Lesson 3.4: Data Governance and Security
Description:
This lesson explains how the ACQF QCP ensures effective data governance and security. It introduces key principles, roles, and technical safeguards that protect data integrity, privacy, and accountability across national and continental levels.
By the end of this lesson, you will be able to:
- Describe the core principles of data governance and their application within the ACQF QCP, including accountability, transparency, and data quality.
- Name key roles and responsibilities in the QCP data governance model, such as data owners, virtual space administrators, and curators.
- Explain how the QCP ensures data security and privacy, including encryption, role-based access control, and country-specific data protection mechanisms.
Data privacy, authentication, authorisation
Authentication and authorisation: the platform manages these critical security aspects internally, without reliance on external services such as Single Sign-On (SSO) solutions. This ensures that control over user access and data security is tightly integrated and tailored to the needs of the ACQF QCP.
Role-based access control: the QCP implements Role-Based Access Control (RBAC) model to enforce the principle of least privilege, granting users only the minimum access rights necessary for their roles. Accordingly, platform users are assigned the role of curator, virtual space administrator or platform administrator (also called QCP administrator). This structured approach enhances security by reducing the attack surface if an account is compromised and minimises risks of accidental or malicious data misuse.
Data accessibility: Access to work-in-progress national qualification data is restricted to the respective country, ensuring data privacy and sovereignty.
Data anonymity: for publicly accessible QCP analytics and reports, any underlying data with personally identifiable information or sensitive details undergo rigorous anonymisation to prevent individual re-identification, safeguarding privacy while enabling aggregated insights.
Data security
The QCP protects data throughout its lifecycle, covering data in transit (over networks) and data at rest (stored within systems). This includes strong encryption, controlled jurisdictional data access, anonymisation for public use, and mechanisms for ongoing data accuracy and integrity.
Transport Layer Security (TLS): all data in transit between the user interfaces and the servers is encrypted using TLS. TLS establishes a secure, encrypted tunnel that protects data from eavesdropping, interception, and tampering across networks. This is crucial for safeguarding all sensitive QCP information, including login credentials and personal data.
For example, TLS encryption means that when a curator logs in and uploads qualification data, that data is scrambled in transit so it cannot be intercepted or read by anyone monitoring the network — this happens automatically, with no action needed from the user.
Encryption of sensitive data: sensitive data at rest is encrypted using strong encryption standards, such as AES-256, to protect against unauthorised access. This ensures that data remains unintelligible to anyone without the decryption keys, even if storage media is compromised.
Country-specific data access controls: the QCP architecture enforces strict data segregation by national jurisdiction. Each country can only access its own transactional data; access to other countries’ data is blocked except under rare, legally sanctioned and mutually agreed exceptions.
API security: QCP API endpoints are protected by robust authentication and authorisation, e.g. with JSON Web Tokens (JWTs) as a key technology. JWTs are compact, self-contained JSON objects used to transmit information securely. They are well suited to stateless APIs and to delegating user authentication and authorisation.
User interface (UI) security: UI security covers measures to protect the client side of the QCP application — the user’s web browser. It defends against web attacks that target users and ensures the integrity of data submitted through the UI.
References
QCP Governance and Network (QCP Technical Cluster)
Qualifications and Credentials Platform: Architecture Report (ACQF)