What is data man­age­ment? Sensible data handling

Data man­age­ment is a rel­a­tive­ly new field within in­for­ma­tion tech­nol­o­gy, emerging in response to growing con­nec­tiv­i­ty and the ever-in­creas­ing flood of data in modern busi­ness­es. The topic has also become a focus of research. Data science, in par­tic­u­lar, is a young dis­ci­pline dedicated to the sensible storage and in­te­gra­tion of data, as well as efficient methods for searching through large datasets.

De­f­i­n­i­tion of data man­age­ment

Data man­age­ment defines clear re­quire­ments for handling digital in­for­ma­tion and refers to a process rather than isolated actions. Data should be sys­tem­at­i­cal­ly organized right from the point of col­lec­tion and entry. Data min­i­miza­tion and quality are key aspects to keep in mind. In addition to safe­guard­ing the content, the data must remain practical and usable for its intended purpose. Another important con­sid­er­a­tion is de­ter­min­ing which data should be archived and for how long. Any data that is no longer needed must be easy to locate and securely deleted without delay.

Types of data

When de­vel­op­ing a data man­age­ment plan, begin by iden­ti­fy­ing the different types of data your business produces. Cat­e­go­riz­ing this in­for­ma­tion allows you to work in a struc­tured way and ensures that no important area is over­looked.

• Personal data: In­for­ma­tion that directly relates to specific in­di­vid­u­als; classic examples include names, phone numbers, and addresses. Mea­sure­ment data and shopping habits are also included. It can involve customer data, data of one’s own employees, or third parties. This data requires special pro­tec­tion.
• Protected company data: Internal company in­for­ma­tion such as ac­count­ing data, tax documents, and trade secrets; every company naturally has a keen interest in handling this data carefully. However, it’s quite sensible to define what in­for­ma­tion belongs to this area as part of data man­age­ment.
• Secondary data: Data generated for a different purpose during an action; an example would be video sur­veil­lance, which is typically installed for pro­tec­tion against burglary and theft. This might also record customer vehicle license plates. Another example is log files in a company network that might store visitors’ IP addresses.
• Public data: In­ten­tion­al­ly published and dis­trib­uted data; this includes in­for­ma­tion on the website and in company brochures. It’s important to comply with copyright reg­u­la­tions and protect your own data, such as published images, ad­ver­tis­ing slogans, and company logos. The latter can be protected under the Design Act (formerly the Design Patent Act).

Tasks and im­ple­men­ta­tion of data man­age­ment

The role of data man­age­ment is to integrate all processes from data col­lec­tion to storage or deletion, with a focus on ef­fi­cien­cy. It takes into account the entire “lifetime” of the data — the concept behind Data Life Man­age­ment (DLM).

Data col­lec­tion

Data pro­cess­ing begins with data col­lec­tion. Two aspects play a central role here:

1. Data min­i­miza­tion. Only the necessary in­for­ma­tion should be collected. This oblig­a­tion is now es­tab­lished in the General Data Pro­tec­tion Reg­u­la­tion (GDPR) should your company do business in the EU. There are also many state laws that govern data col­lec­tion, such as the CCPA (Cal­i­for­nia Consumer Privacy Act). Data can only be processed if the in­di­vid­u­als concerned have given their consent or if it is necessary for legal reasons, such as contract drafting.

2. Data quality: Carefully capturing data saves un­nec­es­sary queries and rework. The in­for­ma­tion should also be stored in the format in which it will later be needed. Any transfer or con­ver­sion can lead to errors in the data inventory.

Data storage

The selection of the storage location and format is important. As a storage location, a backup in cloud storage alongside local storage is a good idea. Both solutions have pros and cons, so a combined solution is advisable for very important data:

For large amounts of data, databases are the preferred choice for storage. If spe­cial­ized software is used, such as for ac­count­ing or inventory man­age­ment, the question of storage location generally doesn’t arise. However, for the latter, attention should be paid to com­pat­i­bil­i­ty with external systems and export options, such as the GOBD interface for audits by the IRS.

Data security

Data security is a critical and complex part of data man­age­ment. Data should be protected from loss, unau­tho­rized changes, and unau­tho­rized access. The National Institute of Standards and Tech­nol­o­gy (NIST) offers com­pre­hen­sive guidance, including the con­tin­u­al­ly updated Cy­ber­se­cu­ri­ty Framework that outlines potential threats and best practices. In addition to iden­ti­fy­ing risks, it provides process-based rec­om­men­da­tions for securing systems and data. The framework is free to access, and many cer­ti­fi­ca­tions — such as ISO 27001 — align with its prin­ci­ples.

Possible threats are:

• Hardware damage due to fire, water, or power surge
• Data loss due to improper operation
• Data loss or system mal­func­tion due to malware (ran­somware, data theft)
• Data loss due to software errors
• Loss due to theft

To address the various risks, solutions include not only software-based pro­tec­tion mech­a­nisms but also or­ga­ni­za­tion­al measures such as fire and burglar alarm systems.

Keep these prin­ci­ples in mind:

• Regular updates: Consider the pros and cons of automated versus manual updates. Automated updates have the advantage of running con­sis­tent­ly without being forgotten, while manual updates reduce the risk of faulty in­stal­la­tions.
• Secure passwords: There are various strate­gies to consider here. One effective approach is to set guide­lines requiring employees to use complex passwords. Regular password changes are also rec­om­mend­ed. However, placing too much emphasis on com­plex­i­ty and frequent changes can backfire, leading employees to write passwords down and leave them at their workspace.
• Antivirus/Firewall: Current antivirus pro­tec­tion is essential for any IT system. Depending on the com­plex­i­ty of the network, it may be advisable to use a firewall and, if needed, an Intrusion Detection System (IDS).
• Backup strategy: One of the most important aspects is un­doubt­ed­ly the proper backup strategy. Relevant data should be thor­ough­ly and regularly backed up on media located in different places. A par­tic­u­lar challenge is backing up databases. It may not be possible to simply copy open files during operation. Instead, backups must be performed from within the ap­pli­ca­tion used or by using spe­cial­ized software like MySQL Dump.

Data pro­tec­tion

Data pro­tec­tion is to be dis­tin­guished from data security, although there are overlaps. The goal here is simply to ensure that unau­tho­rized persons have no access to con­fi­den­tial data. Data pro­tec­tion includes the following areas:

1. Prevent external access: This requires data security measures

2. Restrict internal access to personal data: This requires a per­mis­sions man­age­ment system in the software used. This way, in­di­vid­ual employees are denied access or data sets are only partially displayed. Ad­di­tion­al pro­tec­tion is provided by encrypted trans­mis­sion and storage of data. This ensures that sensitive data is protected from hardware access, such as during a break-in or by unau­tho­rized employees.

Company re­quire­ments

Data man­age­ment must be as practical and intuitive as possible within business processes. This ensures the best ac­cep­tance among employees and the greatest ef­fec­tive­ness. Some of the outlined goals are also sensible regarding ef­fi­cien­cy im­prove­ment. Gathering un­nec­es­sary data wastes time and could annoy customers. The organized and secure storage of data enhances pro­duc­tiv­i­ty.

It may therefore be ben­e­fi­cial for a company to implement a data gov­er­nance policy that es­tab­lish­es how data should be handled within the company. This par­tic­u­lar­ly concerns data quality and potential im­prove­ments through aids like au­to­cor­rec­tions. Ad­di­tion­al­ly, con­sis­tent ter­mi­nol­o­gy and terms are defined.

Archiving

Archiving data that is not currently needed is also an important re­spon­si­bil­i­ty for companies. This includes in­for­ma­tion that must be retained by law, such as invoices and tax records. For this reason, archiving should be an integral part of any data man­age­ment strategy.

• Separate storage: This reduces the volume of current data backups and ensures data pro­tec­tion.
• Suitable storage medium: Not all storage media are ideal for archiving. For example, hard drives should be powered on regularly to maintain func­tion­al­i­ty. Optical media such as CDs are vul­ner­a­ble to external factors and have a limited lifespan. Tape drives with magnetic tapes offer excellent dura­bil­i­ty and are well-suited for archiving. However, they come with high initial costs for the drives and can be cum­ber­some to handle. On the plus side, the tapes them­selves are in­ex­pen­sive and have a long service life.

Deleting

Data that is no longer needed should be deleted, which also removes the oblig­a­tion to ensure its security. A solid data man­age­ment strategy should therefore make it possible to identify and delete such data sep­a­rate­ly. Personal data, in par­tic­u­lar, must be securely and ir­re­versibly erased.

Deleting with operating system functions typically only makes the data available for over­writ­ing. In fact, they still exist on the hard drive until the storage space is randomly needed and they are over­writ­ten.

Other legal re­quire­ments

In addition to federal and state privacy laws, companies in the U.S. are subject to various reg­u­la­tions that require the pro­tec­tion of personal data. If a failure to safeguard such data leads to misuse, business owners or ex­ec­u­tives can be held liable. Relevant laws and frame­works include:

• Cal­i­for­nia Privacy Rights Act (CPRA)
• Health Insurance Porta­bil­i­ty and Ac­count­abil­i­ty Act (HIPAA) for health-related data
• Gramm–Leach–Bliley Act (GLBA) for financial in­sti­tu­tions

In some countries, a data pro­tec­tion officer must be des­ig­nat­ed if a company reaches a certain size. In the U.S., it is not a universal federal re­quire­ment for private companies, but certain state laws, industry standards, or con­trac­tu­al oblig­a­tions may require one, es­pe­cial­ly for larger or­ga­ni­za­tions or those handling sensitive data.

Types of data man­age­ment

How data man­age­ment is organized depends on the size of each company. Various ap­proach­es to in­te­grat­ed solutions are available on the market. Possible forms include:

• En­ter­prise Resource Planning Systems (ERP): These systems offer the most com­pre­hen­sive approach. All resources of the company are recorded and con­sid­ered. This includes personnel, equipment, and materials. Well-known com­mer­cial vendors are SAP, Sage, Oracle, and Microsoft. However, there are also free software solutions like Odoo and OpenZ.
• Master Data Man­age­ment (Central Master Data Ad­min­is­tra­tion): Cen­tral­iza­tion and revision of a company’s core data. This includes employee data, customer data, and in­for­ma­tion about equipment. The goal is a uniform data quality that leads to improved usability. This approach is usually con­sid­ered in ERP systems.
• Content Man­age­ment Systems (CMS): Pre­dom­i­nant­ly in­for­ma­tion man­age­ment systems, for example, in the form of a central intranet for the company. Due to their great flex­i­bil­i­ty, other aspects like form man­age­ment and the in­te­gra­tion of databases are also possible.
• Document Man­age­ment Systems (DMS): A subset of data man­age­ment. They provide forms and offer functions such as filing and archiving.

Chal­lenges of data man­age­ment

Data man­age­ment is a dynamic process and must be con­tin­u­al­ly adjusted to current re­quire­ments. This results in new chal­lenges each time.

Big data

Data volumes are con­stant­ly in­creas­ing. Con­se­quent­ly, there are high demands on data man­age­ment, es­pe­cial­ly in the following areas:

• Scal­a­bil­i­ty of storage and backup ca­pac­i­ties
• Or­ga­ni­za­tion and find­abil­i­ty of required data
• Data min­i­miza­tion and filtering of important in­for­ma­tion

Security

Network ad­min­is­tra­tors con­stant­ly face new dangers. In­for­ma­tion theft through social en­gi­neer­ing and sabotage via ran­somware are just some scenarios. The more a company digitizes its data resources, the more dependent it becomes on the func­tion­al­i­ty of the system used. Therefore, it’s essential to stay informed about new risks and make prepa­ra­tions for hardware failure or lack of access to their own systems.

Legal re­quire­ments

The in­tro­duc­tion of the GDPR has caused a lot of un­cer­tain­ty and resulted in sig­nif­i­cant effort for companies that do business in the EU. Still, it is not unlikely that further reg­u­la­tions will follow or changes to existing laws will require ad­just­ments. This may also affect the concept of data man­age­ment.

Changes in the company en­vi­ron­ment

Changes in the structure or op­er­a­tions of a company must also be con­sid­ered when it comes to data man­age­ment. Pro­vi­sions can be made for this by using ex­pand­able systems or those that are easy to migrate. Regular employee training on internal data gov­er­nance means ad­di­tion­al effort.