Power BI Policy

1. Statement of Policy

Dyfed-Powys Police (DPP) recognises the importance of leveraging new technology to enhance operational and organisational efficiency, promoting the use of accurate data to drive evidence-based decision-making to improve the service provided to our communities. In alignment with this commitment, the Power BI Policy establishes the principles and working practices that are to be adopted when using the Microsoft Power BI application to ensure data integrity, security, and compliance across the force area.

Power BI is an analytics tool developed by Microsoft, designed to transform raw data into insightful visualisations and actionable insights. With its intuitive interface and robust features, Power BI empowers users to make data-driven decisions within organisations. Power BI offers several licensing options tailored to different user needs, including Power BI Free, Power BI Pro, and Power BI Premium. DPP pays an annual license fee for the cloud-based Power BI Premium service and a select number of Power BI Pro licenses held only by members of both the Performance & Analytics Team and ICT.  Power BI connects to a wide array of data sources, including popular databases like SQL Server, MySQL, and Oracle, cloud platforms such as Azure and AWS, as well as various file formats (csv), web services, and online services like SharePoint and Dynamics 365. This versatility makes Power BI an adaptable and comprehensive solution for data analysis and visualisation across diverse organisational data ecosystems.

The proliferation of developing products within Power BI poses potential risks to the accuracy, standardisation, interpretation, security, and confidentiality of data and sensitive information in force.  The purpose of this policy is to mitigate these risks, safeguard the Force's data assets, and maintain a standardised and secure environment for reporting and analytics.  This in turn will ensure organisational standards, compliance requirements, and overarching goals are adhered.

Applies (but not limited) to: All categories of Dyfed-Powys Police officers and staff, whether full-time, part-time, permanent, fixed term, temporary (including agency staff, associates and contractors), seconded staff and volunteers. Police Officers, staff and volunteers accessing and using Force assets and property must have due regard to the contents of this policy.

 

2. Policy Scope

This policy must ALWAYS be adhered to and applied to ALL Dyfed-Powys Police officers, police staff and volunteers.  Specifically, this policy is activated whenever there is a need for the creation, modification, or maintenance of a Microsoft Power BI product within the force environment.  The creation, maintenance, and publication of any Power BI-related product, including but not limited to datasets, reports, dashboards and apps, through use of either the Power BI desktop application or the Power BI web service is strictly prohibited to all force personnel and volunteers outside of the Performance & Analytics Team. 

The policy is necessary to maintain data integrity, security, and compliance standards across the Force. External demands such as data protection laws, regulatory requirements, and emerging cybersecurity threats also contribute to the need for a comprehensive and enforceable Power BI policy. The Performance & Analytics Team is exclusively responsible for the creation and maintenance of all Power BI products, providing centralised control and oversight.

This policy directly affects all members of Dyfed-Powys Police who engage in the creation, modification, or use of Power BI products. It is crucial for all force personnel and volunteers, particularly those within the Performance & Analytics Team, to be fully aware of and compliant with the policy. Regular communication and training sessions will be conducted to keep all relevant stakeholders informed about policy updates, changes, and best practices. This includes Dyfed-Powys Police officers, police staff and volunteers who may utilise Power BI outputs, ensuring a clear understanding of the reliability and security of the information they access.

The decision to prohibit all Dyfed-Powys Police officers, police staff and volunteers from creating and publishing Power BI products is grounded in the imperatives of centralised control and data governance. The Performance & Analytics Team assumes the critical role of ensuring that reports align with organisational standards, compliance requirements, and overarching goals.  By concentrating the development and publishing process within the Performance & Analytics Team, adherence to stringent data governance policies, management of access controls, and data security protocols will be enforced. The approach also facilitates a more rigorous quality assurance process, allowing all Power BI products to undergo thorough testing for accuracy, reliability, and relevance before reaching a broader audience. Centralised control further supports version control, minimising the risks of conflicting or outdated reports circulating within the organisation.

Failure to adhere to this policy would leave the Force at risk in several areas.  This policy aims to mitigate the following risks:

• Unauthorised access and sharing of sensitive data
• Non-compliance with data protection and other information compliance legislation
• Non-compliance with internal policies
• Compromised data integrity and reporting inconsistency
• Lack of quality control
• Inaccurate reporting
• Duplicated effort
• Misinterpretation of data
• Lack of governance
• Increased cost
• Lack of organisational standardisation
• Incorrect use of statistical methodologies

The centralised management within the Performance & Analytics Team serves as a safeguard against these risks, ensuring that all developments align with established organisational and national standards and best practices.

 

3.  Powers and Policy/Legal Requirements

The policy is fit for purpose in that it meets organisational requirements and complies with the following legislation, policy and guidance:

• Dyfed-Powys Police Data Protection Policy
• Dyfed-Powys Police Information Sharing Policy
• Computer Misuse Act 1990
• Data Protection Act 2018
• UK General Data Protection Regulation
• Freedom of Information Act 2000
• Code of Practice on Records Management under s46 Freedom of Information Act 2000
• Police Information and Records Management Code of Practice
• College of Policing APP – Information Management
• NPCC Review Retention and Disposable Schedule

An Equality Impact Assessment has been completed.

 

 

4.  Options and Contingencies

Policy Owner: The policy is owned by the Head of the Service Improvement Unit (SIU) who is responsible for regularly monitoring the policy for its effectiveness, challenges to the policy and any inefficiencies in relation to the implementation of this policy.

 

Approval Process: Approval of decisions regarding the implementation of the policy is made by the Information and Assurance Board.

 

The specifications outlined within the Power BI Policy are applicable to all Dyfed-Powys Police officers, police staff and volunteers.  Referral to Performance & Analytics Management for advice and guidance must be sought where deemed appropriate.

 

Key roles and responsibilities:

 

Performance & Analytics Management	Power BI Management
Business Intelligence Team	Creation and maintenance of all Power BI-related solutions (inc. reports, dashboard and apps)
Data Engineering Team	Creation and maintenance of all Power BI-related datasets
All police personnel outside of the Performance & Analytics Team	Contingent on being assigned the requisite security access, use of published Power BI solutions (inc. reports, dashboards and apps) in the web-based Power BI Service.    All police personnel outside of the Performance & Analytics Team is strictly prohibited from creating or publishing any Power BI-related solutions (inc. reports, dashboards and apps) both in the Power BI Desktop and in the web-based Power BI service.

 

Access:  Access to specific published Power BI solutions, encompassing reports, dashboards, and apps, will be determined through a collaborative decision-making process involving both Performance & Analytics management and the senior sponsor of each project/request. This process is integral to the solution development lifecycle and adheres to the principles outlined in the Stage-Gate Process. During each stage of development, access permissions will be reviewed and agreed upon, ensuring alignment with organisational objectives, data security standards, and user requirements. Performance & Analytics management will evaluate the technical and operational aspects, while the senior sponsor will provide strategic oversight and approval, ensuring that access is granted appropriately and supports the intended business outcomes. This collaborative approach ensures that the deployment of Power BI solutions is both secure and aligned with the strategic goals of the organisation.

The Code of Ethic principles are relevant to this policy:

• Courage – demonstrating integrity and transparency in our decisions, leading by example and challenging anything that could bring our profession into disrepute.
• Respect and empathy – listening to and understanding the needs of the public, and trying to recognise and respond to the physical, mental and emotional challenges that both colleagues and members of the public face. 
• Public service – the commitment to work in the public interest, communicate clearly and openly, and take pride in providing an excellent service to the public.

This Power BI policy supports the Force responsibility for the integrity and security of data through ensuring the development, centralisation, coordination and maintenance of Power BI products within the Performance and Analytics Team. In doing so, the Performance and Analytics Team ensure best practice and adherence to data management controls and governance and the Ethical Policing Principles.

This policy has been written to foster an environment of openness, honesty and accountability and encourages feedback and scrutiny to continuously improve data management.

The Policy ensures clear responsibilities and adopts a user centric approach, ensuring development work and reports are tailored to meet the diverse needs of the various departments and functions, demonstrating sensitivity to the perspectives and requirements of all stakeholders, to include the development of Force BI products based on Force priorities.

The Performance and Analytics Team are responsible for ensuring all data related products are accurate, reliable and consistent and that all reports and dashboards meet the highest standards of quality and compliance to support decisions and more effective policing strategies; supporting the Forces commitment to the public efficiently and responsibly by providing clear and accurate information that underpins effective and proactive policing for the benefit of our communities.

To ensure effective governance and compliance within the Power BI environment, this policy establishes ownership and accountability for data and reports. The Performance Team will take primary responsibility for the Power BI solution, including managing the underlying data used in reports. This encompasses tasks like identifying its source, guaranteeing its accuracy and completeness, and maintaining proper lineage documentation. Individual report creators within the Performance Team will assume ownership of their respective reports, guaranteeing their fidelity to the underlying data, maintaining their functionality and accuracy over time, and documenting the report's purpose, methodology, and limitations.

Data ownership will be a shared responsibility between the Performance Team and the senior stakeholder. The Performance Team will be responsible for any amendments to the data reported, while the senior stakeholder will jointly oversee the data's accuracy and alignment with the terms of reference. Additionally, the senior stakeholder will determine access permissions for reports during the initial development stages, following the established Stage Gate process.

Adherence to the organisation's information management policies is mandatory for all personnel involved in the Power BI process. This encompasses responsibilities related to records management, including classifying reports as records based on the retention schedule and following established procedures for storage, archiving, and disposal. Additionally, it covers cooperation with relevant personnel to locate and retrieve reports in response to Subject Access Requests (SARs) and Freedom of Information (FOI) requests, while ensuring any released reports comply with privacy and confidentiality restrictions. The policy encourages the establishment of a process for regular report review and updates. The Performance Team may consider developing ownership guidelines for complex reports or those with multiple contributors to further define responsibilities.

5. Take action and review

This policy will be reviewed annually by the Business Intelligence Manager, Performance & Analytics Team, SIU. This review will ensure the continued effectiveness of the policy and consider any changes to legislation, national guidance, etc.

The effectiveness of the policy will be measured through the number of queries directed to the to the Performance & Analytics Team concerning the creation or publication of Power BI-related solutions and the frequency of non-conformances with the policy identified.

Any significant failures within the procedures contained within the Power BI Policy will be referred for consideration to the Head of the Service Improvement Unit.  Any feedback or dissatisfaction with the policy will be recorded and discussed with the policy owner, with appropriate action taken.

Any amendments to this policy will be implemented through consultation and approval with the Information Assurance Board.

 

CODE OF ETHICS CERTIFICATE OF COMPLIANCE

This policy has been drafted in accordance with the Code of Ethics and has been reviewed on the basis of its content and the supporting evidence and it is deemed compliant with that Code and the principles underpinning it.

HUMAN RIGHTS ACT CERTIFICATE OF COMPLIANCE

This policy has been drafted in accordance with the Human Rights Act and has been reviewed on the basis of its content and the supporting evidence and it is deemed compliant with that Act and the principles underpinning it.

EQUALITY IMPACT ASSESSMENT

Section 4 of the Equality Act 2010 sets out the protected characteristics that qualify for protection under the Act as follows: Age; Disability; Gender Reassignment; Marriage and Civil Partnership; Pregnancy and Maternity; Race; Religion or Belief; Sex; Sexual Orientation.

The public sector equality duty places a proactive legal requirement on public bodies to have regard, in the exercise of their functions, to the need to:

• eliminate discrimination, harassment, victimisation, and any other conduct that is unlawful under the Act;
• advance equality of opportunity between persons who share a relevant protected characteristic and persons who do not share it;
• foster good relations between persons who share a relevant protected characteristic and persons who do not share it.

The equality duty applies to all protected characteristics with the exception of Marriage and Civil Partnership, to which only the duty to have regard to the need to eliminate discrimination applies.

Carrying out an equality impact assessment involves systematically assessing the likely or actual effects of policies on people in respect of all the protected characteristics set out above. An equality impact assessment should be carried out on any policy that is relevant to the public sector equality duty. 

EQUALITY IMPACT ASSESSMENT COMPLETED: May 2024