Safety Norms: Data Analytics Applications

1Purpose, Scope, and Safety Principles

These norms set out how learners, instructors, analysts, and supervisors must handle the people, data, tools, and environments involved in data analytics applications. The aim is to prevent harm to individuals whose records are analyzed, to protect organizations from security and compliance failures, and to stop flawed analysis from driving unsafe decisions. The norms apply to coursework, laboratories, capstone projects, and any workplace activity that uses analytics tools on operational or personal data.

Three principles guide the rules. First, collect and use only the data needed for a defined purpose. Second, verify before acting on any result. Third, report problems early, because a near miss in data handling is a warning that a control needs repair. Personally identifiable information means any data that can identify a person directly or in combination with other data. A model is a mathematical procedure fitted to data to make predictions or classifications.

• MANDATORY: Do not begin an analysis without a documented purpose and an approved data source.
• RECOMMENDED: Keep a short written project brief that states the question, the audience, and the expected use of results.

2Roles, Competence, and Accountability

The data owner approves the purpose, classification, and retention period for each dataset. The project lead ensures that analysis follows the approved scope and that results are reviewed before release. Analysts perform data preparation, modeling, and visualization only within their authorized access level. The security or information governance contact approves access requests, reviews exceptions, and investigates suspected breaches. Instructors or supervisors confirm that each learner or staff member has completed required training before live or sensitive data is used.

Competence is not assumed from a job title or course enrollment. Before working with restricted data, a person must complete the organization's data handling training, sign an acceptable use agreement, and receive written authorization. Anyone using production systems or regulated health, financial, or education records needs supervised practice first. Where a task requires a formal professional credential or license, the organization must verify it before assignment. This guidance does not create or confirm any certification.

A learner may question an analysis, but only the project lead may approve publication of results that affect a real organization. Anyone who sees a control being bypassed must stop and report it, even when deadline pressure is high. Written delegation records should show who can approve exceptions and for how long.

• MANDATORY: Access to restricted data requires written authorization from the data owner, renewed when roles change.
• MANDATORY: Shared accounts and borrowed credentials are prohibited.
• RECOMMENDED: Assign a named backup for each data owner and project lead so approvals are not delayed.

3Hazards and Risk Assessment

Realistic hazards in this subject fall into five groups. Privacy hazards arise when records are copied into unapproved tools, shared in email, or re-identified by combining datasets. Security hazards include stolen credentials, unpatched notebooks, exposed cloud storage, and malicious macros in shared spreadsheets. Quality hazards include biased samples, incorrect joins, leaked training data, and charts that mislead decision makers. Ergonomic and environmental hazards include long periods of screen work, poor lighting, and cable trips in shared rooms. Operational hazards include overloaded database servers and runaway queries that affect other users.

Each activity should be rated before work starts. Use a simple matrix: likelihood (rare, possible, likely) multiplied by impact (minor, serious, severe), giving a rating of low, medium, or high. Any dataset containing personal, financial, health, or children's information is at least medium risk. High-risk work, such as automated decisions affecting people's access to services, requires documented review by a qualified reviewer before deployment. Risk ratings must be recorded and revisited when data sources, tools, or audiences change.

• Example: A learner downloads a customer export to a personal laptop to finish a dashboard. Rating: likely by serious, high. Control: work only in the approved secure workspace and request a masked extract.
• Example: A chart shows a sales drop because a join silently removed unmatched records. Rating: possible by severe, high. Control: reconcile row counts before and after each join.
• Example: A model flags applicants from one postcode at twice the normal rate after a training set omitted recent records. Rating: possible by severe, high. Control: fairness testing across groups and a documented review before any decision use.

4Preventive Controls and Safe Working Practices

Start every project with data minimization. Remove direct identifiers, aggregate where possible, and use the smallest sample that answers the question. Pseudonymization replaces identifiers with codes, but the key must be stored separately with restricted access. Pseudonymized data is still personal data in many jurisdictions. Do not attempt to re-identify individuals, even for testing. Store all work in approved environments with logging enabled, and use version control for code and queries so changes are traceable.

Before analysis, profile the data. Check ranges, missing values, duplicates, and time zones. Record every transformation. Before publishing, validate results against an independent calculation or a known baseline, and state assumptions and limitations on the same page as the result. For models, separate training and test data, document the features used, and test outputs across relevant groups for unfair error patterns. Do not deploy a model that affects people without approved review.

When working with pipelines or large datasets, set resource limits and alerts so a faulty job cannot exhaust shared capacity or write duplicate records to production tables. Test changes on a copy using masked or synthetic data before any change touches live tables. Keep a documented rollback step for every scheduled job and place production changes behind a change request.

• MANDATORY: Do not paste restricted data into public or unapproved AI or cloud tools.
• MANDATORY: Do not email extracts containing personal data; use the approved sharing location with expiry settings.
• MANDATORY: Lock the screen when leaving a workstation, even for a short break.
• MANDATORY: Check data size and schedule long or resource-heavy queries on approved systems only.
• RECOMMENDED: Peer review each dashboard or model before it is shared outside the team.
• RECOMMENDED: Delete temporary files and local copies at the end of each work session.

5Information, Privacy, Security, and Environmental Safeguards

Information safeguards rest on least privilege, multi-factor authentication where the system supports it, encryption in transit and at rest, and regular patching of notebooks, libraries, and database clients. Credentials must not be stored in code, notebooks, or screenshots. Privacy duties depend on jurisdiction. Laws such as the EU General Data Protection Regulation, US state privacy statutes, and sector rules for health or education records set obligations on lawful basis, retention, transfer, and individual rights. Confirm the current applicable version with your privacy officer or legal counsel. This document does not state legal requirements.

Environmental and ergonomic controls apply to people at screens and to shared labs. Position monitors at or just below eye level, keep wrists supported, and take regular short breaks; the organization should set the schedule in its own policy. Keep walkways clear of cables and bags, and limit glare on screens. Electrical equipment must be inspected under local electrical rules, and damaged chargers or power strips must be removed from use. Server rooms must be locked and kept within temperatures set by the facility operator.

• MANDATORY: Report lost devices or media immediately; do not wait to confirm whether data was on them.
• MANDATORY: Use only approved, encrypted removable media, and only with written authorization.
• RECOMMENDED: Use an ergonomic assessment checklist provided by the facilities or occupational health team.

6Incident Reporting, Emergency Response, and Escalation

Any suspected data breach, misdirected email, lost device, unauthorized access, published error with material impact, or near miss must be reported to the project lead and the security or privacy contact within the period set by organizational policy. Do not delete logs, shut down systems to hide activity, or conduct a personal investigation. Preserve evidence, record what happened and when it was discovered, and cooperate with the response team. Where a regulator notification deadline may apply, the privacy officer decides the response, and time limits vary by jurisdiction and must be verified.

Emergency readiness covers both cyber and physical events. Keep current contact lists for security, facilities, and IT. In a suspected active intrusion, isolate the affected device only if the response plan directs it, and call the security team. For fire, medical emergency, or electrical hazard in a lab or server room, follow building emergency procedures and contact local emergency services. Analysts are not expected to give first aid beyond their training or to repair electrical faults.

After containment, the project lead should prepare a short written account: the data involved, who had access, which controls failed, and what corrective action is assigned with a named owner and due date. Corrective actions must be checked, not just recorded. Affected individuals and decision makers should be informed only through approved channels.

• MANDATORY: Report suspected incidents within the period set by policy, and sooner if the situation is serious.
• MANDATORY: Escalate to the data owner when a result already shared is found to be wrong.
• RECOMMENDED: Run a tabletop exercise on a realistic scenario such as a leaked extract, at a frequency set by the organization.

7Records, Training, Monitoring, and Review

Keep records that let someone else reproduce and check the work: data source and version, access approvals, transformation logs, code, validation results, review sign-offs, and retention decisions. Retain records only as long as the approved schedule requires, then delete them securely. Refresh training when tools, laws, or organizational policies change, and require a short data handling refresher before each new project.

Monitor compliance through periodic access reviews, audit log checks, sampling of dashboards for accuracy, and review of incident trends. Useful indicators include access exceptions, overdue access reviews, dashboards corrected after publication, and time taken to close corrective actions. Owners should discuss these figures openly rather than use them to punish individuals for honest mistakes. Review these norms at least once a year and after any significant incident or change in law, tools, or course structure. Local procedures should be written from this framework and approved by the responsible authority before use.

• MANDATORY: Maintain an access register showing who can use each dataset and when access was granted.
• RECOMMENDED: Track near misses separately from incidents so patterns are visible early.

Implementation checklist

• Confirm a documented purpose and approved data source before starting any analysis.
• Remove direct identifiers and use the smallest dataset that answers the question.
• Work only in approved environments; never copy restricted data to personal devices or unapproved tools.
• Record every transformation and reconcile row counts after each join.
• Validate key results against an independent calculation before sharing.
• Lock your screen, use multi-factor authentication where available, and never share credentials.
• Report suspected breaches, lost media, and wrong results to the project lead and security contact promptly.
• Verify current laws, standards, and internal policies with your privacy officer or qualified professionals.
• Review access rights and these norms at least once a year or after any significant change.