Safety Norms: Data Science and Business Analytics

1Purpose, Scope, and Safety Principles

These norms guide how analysts, data scientists, data engineers, and business stakeholders plan, build, and communicate analytical work. Their purpose is to prevent harm to individuals whose data is used, to decision makers who rely on outputs, to the organization's finances and reputation, and to staff who handle data and systems. The scope covers exploratory analysis, dashboards and reports, predictive and machine learning models, experiments, data pipelines, and the presentation of findings to executives or customers.

Three principles apply throughout. Minimize data: collect and retain only what a defined purpose requires. Validate before use: no output informs a consequential decision until its inputs, method, and limitations are documented and reviewed. Least privilege: access to data and tools is granted only for assigned work.

• Mandatory: no production data is copied to personal devices, personal cloud accounts, or unapproved tools.
• Recommended: review these norms at the start of each project so the team agrees on the applicable rules.

2Roles, Competence, and Accountability

Accountability should be written down for every project. A project sponsor owns the business question and accepts the residual risk of decisions made from results. A data owner approves access to the datasets they are responsible for. A privacy lead or data steward reviews personal and sensitive fields. A model owner or analytics lead signs off methods and documentation. A security contact approves tools and connections. Where one person holds several roles, the conflict should be recorded and a second person should review the work.

Competence is required before access. Staff should complete role-appropriate training in data handling, privacy, and information security before receiving access to restricted data. Work that affects credit, employment, insurance, healthcare, or other regulated decisions requires documented authorization from the responsible owner and, where applicable, review by qualified specialists such as legal, compliance, or clinical reviewers. Untrained staff must not deploy models into production or alter regulated reports.

• Mandatory: every analysis that informs a consequential decision must name an accountable owner in the project record.
• Recommended: maintain a register of who holds access to each restricted dataset, reviewed at least quarterly.

3Hazards and Risk Assessment

Analytics hazards are mostly informational, behavioral, and organizational rather than physical. Realistic hazards include unauthorized disclosure of personal or confidential data through shared notebooks, exported files, email, or misconfigured cloud storage; reidentification of individuals from datasets that were only partly anonymized; biased training data or proxy variables that disadvantage protected or vulnerable groups; models that drift after business conditions change; flawed joins, duplicate counts, or time zone errors that produce wrong figures; and dashboards that present estimates as certainties.

Assess each project before work starts. Rate likelihood and impact on a simple low, medium, and high scale and combine them into a documented risk rating. Projects rated high, including those using sensitive personal data or automated decisions about people, require formal review by privacy, security, and the model owner before data extraction or deployment. Record assumptions, data sources, known gaps, and the decision the output will support.

Physical hazards exist but are modest: prolonged screen use, poor workstation ergonomics, electrical equipment in server rooms, and lifting heavy hardware. Manage these under the general workplace health and safety program and verify local requirements with the relevant authority.

• Example: a churn model trained on customer records that include health-related notes is high risk because it processes sensitive data and influences how customers are treated.
• Example: a sales dashboard that double counts refunds is medium risk, but becomes high risk if executives use it to set commission payments.

4Preventive Controls and Safe Working Practices

Preventive controls should be built into the workflow rather than added at the end. Use separate environments for development, testing, and production. Test data should be synthetic or masked wherever the analysis allows it. Code and queries must be kept in version control, and peer review is required before any metric or model used for decisions is published or deployed.

Data handling norms require masking or removing direct identifiers before analysis unless an identifier is essential and approved. Aggregate results to avoid small group counts; many organizations suppress groups below an agreed minimum, and the privacy lead should set that threshold. Do not join datasets in ways that could identify individuals without privacy review.

Model and metric norms require documentation of purpose, data lineage, features, validation method, performance measures, known limitations, and fairness checks. Validate on held-out data and, where feasible, on a recent time period. Monitor deployed models for drift and define a rollback plan before launch. Reproduce key results independently before executive use.

Communication norms require every chart to state the sample size, date range, exclusions, and confidence or uncertainty where relevant. Do not present correlation as cause without supporting evidence. Label estimates as estimates and state what the output cannot tell the decision maker.

• Mandatory: no personal or confidential data is entered into public or unapproved generative AI tools unless the organization has approved that service for that data class.
• Mandatory: production credentials are never stored in notebooks, scripts, configuration files, or shared documents.
• Mandatory: automated decisions affecting individuals require a documented human review or appeal path where policy or law requires one.
• Recommended: compare error rates across relevant groups before deployment and record any material gaps.
• Recommended: schedule peer review of dashboards before they reach leadership.

5Equipment, Environment, Information, and Protective Safeguards

Use managed company devices with full disk encryption, automatic screen locking after a short idle period, and current security patches. Store restricted data only in approved storage locations. Keep workstations and server equipment in ventilated, temperature-controlled spaces, and ask facilities to confirm cooling and power capacity before adding hardware. Keep drinks away from equipment, use proper cable management, and adjust monitor height and seating to reduce strain during long sessions.

Classify data into levels such as public, internal, confidential, and restricted, and map each level to required controls. Enable multifactor authentication on all analytics platforms. Review sharing permissions at least quarterly. Delete data from scratch spaces and temporary folders at the end of each project according to the retention schedule.

Privacy, data protection, consumer protection, and sector rules differ by jurisdiction and may govern collection, consent, retention, cross-border transfers, and automated decisions. Verify current requirements with qualified legal or privacy counsel. Vendor and data provider contracts may impose further restrictions that override internal convenience.

• Mandatory: restricted data is never moved outside approved systems or borders without written approval from the data owner and privacy lead.
• Recommended: maintain a data source catalog listing owner, classification, legal basis or consent status where applicable, and retention period.

6Incident Reporting, Emergency Response, and Escalation

Report incidents immediately. Incidents include suspected data exposure, lost or stolen devices, shared credentials, an analysis error discovered after a decision was made, a model producing harmful outputs, and near misses such as an email sent to the wrong recipient. Notify the security contact and your manager right away, then complete the internal incident form. Do not delete evidence, attempt to recall data on your own, or investigate beyond your authorization.

Suspected personal data breaches may trigger time-sensitive legal obligations, so the privacy and legal teams must be informed at once. Where a flawed analysis is already influencing a decision, the model owner should recommend a pause, rollback, or correction, and the sponsor should decide the response. Communicate with affected stakeholders only through approved channels.

If someone experiences a medical emergency or a fire, smoke, or electrical fault occurs in a server room, evacuate and call local emergency services. Do not enter areas with smoke, standing water, or exposed wiring. Follow building emergency procedures and report to the designated assembly point. Data recovery always comes after life safety.

• Mandatory: report suspected data exposure to the security contact within the timeframe set by the incident response policy and applicable law.
• Recommended: hold a short blameless review after significant incidents and record corrective actions with owners and due dates.

7Records, Training, Monitoring, and Review

Maintain records for each project, including the risk assessment, data inventory, approvals, validation results, deployment decisions, monitoring reports, and incident logs. Retain records for the period required by policy and applicable law, and dispose of them securely. Keep documentation versioned alongside code so reviewers can see what changed and why.

Training should be role based and refreshed regularly. Cover privacy basics, secure handling of credentials, responsible use of statistical methods, bias awareness, and communication of uncertainty. Track completion, and use a short assessment or practical exercise to confirm understanding for staff with restricted access.

Review active models and dashboards on a defined schedule, typically at least annually and whenever data sources or business conditions change. Track indicators such as drift, error rates, access anomalies, and incident counts. Feed lessons into updated norms, and invite feedback from analysts and the business teams that rely on their work.

Implementation checklist

• Confirm the accountable owner, data owner, and privacy contact for the project in writing.
• Complete a risk rating and record the decision the output will support.
• Minimize data and remove direct identifiers before analysis begins.
• Work only in approved environments on managed devices with multifactor authentication.
• Never store credentials or restricted data in notebooks, personal storage, or unapproved AI tools.
• Peer review code, queries, and key metrics before reporting or deployment.
• Document validation results, limitations, uncertainty, and fairness checks.
• Report suspected exposures or errors immediately to the security contact and your manager.
• Keep records and delete data according to retention rules.
• Schedule periodic review of models, dashboards, and access lists.
• Verify applicable laws and standards with qualified professionals in your jurisdiction.