Assessment data policy.
Principles for collection, access, aggregation, publication and responsible framework development.
1. Principles
Assessment data should be handled with purpose limitation, data minimisation, transparency, security, consent-led publication and methodological integrity.
2. Data categories
Potential data include declared subject and scope, domain responses, evidence items and their provenance, evidence period, review status and decisions, framework version, and — in future services — authorised contact or account information.
3. Collection and purpose
Only information necessary to support assessment, improvement planning, authorised collective analysis or research should be collected. New uses require an appropriate legal and ethical basis and clear communication.
4. Where demonstration data is held
In this implementation there is no central store. The Mapper walkthrough keeps responses in the page only, for the life of the tab; they are discarded on reload or restart and are never written to browser storage. The workspace demonstration writes its state to local storage in the user’s own browser, where it persists until deleted through Reset demo data on the workspace Overview page or by clearing site data for the domain. Neither is transmitted to i5Benchmark. Users should avoid entering confidential or personal information in either.
5. Access and sharing
Organisational workspaces are private by default. Organisation-level responses, evidence and findings should be accessible only to authorised parties. They will not be sold, and will not be published by i5Benchmark without appropriate authority and consent.
6. Aggregation and research
Any aggregate analysis must use a disclosed cohort definition, documented inclusion rules, a minimum cohort size, disclosure controls that reduce re-identification risk, and compatible subject type, scope, evidence period, implementation profile and framework version. Aggregates must not be presented as representative beyond their disclosed sample.
7. Publication
i5Benchmark will not publish identifiable organisation results without explicit, documented consent. Comparative outputs must follow the Ranking Policy. Demonstration data must always be labelled as fictional.
8. Quality and versioning
Data should be linked to the framework version, the evidence period, the declared scope, the implementation profile and the review status of each item. Method changes must be documented before results are compared over time.
9. Retention and deletion
Demo data retention is local: Mapper walkthrough data is retained only while the tab is open, and workspace demonstration data is retained in the user’s browser until the user deletes it through Reset demo data or by clearing site data. Any future hosted service must define retention periods and deletion routes proportionate to purpose and legal requirements before it collects centralised responses.
10. Security and incidents
Reasonable technical and organisational measures must protect any hosted data. A future service must define incident response and notification procedures before collecting centralised responses.
11. Contact
Data-governance questions may be sent to hello@sust.in.