach is ad hoc and uncoordinated. Awareness and documentation of specialist data skills amongst staff across the organisation is poor.	Specialist staff working with data have some support to improve their skills. The approach is somewhat organised but lacks centralised coordination. Beginning to document and improve awareness of specialist data skills in the organisation.	Specialist staff working with data have some support to improve their skills. The approach is organised and coordinated, but inconsistent across different areas of the organisation. Has a clear understanding of what specialist data skills are present in the organisation.	Specialist staff working with data have appropriate support to continuously improve their skills. The approach is consistently organised and coordinated across the organisation. Has a clear understanding of what specialist data skills are present in the organisation and proactively plans to fill gaps.
20	Providing opportunities for staff to develop data and analysis skills.	Skills	Staff learn data skills only through experience, with no access to external knowledge or expertise around data or analytics.	Beginning to provide some limited, internal training for basic, ‘adequate’ data skills, though staff mostly learn through experience.	Provides training for data, analysis, and relevant systems and tools in-house or externally.	Individuals responsible for data have advanced training and skills and regularly engage in learning to develop and improve systems and embed these across the organisation.	Specialist staff regularly update skills and knowledge through training and conferences.
21	Understanding the data and analysis skills that your organisation needs.	Skills	Struggles to understand the needs and skills required for building the organisation’s data capabilities, due to a lack of interest in or information about in staff’s current skills.	Beginning to understand needs around data skills and capabilities.	Exploring up-skilling and recruitment to fill skills gaps. Invested in developing analytical skills across the organisation.	Understands data and analytical skills needs and gaps in important output areas. Opportunities to develop data and analytical skills are visible and available to both specialist and non-specialist staff.	Has a clear understanding of data and analytical skills needed. Proactively seeks to upskill existing staff to meet upcoming needs.
22	Making data available and interpretable for different users.	Uses	Manually reworks data for presentation. Makes all presentation of data and analysis the same regardless of audiences.	Manually reworks data for presentation in written reports for different internal and external audiences.	Enables some internal users to interactively explore and report on the organisation’s data, however the user may need substantial technical expertise or support from data specialists to do so.	Enables most internal users and some external users to interactively explore, analyse and report on the organisation’s data. Non data specialists are able to do so with minimal specialist support, if any.	Carefully considers different audiences from the beginning when planning data and analysis presentation. Uses interactive and static presentations of analyses as appropriate. Presents data and analyses in a way to be easily and quickly interpreted by non-specialists without support.

Topic 3: Having the right systems

ID	Row summary	Theme	Level 1: Beginning	Level 2: Emerging	Level 3: Learning	Level 4: Developing	Level 5: Mastering
23	Allocating appropriate resources to improve tools for data.	Leadership	Leaders seek to improve or replace data systems and tools only when it is mandated externally.	Leaders seek to improve or replace data systems and tools reactively when insufficient systems and tools have damaged organisational outcomes.	Leaders dedicate some resources to improving or replacing data systems and tools, before poor tools damage organisational outcomes. This generally occurs on an ad hoc basis. Changes made do not consistently link to organisational needs and outcomes.	Beginning to proactively commit resources to improving and replacing data systems and tools. Changes made are linked to organisational needs and outcomes. This occurs inconsistently across the organisation without coordinated senior oversight.	Continuously and proactively dedicates appropriate resources to improving and replacing data systems and tools across the organisation. Plans for improving and maintaining tools are aligned with wider organisational needs and outcomes. Coordination across the organisation ensures all areas have proportionate goals and plans for improving and maintaining data systems and tools.
24	Having the right tools for analysing data.	Tools	Data tools are only used for operational requirements. Analysts frequently spend time on labour-intensive workarounds to meet user needs due to inadequate analytical capability of tools.	Tools mostly used operationally rather than analytically. May allow some basic inbuilt analysis and reporting but most often data has to be exported for analysis in another tool. Possible advanced analytical tool used for basic data processing or descriptive statistical analysis.	Tools support efficient and effective outputs for high impact analytical processes. Efficiency and effectiveness of some lower priority outputs are still reduced due to inadequate tooling resources. Some tools may be disproportionately complex for the needs of the organisation.	Tools for analysis are in line with the organisation’s needs and enable analysts to produce effective, efficient outputs.	Tools that meet the peak of the organisation’s analytical needs are in place and available across the organisation. Tools for delivering batch analytics and real-time streamed data are used.
25	Having the right tools for organising and accessing data.	Tools	Uses tools for accessing and organising data that are highly disproportionate to the organisation’s needs. Reviews tools when failures have had a substantial negative impact on outcomes.	Most tools for organising and accessing data allow for the organisation to meet its objectives. Some tools may be disproportionate to the organisation’s needs.	Tools for organising and accessing data are proportionate to the organisation’s needs and allow for registers of data assets to be maintained and updated.	Regularly reviews tools for organising and accessing data to ensure they are adequate and proportionate for current and short-term future needs. Some awareness of tools that might be relevant to the organisation in the future, but interest and buy-in at senior levels is limited.	Makes use of horizon scanning for emerging technology. Understands what future tools are relevant and proportionate to the organisation’s needs.
26	Having tools that allow appropriate access to internal data.	Tools	Shares data mostly by emailing spreadsheets and documents as attachments with duplication, version control, and security issues.	Safeguards are in place to ensure that data sharing does not compromise data security.	Tools allow for data to be shared internally as live documents for improved version control. Non-experts may require support from specialist users.	Tools allow for effective, direct access to internal data for appropriate expert and non-expert users. Exploring tools to support secure, direct access to data for external users.	Tools able to access and utilise internal and external data directly, for both experts and non-experts.
27	Planning effectively to ensure adequate tools for data.	Tools	Dedicates resources to tools, systems and infrastructure for data only when critical systems fail or when changes are legally required.	Acquires systems and tools on a ‘needs-must’ basis, eg for a specific, isolated purpose or project, or when the existing systems and tools fail.	Primarily acquires systems and tools as ‘one-offs’ for specific purposes with limited flexibility for change or improvement. Considers replacements for all critical systems and tools, and researches and costs this before they fail. Dedicates some resources to improving software tools and ad-hoc hardware replacement.	Commits resources to new and existing systems and tools across the organisation, but the approach is inconsistent. Proactively considers and costs replacements and upgrades for all critical and some important systems and tools.	Commits resources to new and existing systems and tools across the organisation, with a consistent, coordinated approach across the organisation. Proactively considers and costs replacements and upgrades for all critical and important systems and tools.
28	Keeping tools for data up to date and supported.	Tools	Does not understand what data tools are in use. Provides minimal, ad hoc support for tools. Invests in updating tools only when out of date tools have had substantial negative impacts on outcomes.	Understands what data tools are in use and provides basic support for high priority tools. Invests in updating tools only when out of date tools begin to have negative impacts on outcomes.	Most data tools are up to date with support available. Work-arounds for inadequate tools to mitigate negative impacts on outcomes are not well communicated or understood.	Most data tools are up to date with support available. Communicates some work-arounds for inadequate tools, but inconsistently. Actively plans replacements for poorer tools.	All data tools are up to date and have adequate support in place. Consistently records and communicates work-arounds for inadequate tools, with a proactive, structured approach to replacing poorer tools.
29	Sharing data internally.	Tools	Users are not able to find or access data that they need due to inadequate data storage tools. Access to stored data is not managed, or is managed ad hoc without structured processes.	Some people or teams may use cloud-based document storage to share some data. Access is managed ad hoc on an individual level by staff who may not be specially trained in security and governance.	Data storage tools are beginning to be used that allow for broader, internal sharing across the organisation. Access to data for non-experts may require specialist support.	Data storage tools allow for internal sharing across the organisation, with internal and external access managed appropriately. Tools in use in some areas of the organisation are not proportionate to data and analytical needs. Non-experts are able to access most data without specialist support.	Data storage and sharing tools are proportionate to analytical capability and data needs. Storage tools allow for non-experts to access appropriate data without requiring specialist support. Internal and external access is managed appropriately.
30	Sharing analytics internally.	Tools	Analytics tools in use are outdated and do not allow the organisation to consistently share analytics in ways that meet their users’ needs.	Analytics tools are being updated and allow the organisation to share some analytics internally. Non-specialists are not able to meaningfully make use of analytics tools without extensive, direct support from expert users.	Available tools allow for effective internal sharing of analytics but may not be meaningfully usable by non-specialists without support.	Self-service analytics available both inside the organisation and to some relevant external partners and stakeholders. Non-expert users may require support from data and analysis specialists in order to make effective use of analytics.	Self-service analytics available both inside the organisation and to relevant external partners and stakeholders. Non specialist users are able to extract meaning from analyses without support.
31	Having the right tools and systems to collect and store data.	Tools	Mostly uses unstructured tools and systems to collect data such as emails, SMS messages, paper forms. Does not consistently transfer this data into a structured physical or digital storage system.	Mostly collects data manually and then enters it into an isolated database or spreadsheet for analysis and reporting.	Holds data in a range of systems and tools that are all separately managed. Interlinking between systems is restricted by default rather than by design.	Collects and automatically stores data digitally wherever possible eg online forms or apps directly into databases. Beginning to break down silos by increasing interlinking between systems and tools.	Has capacity to store, manage, and analyse increasingly large volumes of data from multiple sources. Breaks down silos by increasing interlinking between data storage systems and tools with appropriately managed access.
32	Storing data in organised ways.	Tools	Data is disorganised and unmanaged and stored in a range of places: on desks, in filing cabinets, individual people’s email inboxes, computers, phones, or other devices.	Stores most data in designated locations. Data is stored in hardcopy and digital formats. Accessing the data requires physical presence in those designated locations. Organisation and management of stored data is ad hoc or manual.	Mostly stores important digital data on a secure, backed-up environment such as a cloud-based system or local server with managed access. Some data may remain inaccessible on computers, central shared drives or devices.	Stores all important data relevant to important business operations and outcomes in secure, backed-up digital systems with managed access where possible.	Draws data from a streamlined number of sub-databases and systems. Holds data in properly supported, securely accessed databases

Topic 4: Knowing the data you have

ID	Row summary	Theme	Level 1: Beginning	Level 2: Emerging	Level 3: Learning	Level 4: Developing	Level 5: Mastering
33	Ensuring findability of data.	Data	Relies on individual staff member’s knowledge to make find data and make it available to those who need it. Finding data is ad hoc and inefficient.	Documents critical data sets in a central location, with a location of the data set. Relies on ad hoc processes or substantial specialist support to make data available to those who need it.	Documents all critical and some important data sets in a central location, with a location of the data set. The data is available to those who need it through efficient, structured routes. Some data requires specialist support to access.	Documents all critical and important data sets in a central location, with the location of the data set. The data is available to those who need it through efficient, structured, well-communicated routes. Most data can be accessed without specialist support.	Documents all critical and important data sets and makes them fully findable by all authorised users. Users are consistently able to access the data they need without specialist support.
34	Managing disposal of data in the right way.	Data	Complies with minimum legal requirements for archiving of data. Disposal of data is ad hoc and does not consider the value or retention needs of the data.	Plans for organised disposal of data, but does not consider different value and sensitivity of data or retention needs for different data sets. Consistently records established processes for disposal of data and ownership of those processes.	Links the retention period for data in high profile data assets to the long-term value, sensitivity and context of the data. Records processes for disposal of the data alongside the data asset.	Automates disposal of data in line with legal requirements and the long-term value of the data. Documents processes for data disposal clearly, and reviews them in tandem with changes to the data.	Proactively considers the requirements and processes for end-of-lifecycle disposal of data at the beginning of the data lifecycle. Consistently balances user needs with requirements for long-term preservation of data when implementing data initiatives.
35	Recording the data you hold, and ensuring people can access it.	Data	Has no formal record of the data that the organisation holds. Nobody is aware or interested in the data assets in the organisation.	Has a basic register of data assets. The process for how to record data in the register is not described, supported or monitored. There is no public layer to the records and the register cannot be accessed by those who need it.	Has a register of data assets with standardised processes. The register can be accessed by request at the discretion of the accountable party with no consistent, communicated process in place for this.	Has a comprehensive and standardised register of data assets with efficient and appropriately governed internal access. Exploring processes for a public access layer for transparency of the nature assets held by the organisation that cannot be accessed directly, but this may be poorly communicated.	Has a comprehensive, standardised, and visible register of data assets with efficient and appropriately governed internal and external access. A public access layer supports transparency around data assets that require limited access.
36	Keeping good metadata.	Data	Has metadata for some data sets. Where metadata is present it is often incomplete or out of date.	Has metadata for most high priority data sets, however it may be incomplete and is not updated in tandem with changes to the data. Metadata does not account for user needs.	Includes information in metadata regarding where and when the data was collected or acquired, accounting for licencing that may affect long-term preservation. Metadata format and structure is standardised to some degree.	Includes information in metadata regarding why the data set was created or acquired, and the purposes and users for which the data set was created. Marks sensitivity of data in critical data sets, but this may be inconsistent across the organisation. Standardises metadata based on some understanding of user needs.	Actively maintains and updates metadata in tandem with changes to the data for all known data sets. Supports prevention of mosaic re-identification when combined with other data in archives by marking sensitivity of data clearly. Standardises metadata based on an in-depth understanding of user and data needs.

Topic 5: Making decisions with data

ID	Row summary	Theme	Level 1: Beginning	Level 2: Emerging	Level 3: Learning	Level 4: Developing	Level 5: Mastering
37	Basing decisions and organisational planning on data.	Leadership	Leaders rely on gut feeling, experience and what seems to work rather than data for decision making.	Typically uses data about what happened in the recent past and verbal accounts of what is happening now for decision-making.	Uses past and current data to understand trends and support some decision making.	Monitors what is happening in the present as well as past trends. Some exploratory forward-looking research and predictions.	Uses past, present and forward looking data for business planning and decision making (this may include forecasting, modelling, prediction and optimisation).
38	Linking decisions that affect organisational outcomes to data.	Leadership	Links decisions that affect business outcomes to data only when it is required for external reporting purposes. Does not consider the value of the organisation’s data to internal and external users.	Beginning to link decisions that affect high profile organisational outcomes to data. Customers and users are not considered when making changes based on data.	Links decisions that affect high profile organisational outcomes to data. Beginning to consider customers and users when making changes based on data.	Links decisions that affect all critical and some important organisational outcomes to data. Considers the needs of customers and users when making changes based on data. This is applied inconsistently across the organisation.	Consistently links decisions that affect all critical and important organisational outcomes to data. Takes a customer-focused approach, incorporating the value that the organisation’s data has to its users into decision making.
39	Using data to monitor and improve performance.	Leadership	Leaders use anecdotal accounts of what is happening rather than data to monitor and improve organisational performance.	Leaders make use of some existing data to monitor performance in some high profile areas of the organisation. Decisions on how to improve are informed by both data and anecdotal accounts of what is happening.	Leaders make use of multiple data sources to monitor and improve organisational performance in all critical areas. Leaders are beginning to question what other data could be used for this. The approach is inconsistent across different areas of the organisation.	Leaders make use of data to monitor and improve performance in all critical areas and some important areas. Senior leaders actively question these data sources and support efforts to improve or broaden the data used for these purposes. The approach is somewhat inconsistent across different areas of the organisation.	Leaders use data to monitor and improve performance in all critical and important areas of the organisation. Leaders proactively encourage the use of new sources of data to better understand performance. The approach is consistent across different areas of the organisation.
40	Using data for operational and strategic purposes.	Uses	Collects and uses data for requisite purposes eg basic financial management and legal or compliance reporting.	Captures data relating to internal activities and measuring outputs. Conducts basic financial analysis and forecasts.	Uses data for both operational and strategic purposes.	Actively exploring more ways to get more value out of data for operational and strategic purposes.	Uses data extensively for a wide range of strategic and operational purposes. Proactively looks for ways to get more value out of data to meet current and future needs.
41	Influencing stakeholders with data.	Uses	Makes data available to stakeholders and partners only in line with legal or policy requirements. Does not see data as useful in conversation to influence stakeholders.	Starting to make some data available to stakeholders and partners but does not consistently use the data as part of conversation to influence them.	Starting to lead conversations with stakeholders and partners using data.	Can coherently make the case to stakeholders and budget holders for existing and new services, products, and campaigns.	Uses data to provide robust, credible evidence to influence policy and decision makers.
42	Using data for business planning and strategy.	Uses	Prioritises speculative, subjective or anecdotal information, over data, to inform decisions.	Starting to use data to inform efficiency savings. Does not frequently use data to influence strategic decisions.	Consistently uses data to inform initiatives to improve efficiency and resource management. Sometimes uses data to support strategic planning and decision making.	Consistently uses data to understand which approaches work and which do not. Strategic planning and decision making are consistently informed by data.	Uses data and analyses of past, present, and future as core elements for all strategic planning and decision making.
43	Using data on customer needs to improve services.	Uses	Only collects data about customers’ and users’ needs in line with minimum legal or policy requirements. Does not communicate or implement insights from this data.	Collects some data about customers’ and users’ needs. The insights and understanding gained from the data is inconsistently communicated and applied to improving products and services.	Collects data to be able to understand and evidence the types of customers’ needs and problems the organisation addresses. Uses both internal and reliable external data sources to do so.	Collects data to understand and evidence a range of customer and user needs. Beginning to use this data as part of discussions for changing, updating, or introducing products and services.	Predicts user needs and service or product options based on understanding customer behaviours and how to influence these for the best outcomes.
44	Knowing who uses your products and services.	Uses	Records basic customer information and activities or work delivered in order to operate at a basic level.	Starting to explore service users, customers, and target audiences. Beginning to account for ethical considerations and any particular groups who could be negatively affected by the organisation’s data, but at a late stage.	Starting to use data to understand different ways customers initially contact and engage with services over time (or not). Accounts for ethical considerations and any particular groups who could be negatively affected by the organisation’s data. However this is inconsistent across the organisation and considered at a late stage.	Regularly reviews and adapts services, products and campaigns in response to data to optimise outcomes. Designs services to ensure inclusion and protection for societal groups who could be negatively impacted by the organisation’s data. Applies this somewhat inconsistently across different areas of the organisation.	Uses data to optimise design and delivery of services, products and campaigns at an individual or personal level. Consistently designs services from the beginning to ensure inclusion and protection for societal groups who could be negatively impacted by the organisation’s data.
45	Targeting services and campaigns.	Uses	Holds data on groups and locations where products and services are used, but does not use the data to evaluate differences or take action to target products and services.	Beginning to use data to understand the differences in groups and locations where products and services are used.	Uses data to understand the needs of end users. Beginning to use this understanding to target services, products, and campaigns at specific groups and geographic locations.	Uses data to understand the needs of end users and internal users. Consistently uses this understanding to improve efficiency and effectiveness of targeting services, products, and campaigns at specific groups and geographic locations.	Uses data to create highly targeted services and products in collaboration with other partners and service providers where appropriate. Uses understanding of internal needs to deliver insights and predictions to proactively improve services and products.
46	Monitoring product or service performance, and use of resources.	Uses	Does not use data to monitor and improve organisational performance except where legally required.	Uses existing data to improve some organisational performance and effectiveness.	Makes use of multiple data sources to monitor and improve all critical areas of organisational performance. Beginning to seek new data to do this.	Uses data to actively improve all critical areas of organisational performance, and some important areas. Actively seeks data and makes use of multiple data sources, including feedback from users or customers.	Uses data to actively improve all critical and important areas of organisational performance. Actively seeks out new sources of data, including user and customer feedback, to monitor and improve organisational performance. Routinely reviews these data sources to ensure effectiveness.

Topic 6: Managing and using data ethically

ID	Row summary	Theme	Level 1: Beginning	Level 2: Emerging	Level 3: Learning	Level 4: Developing	Level 5: Mastering
47	Accounting for limitations in data and how this may introduce bias.	Culture	Only accounts for how limitations in data that may create bias and negatively affect particular groups where it is externally mandated by legal, policy, or service level agreement requirements.	Beginning to account for how limitations in some high profile data sets may introduce bias that can negatively affect any particular groups. This occurs inconsistently in small pockets of the organisation.	Accounts for limitations in all high profile data sets that may introduce bias and negatively affect any particular groups. This may be inconsistent across different areas of the organisation.	Accounts for limitations in all high profile data sets and some important data sets that may introduce bias. This occurs consistently for high profile areas, but pockets of the organisation still struggle to apply this consistently.	Proactively considers how limitations in all high profile and important data sets may introduce bias. A consistent approach is taken across the organisation to ensure that limitations to data do not negatively impact any particular groups.
48	Ensuring transparency and scrutiny of data processing and analysis.	Culture	Does not ensure transparency in processing and analysis of data even where this is not restricted. Routes for public scrutiny and accountability are not available.	Ensures transparency around most high profile processing and analysis of data where appropriate. Routes for public scrutiny and accountability exist for high profile processes where appropriate, but are not well communicated. Considerations of these are ‘added on’ after the process is already active.	Ensures routes for public scrutiny exist for all appropriate processing and analysis of data and is making efforts to make these more visible. Makes methods and objectives used for this transparent where appropriate. Approaches to this tend to be considered as an after thought, not an integral part of developing the process.	Ensures routes for public scrutiny of processing and analysis of data are visible and well communicated where possible. Considers transparency and public scrutiny from the beginning as a fundamental part of all high profile processes.	All processing and analysis of data has transparency and public scrutiny in mind from the early planning stages where appropriate. Makes internal, external, and public scrutiny integral to the design of all processes where possible.
49	Considering and mitigating ethical impacts of bias in data.	Culture	Considers potential negative impacts of interventions or data activities on specific societal groups and an extremely late stage in the process, and only where it is externally mandated by legal or policy requirements.	Explores potential negative impacts of interventions as well as data ethics.	Consistently considers potential negative impact of data initiatives on specific societal groups. Some parts of the organisation engage with external experts or advisory boards for high profile projects.	Seeks guidance from external data ethics advisory board. Consults with stakeholders in civil society groups or academia to improve ethical use of data. High profile projects may include public consultation.	Keeps up with societal changes in order to ensure that data collection and publication remains inclusive to all. Conducts extensive public consultations with groups who may be affected by data initiatives to ensure transparency and mitigate bias.
50	Meeting accessibility standards for published data.	Culture	Considers accessibility for published data and analysis at an extremely late stage, and only to the degree that it is externally mandated by legal or policy requirements.	Aware of accessibility requirements for active publications. Beginning to meet requirements that have an impact on the largest number of users.	Ensures that new publications meet accessibility standards, but previous, active and relevant publications have not been updated to meet minimum standards.	Beginning to ensure that all prominent active publications meet accessibility requirements.	Ensures that all active published data and analyses meet or exceed requirements for accessibility. Considers accessibility from the beginning when designing new analytical publications.
51	Ensuring transparency and scrutiny of data.	Culture	Complies with minimum legal requirements for transparency and public oversight of data use. These requirements are considered at a late stage of projects and usually met as an after thought.	Beginning to recognise the potential for increasing transparency and public oversight of the organisation’s data objectives, but no firm or structured plans. Where this occurs, it is driven by internal engagement.	Beginning to consider public visibility and oversight as a core element of high profile data initiatives. Engagement with some users to improve transparency occurs in isolated pockets of the organisation.	Engages with users to ensure appropriate transparency and accountability in structured ways. Some parts of the organisation consistently consider how to ensure appropriate public visibility from the start when planning data initiatives.	Actively engages with appropriate communities to empower the public to hold the organisation to account on their data objectives. Considerations of public visibility are integral to planning new data initiatives.
52	Understanding interactions of automated data processing and ethical data practices.	Data	Does not consider how to use automation in data supply and processing. Does not consider how automation can reduce risks or bias in data processing. Does not consider oversight, transparency, and public scrutiny when automating data processing. Does not document these processes.	Beginning to consider how to use automation in high profile areas of data supply and processing. Beginning to consider how to mitigate against automation risks in high profile areas, however does so inconsistently and usually after the implementation. Beginning to consider oversight, transparency and routes for public scrutiny when automating data processing. Does not document changes to these processes.	Consistently considers risks and benefits of automation of data supply and processing and in high profile areas. Understands where automation is proportionate, and mitigates against the potential for automation to introduce bias, though somewhat inconsistently in different areas of the organisation. Consistently considers oversight, transparency, and public scrutiny of automated data processing, but does so at a late stage. Documentation of changes is sporadic.	Consistently considers the risks and benefits of automation in all high profile areas, and beginning to do so in other areas. Understands where automation is proportionate, mitigates risks appropriately, and plans to do so from early stages for all processes, though this may be inconsistent across the organisation. Considers oversight, transparency, and public scrutiny from early stages of automation initiatives, and consistently documents all changes.	Has a clear understanding of the interactions between automation of data supply and preparation and data ethics. Proactively plans automation in processes to reduce human bias whilst carefully considering and mitigating any bias the automation could introduce. Plans for oversight, transparency, and public scrutiny from the beginning in all data processing automation initiatives. Documents all changes to these processes and the reasons for the changes clearly and consistently across the organisation.
53	Collecting data in inclusive and ethical ways.	Data	Considers accessibility, transparency and the potential for bias in data collection at a late stage in the development process, and only to meet legal or policy requirements.	Checks data for bias and documents any mitigation made against bias. Considers transparency and accessibility in data collection methods but applies this at late stages in development to meet legal or policy requirements.	Embeds transparency of methods into the process when designing data collection where appropriate. Makes efforts from the beginning to mitigate bias and make collection methods accessible to ensure that no societal group is disadvantaged by the methods used. Applies this very inconsistently in different areas of the organisation.	Embeds transparency, inclusivity and accessibility in data collection methods from the beginning. Checks data collection processes for bias, with actions to mitigate bias recorded and communicated. Applies this somewhat inconsistently in different areas of the organisation.	Embeds a deep consideration of data ethics from the beginning when planning data collection. Proactively embeds transparency of methods, accessibility, inclusivity and mitigation of bias into new data collection processes consistently across the organisation.
54	Creating diverse leadership to support ethical use of data.	Leadership	Considers data ethics through a limited lens due to a lack of diversity in leadership.	Considers data ethics, but faces difficulty in doing so with depth or breadth due to a lack of diversity in the organisation’s leadership.	Understands the importance of diversity amongst leadership in supporting ethical use of data. Beginning to build a more diverse leadership team.	Has an increasingly diverse leadership team which is beginning to support depth and breadth in considerations of data ethics.	Has a diverse leadership team which consistently supports broad perspectives on the use, value, and ethics of data at all stages of its lifecycle.
55	Ensuring responsibility and oversight for data ethics.	Leadership	Senior leaders only engage with ensuring oversight and scrutiny is in place for the ethical use of data where it is externally mandated by legal or policy requirements.	Senior leaders are beginning to engage with ensuring external and public oversight and scrutiny is in place for the ethical use of data. However, their approach is unstructured or reactive.	Senior leaders are engaged with ensuring oversight and scrutiny is in place for the ethical use of data however this does not consistently reach across the organisation. Lines of responsibility and accountability for data ethics are structured, but visibility of these is poor.	Senior leaders are engaged with ensuring oversight and scrutiny is in place for the ethical use of data across the organisation. Lines of responsibility and accountability for data ethics are structured, though visibility of this may be limited. Champions for data ethics are present in the organisation, however they may lack the seniority or the reach to have a large impact.	Senior leaders are proactively engaged with ensuring oversight and scrutiny is in place for the ethical collection, storage, and use of data across the organisation. Senior leaders are highly visible as champions for promoting data ethics across the organisation. Responsibility and accountability for this is clear, structured, and visible.
56	Having the skills to understand ethical management and use of data.	Skills	Staff consider ethics when working with data only in line with legal or policy requirements, due to a lack of availability or interest in relevant training.	Staff working with data have awareness and skills to identify and address bias in data.	Staff working with data have a firm understanding of the importance of ethical use of data and are beginning to see how this applies to their own work.	Staff have the skills to understand the unintended consequences of data collection and use, and how misuse of data can reinforce existing problems in the treatment of different societal groups.	Staff working with data are confident in proactively mitigating against negative impacts for particular societal groups in the way that they collect, process, store, and destroy data. They are able to identify areas where misuse could reinforce existing problems.
57	Ensuring tools for data are inclusive.	Tools	Considers accessibility and inclusivity for tools at the end of the acquisition or design process, and only when it is externally mandated by legal or policy requirements.	Data and analytics tools meet minimum accessibility requirements. Considers accessibility and inclusivity as an afterthought at a late stage when designing or acquiring tools.	Adapts tools for data collection, storage, and processing to improve inclusivity for different societal groups. Considers inclusivity and accessibility at a late stage in the process when designing or acquiring new tools.	Designs new tools with inclusivity and accessibility in mind for all users from the earliest stages of the design process.	Sees accessibility and inclusivity as high priority from the beginning when updating, designing or acquiring any tools.

Topic 7: Managing your data

ID	Row summary	Theme	Level 1: Beginning	Level 2: Emerging	Level 3: Learning	Level 4: Developing	Level 5: Mastering
58	Building a data quality culture.	Culture	Measures and addresses data quality at extremely late stages, and only when it is externally mandated by legal, policy or service level agreement requirements. Does not link data quality to business outcomes.	Some interest in improving data quality, but does not consistently link these to damages to business outcomes. Attempts to improve data quality are ad hoc and do not address root causes.	Beginning to understand data quality in terms of the risks it poses to business outcomes. Addresses issues with data quality through tackling root causes not only through cleansing.	Consistently links data quality to the risks it poses to business outcomes. Aware of trade-offs in data quality in line with the needs of users and the purposes of data.	Consistently frames all data quality issues in terms of their impact on business outcomes. Everyone in the organisation is committed to ensuring quality data is available to support services and decision-making.
59	Managing data disposal the right way.	Culture	Considers disposal of data only at a very late stage in the data lifecycle. Defines ownership of and responsibility for disposal of data only in line with minimum legal or policy requirements. Does not understand differences in types of disposal of data.	Staff responsible for data sets understand differences in types of disposal. Responsibilities for implementing appropriate disposal methods are beginning to be defined. Any considerations of how to dispose of data occur at a very late stage in the data lifecycle.	Beginning to give greater consideration to data disposal, but it is not seen as fundamental when planning data initiatives. Ownership and responsibility for disposal of data is recorded alongside all high profile data sets. Staff working with data have some understanding of expectations and requirements for data preservation and disposal.	All staff working with data understand their responsibilities to ensuring records are able to be created and preserved of all appropriate data. Responsibility for disposal of data is defined and recorded alongside all data assets, but implementation is inconsistent across the organisation.	Collaborates with archiving experts to ensure that data sets can be preserved appropriately. Proactively considers the end of the data lifecycle when planning new data initiatives. Ownership of and responsibility for disposal of data is clearly defined, recorded, and implemented for all data assets.
60	Communicating limitations of data appropriately to users.	Culture	Communicates limitations of data only in line with externally mandated requirements. The style and method of this communication does not consider users’ needs.	Beginning to understand limitations of data and communicates these in some high-profile areas. Some pockets of the organisation consider the needs of some important users and communicate in a way to meet these needs, through a limited range of routes.	Understands and communicates limitations of data in all high-profile areas. Understands the needs of some important users and communicates in a way that meets these needs, however the range of routes may be limited. The approach to this is inconsistent across different areas of the organisation.	Understands and communicates limitations of data. Understands the needs of most important users of the data and communicates in a way that meets these needs, using a range of appropriate routes. The approach to this is inconsistent across different areas of the organisation.	Understands and communicates limitations of data. Understands the needs of all important users of the data and communicates in a way that meets these needs, using a range of appropriate routes. The approach to this is consistent across the organisation.
61	Linking data collection processes to organisational outcomes.	Data	Collects data in order to meet minimum requirements without understanding how this is attached to business needs. Has a minimal awareness of collection methods based on what has previously been used, but does not record or address errors.	Beginning to understand the need to collect data that is attached to business needs, and to avoid collecting data that is not. Does not regularly apply or incorporate this into practices. Has some awareness of collection methods and errors but does not record or address these.	Understands the need to collect data that is attached to business needs, and to avoid collecting data that is not. Beginning to incorporate this into planning collection or use of data. Beginning to consider and record methods and errors but does not consistently address these.	Understands the need to collect data that is attached to business needs, and to avoid collecting data that is not. Incorporates this in critical business process in some areas of the organisation. Regularly plans ahead regarding the collection or use of data but this is not embedded from beginning to end. Considers and records methods and errors and is beginning to address these in higher profile initiatives.	Has a clear understanding of the need to collect data that is attached to business needs, and to avoid collecting data that is not. Consistently incorporates this in critical and important business process across the organisation. Embeds planning of collection or use of data from beginning to end. Gives full consideration to methods and errors and ensures that these are addressed promptly.
62	Acquiring existing data in the right way.	Data	Acquires existing data over collecting data only when required or requested to do so by external impetus. Does not record licencing of acquired data alongside data sets.	Beginning to understand the difference in value of acquiring existing data compared to collecting new data and which is most appropriate. Does not make use of existing data. Has some awareness of licencing of data acquired from other sources but does not record licencing of acquired data alongside data sets.	Understands the value of using existing data rather than collecting new data and which is most appropriate. Beginning to make use of some open data sets where appropriate. Beginning to record licencing of data acquired from other sources alongside data sets. Beginning to plan for effects of licencing on long-term preservation of data sets containing acquired data.	Understands the value of using existing data rather than collecting new data and which is most appropriate. Makes good use of open data sets where appropriate but does not fully embed the approach from beginning to end. Records and communicates licencing of data acquired from other sources but this approach is not fully embedded from beginning to end. Plans for effects of licencing on long-term preservation of data sets containing acquired data but this approach is not fully embedded from beginning to end.	Has a clear understanding of the value of using existing data rather than collecting new data and which is most appropriate. Makes full use of open data sets where appropriate and fully embeds the approach from beginning to end. Fully records licencing of data acquired from other sources and this approach is fully embedded from beginning to end. Plans for effects of licencing on long-term preservation of data sets containing acquired data and this approach is fully embedded from beginning to end.
63	Applying data users’ needs to product design.	Data	Has a minimal awareness of who the users of the organisation’s data are and what their needs are, driven only by legal or service level agreement requirements. Does not incorporate or apply information about data user needs in product design and development	Has some awareness of who the users of the organisation’s data are and what their needs are, but does not incorporate this into product design and development.	Understands who the users of the organisation’s data are and what their needs are. Beginning to incorporate and apply user needs into product design and development.	Has a good understanding of data users and their needs though this may be inconsistent across the organisation. Beginning to incorporate and apply data users’ needs in product design and development, but this is not embedded from beginning to end.	Has a clear understanding of data users needs in all relevant areas of the organisation. Consistently incorporates and applies data users’ needs in product design and development, and embeds this from beginning to end.
64	Collecting data with user needs in mind.	Data	Has a minimal awareness of the user (eg member of the public or civil servant) providing data to government, driven only by legal or service level agreement requirements. Designs and develops products without considering or incorporating the needs of these users.	Has some awareness of the needs of the user providing data, and of user-centred design and methods. Does not incorporate or apply this understanding in product design and development	Understands the needs of the user providing data, and of user-centred design and methods. Beginning to incorporate and apply this understanding to product design and development.	Has a good understanding the needs of the user providing data, and of user-centred design and methods, though this may be inconsistent across the organisation. Incorporates and applies this understanding to product design and development in some areas, but may not embed this from beginning to end.	Has a clear understanding of the needs of the user providing data, and of user-centred design and methods in all relevant areas of the organisation. Fully embeds application of this understanding in product design and development from beginning to end.
65	Conducting data quality assessments.	Data	Assesses data quality only when it is externally mandated by legal, policy, or service level agreement requirements. Does not record or track data quality assessment results over time.	Assess data quality against generic standards. Does not update data quality assessments across the lifespan of the data.	Re-assesses data quality during the data’s lifetime, but does not link the frequency of assessment to changes in the data. Beginning to conduct assessments that consider quality dimensions, measurements, and requirements in relation to the way in which the data is used.	Proactively monitors the quality of data in important data sets is in a way that is linked to purpose, documented and communicated. Conducts data quality assessments that are evidence-based and tracked over time.	Proactively monitors and fully understands the quality of the data it holds and hence has high levels of confidence and trust in its data.
66	Managing data quality across the data lifecycle.	Data	Makes efforts to manage data quality only when it is externally mandated by legal, policy, or service level agreement requirements. Does not make dedicated resources available for this.	Manages data quality ad hoc and at a late stage in the data lifecycle. Where resources and processes are in place for managing data quality, they focus only on data cleaning.	Beginning to manage data quality for priority data at different stages of the data lifecycle.	Puts resources and processes in place for managing data quality at all stages of the data lifecycle, but does not apply this consistently across the organisation.	Proactively invests in resources to collect, maintain, and manage high quality data at all stages of the data lifecycle. Data quality is managed consistently across the organisation.
67	Understanding the data quality needs of your users.	Data	Engages with a minimal number of internal users to understand data quality needs, based primarily on policy or service level agreement requirements.	Beginning to engage with some immediate users of the organisation’s priority data to understand their data quality needs.	Accounts for the needs of immediate, internal users in data quality assessments and initiatives	Actively engages with a wide range of internal users to understand their data quality needs and reviews these needs regularly. Beginning to communicate data quality alongside high profile data sets.	Considers the data quality needs of all knowable users alongside immediate internal user needs when collecting, processing, and publishing data. Consistently communicates the quality of data alongside data sets.
68	Understanding what data processing to automate.	Data	Does not understand what data processing can or should be automated. Where automation occurs, it does so without understanding or considering what is useful and proportionate in the long-term to achieve efficiency and quality.	Beginning to understand what data processing can and should be automated. Makes some consideration of what automation is useful and proportionate in the long-term to achieve efficiency and quality in high profile processes, though the approach is inconsistent and occurs as an after thought.	Able to apply a good understanding of what data processing can and should be automated for high profile areas, but inconsistently elsewhere. Considers what automation is useful and proportionate in the long-term to achieve efficiency and quality, but somewhat inconsistently in different areas of the organisation.	Has a good understanding of what data processing can and should be automated for high profile areas, and is beginning to apply this consistently across the organisation. Considers what automation is useful and proportionate in the long-term to achieve efficiency and quality but with some inconsistency.	Has a clear understanding of what data processing can and should be automated. Carefully considers what automation is useful and proportionate in the long-term to achieve efficiency and quality.
69	Building reproducible data processing.	Data	Designs data processing without considering adequate testing, transparency and documentation to ensure that processes can be reproduced for the same output. Does not document processes or changes to processes.	Some testing and documentation for important data processing. Aware of the importance of documentation or transparency to ensure good automation. Documentation that exists may not be appropriately available to those who need it, or may assume prior knowledge of the processes.	Tests and documents most important data processing and is able to reproduce the same outputs efficiently in most cases. Testing covers a range of data scenarios. Documentation of processes is sporadic, this may be done at a late stage. It may be poorly communicated or inaccessible. The approach is highly inconsistent across the organisation.	Designs, tests and documents all important data processing. Tests include typical changes that may occur. Testing strategy may be considered after processes are created. Most processes are clearly documented, documentation is communicated and available as appropriate. The approach is somewhat inconsistent across different areas of the organisation.	Proactively designs, tests, and documents all important data processing from the beginning to ensure that they can be efficiently reproduced with the same outputs and are resilient to change. Documentation and processes are transparent, communicated and available as appropriate. The approach is consistent across the organisation.
70	Applying data standards in your organisation.	Data	Applies data standards only where they are externally mandated for compliance. Considers interoperability between data sets only to mitigate against critical failures.	Beginning to apply data standards on an ad hoc basis where interoperability between data sets is needed for a specific purpose.	Applies data standards in some areas but does so inconsistently. Some data is versatile and re-usable internally for limited purposes.	Beginning to apply data standards consistently enough to allow data to be re-used internally for a range of purposes. Some data is re-usable externally but with limited scope.	Applies data standards consistently across the organisation to ensure that data is versatile and re-usable for multiple purposes and audiences.
71	Engaging with cross-government data standards.	Data	Only engages with data standards in other areas of government to comply with externally mandated requirements.	Engages with other areas of government to begin exploring how to implement data standards internally.	Acknowledges the importance of data standards in other areas of government. Actively engages internally to embed standards.	Actively applying most cross-government data standards. Exploring shared measures and benchmarks with other organisations.	Proactively involved in the development of cross-government standards and actively applies these across the organisation. The organisation compares its data with other organisations through shared measures and benchmarks.
72	Engaging senior leaders with data and its value to the organisation.	Leadership	Leaders are not engaged with data or how it is used. They do not understand how difficult or complex it is to achieve their requests for data.	Leaders are aware of some uses for data in the organisation but do not see value in it for business outcomes. Leaders do not see data as a priority in the organisation.	Leaders occasionally ask questions about the data they are given but are not entirely convinced about its value. Leaders have little or no interest in the full data lifecycle.	Leaders are beginning to engage with the value of data throughout the data lifecycle. They ask the right questions of data, are active in harnessing its value, and supportive of the organisation’s data needs.	Leaders are fully engaged with the value of data at all stages of the data lifecycle. They proactively seek to understand the organisation’s current and future data needs.

Topic 8: Protecting your data

ID	Row summary	Theme	Level 1: Beginning	Level 2: Emerging	Level 3: Learning	Level 4: Developing	Level 5: Mastering
73	Managing policies for data protection and data security.	Culture	Has basic policies for data protection and security in place, but does not have a method to monitor or enforce these.	Has policies in place to ensure data about identifiable individuals is deleted when no longer necessary and to respond to subject access requests.	Monitors and enforces policies for data protection and data security consistently. Reviews policies regularly to ensure they are fit for current needs.	Communicates and enforces policies for data protection and data security consistently. Beginning to embed policies across all levels of the organisation.	Thoroughly embeds positive attitudes to and understanding of data protection and data security at all levels of the organisation.
74	Controlling access to data.	Culture	Data security in place only to meet minimum legal or policy requirements. Does not link security vetting of staff to data protection and data security measures.	Most critical systems, processes, and data have limited security and security governance. Security vetting of some staff is linked to data security.	All critical data assets have at least limited security and security governance in place. Security vetting of most staff is linked to data security.	Consistent and comprehensive security and security governance policies are in place for all critical data assets. Clearly links security vetting and background checks of all staff to data security and legitimate business need.	Communicates security governance clearly and openly throughout the organisation. Clearly links security vetting and background checks of all staff to data security and legitimate business need. Reflects security clearance for access to data assets in employment contracts where appropriate.
75	Reviewing governance and security incident responses.	Culture	Reviews of data security incidents are limited in scope and responses to incidents are inconsistent. Very little, if any, review or assessment of governance takes place.	Reviews and assesses security controls, but this is inconsistent or limited in scope. Beginning to identify and review data security incidents and take appropriate responses.	Regularly reviews assesses all critical governance and security controls for effectiveness, though recording of these may be inconsistent. Identifies and reviews data security incidents and takes appropriate responses.	Regularly reviews and assesses all governance and security controls regularly for effectiveness. Recording of reviews is clear and consistent, though not consistently available as appropriate. Reviews all security incidents promptly and takes appropriate, proportionate actions.	Regularly reviews and assesses all governance and security controls for effectiveness. Recording is clear, consistent and appropriately available both internally and externally to support continuous improvement. Reviews all security incidents quickly and takes appropriate, proportionate actions. Discusses lessons learned from security incidents openly as appropriate.
76	Ensuring business continuity for data.	Culture	Business continuity plans exist for some critical activities, but nobody has full oversight of which activities are critical to the organisation’s operation. No clear central record of the potential impact of critical failure on staff, customers, services, products and reputations.	Has business continuity plans in place for all critical data activities, but these are not centralised. Does not have standardised risk assessments for activities.	Centrally coordinates oversight for business continuity as appropriate to ensure all critical activities are understood and calibrated. Standardises risk assessments for activities to promote parity across the organisation. Tests business continuity plans occasionally.	Has business continuity plans for data in place for all areas of the organisation with central oversight. There are clear lines of ownership for plans and they are regularly tested with actions planned for improvements.	Regularly reviews and tests business continuity plans with lessons learned and actions for improvement. Ties the frequency of reviews to the level of criticality of the activity and an understanding of threats to the organisation’s operation. Business continuity plan owners have access to regular updates and refreshes on best practice.
77	Measuring the effectiveness of your data protection processes.	Data	Assesses effectiveness of data protection measures only in line with minimum legal or policy requirements.	Regularly conducts data protection impact assessments.	Proactively reviews data protection impact assessments to ensure continuous improvement.	Actively engages internally to ensure that data protection impact assessments and improvements are understood and valued across the organisation.	Proactively engages internally and externally to promote good practice in data protection. Seen as a leader in assessing data protection impact and implementing data protection measures.
78	Assessing risks to data assets.	Data	Only assesses or knows security risks to data in line with minimal legal or policy requirements. Does not assess data assets for their value.	Only assesses data assets for their value or sensitivity when it is externally mandated by legal, policy or service level agreement requirements. Assesses risks to critical data assets.	Routinely assess the value of the organisation’s data assets. Assesses risks to all appropriately valuable individual data assets.	Routinely assesses data assets for their value to the organisation’s outcomes and assigns appropriate levels of sensitivity. Assigns ownership of data assets but this may not be fully embedded or communicated.	Understands the value of data in terms of how it is used. Assesses risks to all data assets to implement cost-effective data security measures, matched to the value of the assets they protect. Defines ownership and responsibility for data assets clearly.
79	Training staff to comply with and enforce data protection regulations.	Skills	Staff have basic data protection and compliance training though are not be very confident in applying this.	Staff know how to respond to a data breach, potential breach, or near miss. Staff know how to respond to a subject access request.	All staff who work with data understand legal constraints around data e.g. computer misuse regulations, and data protection regulations. These staff are able to apply this understanding confidently.	Firmly embeds data protection and compliance with data regulations within staff training. Non-specialist staff are not fully confident in applying this training without support.	Firmly embeds data protection and compliance with data regulations within staff training. All staff are confident in applying this knowledge.
80	Training staff to work with data securely.	Skills	Staff have basic data security training though are not very confident in applying this.	Staff are aware of security requirements and the need to operate securely in line with policy, procedures and processes.	Staff working with data are aware of the need to work securely. Reviews and updates to security training are limited in frequency or scope. Non-expert users may not be confident in applying policies without support.	Staff are confident in their understanding of data security requirements. The organisation is committed to embedding and instilling good security practice in people who work with data.	Uses training materials and internal communications to actively work to embed good data security practice and inform staff of risks and threats.
81	Protecting your data.	Tools	Does not design systems and tools to protect data. Users are able to access systems and data assets irrespective of having a legitimate business need to do so. Does not monitor systems usage.	The most critical data storage and processing systems and tools integrate data security by design, including some access control and monitoring of use. Assesses data security risks when changes are made to critical systems.	All data systems and tools integrate data security and are subject to risk assessments when changes are made. Bases access to systems and data on legitimate business needs.	Considers risks and security requirements throughout the development of new systems and tools. Monitors systems and data access for misuse or attack.	Tailors data security tools to the organisation’s specific risks and threat patterns. Uses the development of new data storage and processing tools as an opportunity to improve data security tools. Routinely reviews access permissions to systems, tools, and data.
82	Recording and securing your data tools and systems.	Tools	Records minimal or no information regarding IT assets that the organisation holds to store and process data. Any records are usually collected indirectly without organisation or coherent structure. Considers physical security measures to protect data held on IT assets only in line with minimal legal requirements.	Has a basic IT asset register. The process for how to record tools is not described, supported or monitored. The register captures only high profile assets. Some security risks to high value assets have been identified and addressed. No monitoring and review of risks and physical data security measures.	Standardised processes for recording IT assets are in place. Value and sensitivity of data stored in these assets is not consistently recorded. Security risks to all known IT assets are assessed and addressed. Physical security for high priority assets is reviewed regularly, however the security implemented is not measured in relation to the value or sensitivity of the data.	Standardised processes for recording IT assets are embedded. The value and sensitivity of data is a priority element of recording physical IT assets. Physical security measures for all recorded IT assets are regularly reviewed and linked to the value and sensitivity of the data they hold.	The IT asset register is thorough and ownership and accountability for these assets is defined, implemented, and transparent. Physical security measures are reviewed and tested proactively to ensure the security of data.

Topic 9: Setting your data direction

ID	Row summary	Theme	Level 1: Beginning	Level 2: Emerging	Level 3: Learning	Level 4: Developing	Level 5: Mastering
83	Creating and embedding data principles and policies.	Culture	Only creates structures for responsibility, accountability and oversight for data policies and data principles by default rather than by design.	Data principles and policies exist but are not supported or understood.	Some awareness of Data Principles and Policies as they are developed in line with the needs of the organisation.	People are aware of Data Principles and policies and they are supported by senior leaders.	Data principles and policies embedded and governed with clear visibility across the organisation and to the public.
84	Communicating data strategy, policies, and principles.	Data	Builds data policies, data principles and data strategy in a disconnected way. Does not communicate or seek to embed these due to a lack of interest or dedicated resource.	Starting to build data strategy alongside the data principles with regard to data policies.	Makes data strategy, principles and policies publicly available.	Actively working to embed data strategy, principles and policies across the organisation.	Has fully embedded the organisation’s data strategy, principles and policies with an established assurance and review process in place.
85	Linking data principles and policies to organisational objectives.	Leadership	Links data objectives, data principles, and data policies to organisational objectives only to minimum degrees required by externally enforced mandates.	Beginning to see value in linking data objectives to organisational objectives. Attempts to do so are limited in scope and do not consistently surface in data policies or data principles.	Beginning to consistently link data objectives to organisational objectives, though this may not always be made clear in organisational plans. Some of this may surface in data policies or data principles, but the links are not explicit.	Leaders have clear sight of how and why data objectives, data principles and data policies link to organisational objectives. These links surface in data policies and data principles, but the approach is somewhat inconsistent.	Leaders proactively work to ensure that data objectives are aligned with organisational objectives. Clearly and consistently aligns data principles, data policies, and data strategy with organisational strategy.
86	Seeing data as an organisational priority.	Leadership	Senior leaders do not see data as important or valuable.	Leaders show some recognition of the importance of data to the organisation, but they do not see the value of engaging with it.	Leaders know data is important and are curious to learn about its potential uses and benefits. Some leaders are beginning to model good data culture.	Leaders see data as an organisational priority, and especially so in high impact projects or work. Senior leadership teams model good data culture and are working to embed this culture throughout the organisation.	Leaders see data as a major organisational priority, with value for all business areas. Senior leadership teams model good data culture and a continuously support a well-embedded, strong data culture throughout the organisation.
87	Linking data strategy to organisational strategy.	Leadership	Links data strategy to organisational strategy only where it is required for external reporting purposes. Any connections are not acted on internally. Leaders do not see data as a priority.	Beginning to see the relevance of data strategy to organisational strategy, but does not attempt to connect these for internal action. Sees data as useful, but not a high priority.	Leaders see data as important to organisational outcomes. Beginning to incorporate data strategy in organisational strategies but this may be inconsistent or disjointed.	Leaders see data as a priority. Prioritises and plans data strategy as part of organisational strategy, though application may not be consistent across the organisation. Data strategy has sponsorship at a senior level.	Consistently sees data as a vital resource for the organisation. Plans and prioritises data strategy as a core element of organisational strategy. Sponsorship and promotion of this by senior leaders is visible and communicated.
88	Aligning data goals with organisational needs and outcomes.	Leadership	Aligns data practices with work plans only where it is externally mandated or by chance rather than by design. Rarely aligns data goals with the organisation’s needs, outcomes or strategies.	Beginning to consider how to link data practices to work plans. Considers some of the organisation’s current needs, outcomes or strategies when setting goals for data in some areas the organisation.	Consistently links data practices to work plans and considers the organisation’s current needs when setting goals for data in most areas of the organisation. Beginning to align some data goals with the organisation’s outcomes and strategies in some areas of the organisation.	Aligns data practices with work plans, though communication of this may not be clear outside of data specialists. Aligns data goals with the organisation’s current needs, outcomes, and strategies, though application of this may be inconsistent across the organisation.	Aligns data practices and data goals clearly with work plans based on outcomes, desired impact, and the organisation’s current and future needs.
89	Understanding the value of your data to your organisation.	Uses	Relies on external impetus to see value of data that the organisation holds or how to make use of it.	Understands at a basic level how data is useful through time. Reflects on the value of the data the organisation holds.	Has a reasonable understanding of the value of the data the organisation holds and potential uses of this data.	Has a good understanding of the value of most of the data the organisation holds and making attempts to quantify this.	Has a deep understanding of the value of the data the organisation holds, and takes steps to maximise this value for the good of society. Actively and regularly measuring the value of its data.

Topic 10: Taking responsibility for data

ID	Row summary	Theme	Level 1: Beginning	Level 2: Emerging	Level 3: Learning	Level 4: Developing	Level 5: Mastering
90	Defining and recording accountability and ownership for data.	Culture	Consistent structures for ownership of data are not in place. Where ownership exists, this is assigned by default not by design. Documents responsibility and ownership of data only where externally mandated.	Beginning to assign ownership of critical data. Documents and communicates ownership sporadically or inconsistently.	Assigns ownership to all critical data. Documents ownership clearly and beginning to document responsibilities of data owners. Staff require specialist support to find or access this documentation.	Assigns ownership to all critical data. Beginning to assign ownership to other important data. Clearly documents data ownership and data owners’ responsibilities in a way that is findable for all staff. Processes around this are inconsistently applied across the organisation.	Assigns ownership to all important data. Clearly and consistently documents data ownership and data owners’ responsibilities. Ensures that this documentation is available and findable for all relevant stakeholders.
91	Creating and embedding data governance.	Culture	Only has governance systems in place for sharing and use of data in line with externally driven requirements. Struggles to use or share data within the organisation due to lack of clarity on what is possible.	There is a policy or framework for governance of data in place, but this is not understood, known or possible to implement.	People are aware of governance frameworks, systems and accountabilities. These have been developed with the needs of the organisation in mind.	Robust, needs-based governance frameworks are embedded in the organisation.	Governance for use and sharing of data is fully embedded. Governance, ownership and accountability for analysis are well documented and enforced, and clearly visible across the organisation. Analysts understand how their work relates to these structures.
92	Defining who should have responsibility for data.	Culture	Sees data as a chore with questions and requirements mostly externally driven. Assigns responsibility for data by defaults rather than by design, usually to staff in IT or administrative roles.	Places responsibility for data purely with administration or IT roles. Staff working with data do not understand how data management relates to the business’ objectives and see data as the responsibility of ‘someone else’.	Beginning to define and implement roles, responsibilities, and accountabilities for maintenance and improvement of data. Most staff working with data understand the importance of good data management, but may not be aware of how this relates to the organisation’s objectives and outcomes.	Clearly defines and implements roles, responsibilities, and accountabilities for data management across the organisation, with good visibility.	Sees data as a team effort and critical asset for every part of the organisation. All staff working with data understand the importance of good data management and feel empowered to challenge each other when this does not happen. Staff understand how data management links to the organisation’s outcomes.
93	Taking responsibility for recording the data you hold.	Data	Defines responsibilities and accountabilities for data assets only in line with minimum legal or policy requirements. Does not record or enforce these structures.	Beginning to define some responsibilities for maintaining registers of data assets. There is no accountability system in place for maintenance of the register and little to no resources are available for this.	Has a recorded structure of responsibility and accountability for the register of data assets, but is not well understood or enforced. Relies on ad hoc or periodic updating and monitoring of systems with limited resources available.	Understands and enforces accountability for updates and maintenance of the register of data assets. Resources for maintenance are not fully allocated.	Updates and maintenance for the register of data assets are fully resourced. Understanding use of the register is embedded across the organisation.
94	Maintaining awareness of data legislation within senior leadership.	Leadership	Board and senior management are aware of relevant legislation but may not be confident in applying this to their organisation.	Board and senior management are up to date on legislation. They are able to respond to this somewhat consistently in their organisation.	Board and senior management are up to date on legislation and have some awareness of future changes. There is some degree of planning for the future.	Board and senior management keep abreast of future changes in legislation and best practice. They plan for changes across their organisation, but implementation is inconsistent or incomplete.	Board and senior management keep abreast of future changes in legislation and best practice. The organisation is fully prepared for future changes.
95	Creating and enforcing structured responsibility and accountability for data.	Leadership	Only creates structures for responsibility, accountability and oversight for data by default rather than by design. Does not make these structures visible or support staff in understanding their responsibilities for data.	Has structures for responsibility, accountability and oversight for data in place, however the implementation of this is not well understood. Monitoring and enforcement of policy is inconsistent.	Leaders monitor adherence to data and analysis policies and processes and enforce where necessary.	Leaders are invested in ensuring that responsibility, accountability and oversight for data is structured, maintained, and enforced.	Has transparent and well-communicated structures for responsibility, accountability and oversight for data across the organisation. Leaders ensure that staff have a clear understanding of how this relates to their own work.
96	Defining oversight and responsibility for ensuring staff have necessary data skills.	Skills	Does not have structures of responsibility for developing data and analytical literacy in the organisation. There is no oversight from leadership to develop data and analytical skills in the organisation.	Skills to be responsible for data are being developed in specific areas. Some interest in developing data and analytical literacy skills, but oversight and organisation of this is limited.	Defines and enforces responsibility within senior leadership for development of data skills across the organisation. Some skilled data people in other roles, though perhaps with limited capacity to fulfil the task.	A senior person or team brings organisation-wide data together. Development of data and analytical skills has oversight and sponsorship at a senior level.	High levels of commitment to developing data and analytical skills from staff at senior, specialist, technical, and administrative levels.
97	Assigning ownership and responsibility for data tools and systems.	Tools	Holds a minimal record of some tools used or owned by the organisation. Any records are usually collected indirectly without organisation or coherent structure. Only creates structures of responsibility for maintaining and updating tools by default rather than by design.	An inventory of tools and systems (including hardware, software, licence, passwords and access) is managed and maintained. Ownership and responsibility for tools and systems is not consistently recorded.	Formal responsibility for data and analytics tools is established, however this is not well monitored or visible across the organisation. Staff do not understand how these structures relate to their work.	People are formally responsible for managing the storage, cleaning and maintenance, security, and backup of all data. Where possible this is becoming routine and/or automated.	Ownership, oversight and support for all tools is documented. Accountability and responsibility for tools is transparent and visible across the organisation. Staff understand how these structures relate to their work.

6. Legal notices

© Crown copyright, 2023

Licensed under the Open Government Licence v3.0 except where otherwise stated.

Provenance

This Data Maturity Assessment Framework has been adapted from the Data Orchard Data Maturity Framework.

The Data Orchard Data Maturity Framework by Data Orchard CIC is licenced under CC BY-NC-SA 4.0

Licence

This work is licensed under the Creative Commons Attribution-NonCommercial-ShareAlike 4.0 International License.

Creative Commons, PO Box 1866, Mountain View, CA 94042, USA.

The licence allows:

Sharing, copying and redistributing the content.

Adapting - remixing, transforming, and building upon the material.

NB. For the purposes of use in government, please contact CDDO (datamaturity@digital.cabinet-office.gov.uk) before making changes to this Framework.

Under the following terms:

• Attribution — You must give appropriate credit, provide a link to the licence, and indicate if changes were made. You may do so in any reasonable manner, but not in any way that suggests the licensor endorses you or your use.
• NonCommercial — You may not use the material with the primary purpose of commercial advantage or monetary compensation.
• ShareAlike — If you remix, transform, or build upon the material, you must distribute your contributions under the same licence as the original.
• No additional restrictions — You may not apply legal terms or technological measures that legally restrict others from doing anything the licence permits.

7. Acknowledgements

The work of the Data Quality Hub at the Office for National Statistics in leading the development and testing of the DMA on behalf of government is gratefully acknowledged.

Contact

Central Digital and Data Office, Cabinet Office

datamaturity@digital.cabinet-office.gov.uk