Our 2024/25 implementation plan prioritises balancing value delivery with foundational development. It's crucial to avoid overemphasis on fixing foundations at the expense of quick value delivery or prioritising value without building sustainable capabilities.
Our approach focuses on laying groundwork to grow our data maturity, while delivering impactful data and analytics projects that support funded transformation programs – a balanced approach.
Measurably growing our data maturity
Our implementation plan for 2024/25 includes activities that focus on growing our data maturity compared to the data maturity score in 2023. To support the achievement of this goal, we intend to explore activities in four foundational areas during 2024/25:
- Data operating and delivery model
- Data management and data governance
- Data literacy and culture
- Data and analytics platform
Data operating and delivery model
Our operating model will set out how we include our strategy in our day-to-day operations. It will serve as a blueprint for our people, establishing clear accountabilities for data decisions that align to our corporate governance processes. It will make the connections between supporting analytical teams clear and outline the processes that support collaboration between them. It also needs to outline how we will be dynamic with our delivery, and how we will remain flexible with the changing needs of the organisation. Finally, we will ensure we have the talent skills and capabilities we need to succeed now and in the future. Our workforce plans within our operating model will outline how we deliver on this.
It is important that we keep our colleagues and our customers informed on progress as we embark on our data strategy journey. We want to showcase the benefits of our deliverables and allow the opportunity for challenge and feedback. To do this, we intend to consult with our partners and customers on an ongoing basis to understand their data needs, and to consider how we can make our data available to those that need it.
During 2024/25, we will take the following actions:
- Understand, design, and implement a viable target operating model. This will demonstrate how we will deliver what we have set out in our strategy. It will include roles, accountabilities, project prioritisation processes, and the resources and skills required to achieve our goals.
- Establish a communications plan that ensures that we keep everyone informed of the progress we are making. Our communications will serve as a tool for transformation, supporting the drive for the behavioural changes necessary to realise our vision. This includes a shift in our risk appetite towards data sharing, embracing an open and transparent approach.
- Implement feedback mechanisms for receiving internal and external feedback throughout the strategy lifecycle. This will ensure our plans maintain a focus on what our customers need, not what we think they need.
Data management and data governance
Implementing and enforcing relevant policies and standards, as part of a solid data governance and data management framework, will help us to have a greater confidence in our data. It will ensure that data remains understandable, available, secure, reliable and ultimately trustworthy when we use it to make decisions.
However, compliance with them is everyone’s responsibility. We want to create a network of colleagues that champion this thinking, and inspire others to follow good data management practices that lead to better quality data.
Knowing the data we have is a key focus during 2024/25. Having a clearer understanding of our data assets will allow us to manage our data more effectively. We will focus internally and listen to customer feedback. But also explore how we provide greater visibility and understanding of the datasets we publish to our website so that they become more accessible and usable.
During 2024/25, we will take the following actions:
- Identify a core set of data standards and policies that will sit at the foundation of a future data governance framework. The availability of clear, accessible data policies, supported by appropriate governance, will help us protect the integrity of our data and ensure we are using it in a consistent way. This in turn fosters improved data quality and consistency throughout our organisation.
- Explore how we can introduce data stewardship into our organisation, possibly by extending the already well-established information management roles. Those holding data governance roles ensure data is secured and protected during processing and analysis, and is used ethically. We will look to kickstart our data governance initiative by focusing on key business concepts and creating a business glossary to drive consistency for how we record and categorise data.
- Begin work on an enterprise data catalogue, providing a valuable resource for colleagues to understand what data we have, where it resides, and how they might access it.
- Implement robust processes for managing the data and datasets that we publish on our website, and explore how we can support users with identifying datasets by implementing a searchable catalogue.
Data literacy and culture
Empowering colleagues with the right data skills and knowledge enables wider opportunities to meet business objectives through the clever use of data and analytics. Improved data literacy within our organisation will also help us strengthen good data governance and data management practices and understanding.
We will focus on only one or two topics in 2024/25 so that we can evaluate and refine different approaches for educating colleagues ahead of a wider rollout in subsequent years. Focusing on the topic of data ethics, and helping colleagues understand the importance of transparency, fairness, and accountability when managing and sharing data, directly supports our ambition to increase our data maturity level in this area.
A positive data culture within our organisation presents the opportunity for sparking new data innovation. By supporting existing data communities of practice in the business, we can help to bring our talented colleagues together to share their knowledge and work collaboratively to solve key business challenges.
In 2024/25, we will take the following actions:
- Launch a new internal data literacy initiative – the ICO Data Academy. We will take an ongoing steer from our internal Data Analyst Network (DAN) on topics and skills that require the most support. But we will focus on improving awareness of data ethics, and data visualisation (using a business intelligence tool in widespread use across our organisation).
- Continue to grow and develop the DAN to showcase the value of data and inspire and attract new and innovative uses of data across our organisation. We will encourage colleagues to share success stories to inspire others, to work collaboratively and share knowledge wherever possible.
Data and analytics platform
A single data and analytics platform for the organisation will enable us to bring together data from our various siloed systems. It will also enable us to apply consistent data management and governance approaches, and make it securely available for colleagues to use in the most effective way. This centralisation and availability of data can allow colleagues to self-serve and more readily access the data they need to gain insight and make decisions. It can also mean shorter times for our data analysts to deliver value, as the work to prepare the data they need will have already been done for them.
The establishment of a central platform will require careful design and planning, and support and expertise from across several teams within our Digital, Data and Technology function.
We are also keen to explore how we can start using advanced analytics (such as artificial intelligence, AI) to drive value. But we are aware that these approaches often require more sophisticated technology and services to develop than what we have at present.
Therefore, in 2024/25, we will take the following actions:
- Begin our journey of establishing a ‘single source of truth’ for data and analytics within our organisation by identifying and designing a suitable platform. A scalable, resilient, secure and cost-effective data platform, that aligns with business operations and delivers standardised capability, can help us accelerate the development of solutions that deliver value.
- Our ‘platform’ will include consideration of appropriate services that support the development of advanced analytics outputs (eg AI, deep learning), and components that enable self-service capabilities for colleagues.
Delivering tangible value from data and analytics for us and our customers
We will look to demonstrate our developing data maturity and capability through a series of projects that focus on key business challenges. We will take a “learn fast” approach to delivery, and will rapidly move through discovery, proof of concept, minimum viable product (MVP), full solution, support, evolve, recycle or retire phases.
The nature of such an approach requires a high degree of agility and flexibility in selecting, iterating and potentially pivoting based on testing and feedback. Accordingly, the roadmap of projects will remain dynamic.
To support the achievement of our data vision and this goal, we intend to focus on three areas:
- Regulatory effectiveness
- Data protection fee income
- AI and automation
Regulatory effectiveness
We want to explore new data and analytical solutions to support more informed regulatory decisions and ensure our finite resources focus on the areas of greatest impact.
An example here being the consolidation of key information that relates to a single organisation but resides across several systems. The integration of similar data into a single interface can provide colleagues with a consolidated and comprehensive view of an organisation, enabling quicker decision making, and increasing productivity.
Organisation 360°
We want to harness the power of data to deliver our mission – “to empower people through information”. An integrated view of the organisations we regulate will establish a single source of truth and pave the way for evidence-based decision making.
Data serves as a key enabler in achieving this goal, where data elements that could be useful for providing a 360° view of an organisation reside in different systems. By bringing together, or integrating, this data into a single platform, and making it available to those who need it in a secure way, we can begin to realise the opportunities offered by a single view. We envisage this will support those colleagues working within our casework, audit, registrations and regulatory environment teams particularly. It will help them leverage this information to support data-led decision making, which in turn enables swift response to emerging threats.
Additionally, we will explore how we can augment the data platform, and our organisation 360° view, by including new external datasets that may have value. This includes establishing new partnerships and data-sharing agreements with organisations across the regulatory landscape.
Data protection fee income
We want to improve our understanding of organisations that must register with us so that we can make our fee campaigns more efficient, accurate, and effective.
Optimising fee-related communications with our customers
We will explore how we might lean on analytical approaches used by organisations across other sectors, to test and evaluate the optimal way of raising awareness of fee eligibility with organisations.
By understanding which approaches are most effective, we can make our communications clearer to our customers and increase the number of organisations registered with us.
We can also use this opportunity to share more information about the services we offer that our customers can also benefit from.
AI and automation
We want to free up colleagues so they can concentrate on high-value work areas. We plan to do this by integrating AI and other emerging technologies into administrative tasks.
We will take a fully responsible approach when exploring AI innovation. Whilst we will seek to fully understand any ethical, security or legal implications before commencing any development work, we will remain curious and daring with our stance. We don’t want to lose the opportunity to fully embrace the capabilities offered by these new emerging technologies that could benefit how we serve our customers.
Automating data protection fee exemption processes
Every organisation or sole trader who processes personal information needs to pay a data protection fee to us, unless they are exempt. Organisations are able to self-assess whether they are eligible for paying the data protection fee via our website.
Previously, when an organisation informed us they were exempt from paying the fee, we carried out a number of manual and laborious checks to confirm it was indeed ineligible for payment.
Through the recent introduction of new automated processes, we have been able to substantially reduce the manual effort required to support our exemptions processes. This has allowed our colleagues to devote more time to supporting our customers. Automated processes have also supported improvements to our data quality, ensuring we are able to deal with new exemption requests quickly and efficiently.
We have also been able to provide our teams with improved management information tools providing greater visibility in support of data-led decision making.
How will we know if we have been successful
We will be able to determine whether our outputs are adding value and benefit to our organisation and our customers in several ways:
- An improvement in our data maturity score. We will repeat the data maturity assessment process at the end of 2024/25 to evaluate whether our outputs have made a positive impact on our level of data maturity. We will track progress via a new scorecard:
- Project 1: Data operating and delivery model
| Objective | Key activities |
| Engaging with others: improve from emerging to learning state | Implementing feedback mechanisms |
| Setting your data direction: improve from emerging to learning state | Aligning our data strategy with wider organisational objectives |
-
- Project 2: Data management and data governance
| Objective | Key activities |
| Engaging with others: improve from emerging to learning state | Implementing data catalogues to better understand our data |
| Knowing your data: improve from beginning to learning state | Creating a register of critical datasets Introducing standardised data governance processes and artefacts (eg metadata) and considering data disposal and retention |
| Managing your data: improve from emerging to learning state | Implementing a data governance framework |
| Protecting your data: improve from learning to developing | Improving our security controls |
| Taking responsibility for data: keep learning state | Defining ownership for critical datasets |
-
- Project 3: Data literacy and culture
| Objective | Key activities |
| Engaging with others: improve from emerging to learning state | Exploring new and innovative uses of data via the DAN |
| Having the right data skills and knowledge: keep emerging state | Building and launching a new ICO data academy |
| Managing and using data ethically | Supporting awareness of data ethics via the ICO data academy |
-
- Project 4: Data and analytics platform
| Objective | Key activities |
| Having the right systems: keep emerging state | Implementing data catalogues to better understand our data |
-
- Data and analytics value projects
| Objective | Key activities |
| Making decisions with data: keep emerging state | Enabling data-led decision making in the areas of regulatory effectiveness, data protection fee income, and AI and automation |
- Delivery of solutions that support key transformation initiatives across our organisation. This includes indicators of increased productivity and efficiency, particularly where we have been able to implement AI or intelligent automation leading to more efficient ways of working.
- Sustained employee retention within the Data Team, and a growth in the number of colleagues participating in data and analytics forums, such as the DAN.