Governance traceability
This table lists every numbered section of the 1+MG Data Governance master document (version 2025-12) and the architecture pages that implement it. The governance is published as the annex of GDI D2.4 [DG], on Zenodo. The table is generated from the governance_refs field of each page, so it is always up to date.
- Bold rows are chapters and steps of the governance.
- Applies to shows the notes in square brackets in the governance titles: the types of use or the types of dataset a section is limited to. Types of dataset (1+MG compliant, 1+MG cohort) are highlighted.
- The detailed responsibility sections (chapters V to VIII) are the requirements the architecture must cover. When no page references one, it is marked as a gap.
- To cite a section in a page, write
<GovRef id="VII.2.3" />. The link lands on the matching row below. - Sections are identified by their number, never by a page number. The published document numbers the overview section IV and its subsections as I. and I.1 to I.4; the table shows this next to the title.
Coverage of the 95 responsibility sections (chapters V–VIII): Covered 20 Planned 75 Gap 0
Covered: referenced by a page with content (draft, in review or approved). Planned: referenced only by placeholder pages. Gap: no page references it yet. Architecture decisions (ADRs) are listed, but don't count as coverage.
| DG section | Title | Applies to | Scope | Implemented in |
|---|---|---|---|---|
| I | Reading Guide | 1.3 Stakeholders (planned), 3.1 Business context (planned), 3.3 European, national and User Organisation scopes (planned) | ||
| II | Introduction | |||
| II.1 | Context | 1. Introduction and goals (planned), 3.3 European, national and User Organisation scopes (planned), 8.12 Types of dataset, 8.2 Controllers, processors and responsibilities (planned), ADR-0002 Who decides on access, per type of dataset, 11. Risks and technical debt (planned) | ||
| II.2 | Principles guiding the data governance | 1.2 Quality goals (planned), 2.2 Governance principles (planned), 4. Solution strategy (planned) | ||
| II.3 | Scope of secondary use | 1. Introduction and goals (planned), 1.1 Requirements overview (planned) | ||
| II.4 | Elements not covered in the data governance | 1.1 Requirements overview (planned), 2.1 Legal and regulatory constraints (planned) | ||
| III | Definitions and Qualification of Stakeholders | 1.3 Stakeholders (planned), 3.1 Business context (planned), 3.3 European, national and User Organisation scopes (planned), 5. Building block view (level 1) (planned), 8.12 Types of dataset, ADR-0002 Who decides on access, per type of dataset, 11. Risks and technical debt (planned), 12. Glossary | ||
| IV | Overview/summary (numbered I in the published document) | |||
| IV.1 | Aspects relevant for all processes (numbered I.1 in the published document) | |||
| IV.2 | Data Inclusion Governance (numbered I.2 in the published document) | |||
| IV.3 | Data Access Governance (numbered I.3 in the published document) | |||
| IV.4 | Data Use Governance (numbered I.4 in the published document) | |||
| V | General Aspects | |||
| V.1 | Measures for data protection, risk and quality management | |||
| V.1.1 | Data protection, risk and quality management – Responsibility: Genome EDIC Assembly of Members | European | 2.1 Legal and regulatory constraints (planned), 8.3 Security and risk management (planned) | |
| V.1.2 | Data protection, risk and quality management – Responsibility: Genome EDIC CC | European | 2.3 Organisational constraints (planned), 6.5 Security incident and personal data breach (planned), 7.1 Central deployment (planned), 8.1 Data protection by design and by default (planned), 8.3 Security and risk management (planned) | |
| V.1.3 | Data protection, risk and quality management – Responsibility: 1+MG IT Infrastructure Provider | European, National | 2.4 Technical constraints (planned), 6.5 Security incident and personal data breach (planned), 7.2 National deployment patterns (planned), 8.1 Data protection by design and by default (planned), 8.3 Security and risk management (planned), 11. Risks and technical debt (planned) | |
| V.1.4 | Data protection, risk and quality management – Responsibility: 1+MG Member Countries | National | 2.3 Organisational constraints (planned), 7.2 National deployment patterns (planned) | |
| V.2 | Data Subjects’ Rights | |||
| V.2.1 | Data Subjects’ Rights – Responsibility: Genome EDIC Assembly of Members | European | 6.4 Exercise of data subjects’ rights (planned) | |
| V.2.2 | Data Subjects’ Rights – Responsibility: Genome EDIC CC | European | 5.1.4 Transparency and reporting services (planned), 6.4 Exercise of data subjects’ rights (planned) | |
| V.2.3 | Data Subjects’ Rights – Responsibility: 1+MG Data Provider | National | 6.4 Exercise of data subjects’ rights (planned), 8.6 Legal basis, consent and objection (planned) | |
| V.2.4 | Data Subjects’ Rights – Responsibility: Genome EDIC Member Country | National | 5.2.4 Data subject services (planned), 6.4 Exercise of data subjects’ rights (planned) | |
| V.2.5 | Data Subjects’ Rights – Responsibility: 1+MG NCP | National | 5.2.4 Data subject services (planned), 6.4 Exercise of data subjects’ rights (planned) | |
| V.2.6 | Data Subjects’ Rights – Responsibility: 1+MG IT Infrastructure Provider | European, National | 6.4 Exercise of data subjects’ rights (planned), 8.9 Dataset versioning (planned) | |
| V.2.7 | Data Subjects’ Rights – Responsibility: User | User Organisation | 6.4 Exercise of data subjects’ rights (planned) | |
| VI | Data Inclusion Governance | |||
| VI.1 | Establish Principal Availability | |||
| VI.1.1 | Establish Principal Availability – Responsibility Genome EDIC General Assembly | European | 6.1 Data inclusion (planned) | |
| VI.1.2 | Establish Principal Availability – Responsibility Genome EDIC CC | European | 6.1 Data inclusion (planned) | |
| VI.1.3 | Establish Principal Availability – Responsibility Genome EDIC Member Country | National | 2.3 Organisational constraints (planned), 6.1 Data inclusion (planned), 8.12 Types of dataset, 11. Risks and technical debt (planned) | |
| VI.1.4 | Establish Principal Availability – Responsibility 1+MG NCP | National | 5.2.1 1+MG NCP node and national catalogue (planned), 6.1 Data inclusion (planned) | |
| VI.1.5 | Establish Principal Availability – Responsibility 1+MG Data Provider | National | 6.1 Data inclusion (planned), 8.12 Types of dataset, 8.6 Legal basis, consent and objection (planned), 11. Risks and technical debt (planned) | |
| VI.2 | Data Transformation | |||
| VI.2.1 | Data Transformation – Responsibility Genome EDIC CC | European | 6.1 Data inclusion (planned) | |
| VI.2.2 | Data Transformation – Responsibility 1+MG Data Provider | National | 5.2.6 Data transformation and documentation (planned), 6.1 Data inclusion (planned), 8.12 Types of dataset | |
| VI.2.3 | Data Transformation - Responsibility 1+MG NCP or 1+MG IT Infrastructure Provider or other Genome EDIC national entity | National | 5.2.6 Data transformation and documentation (planned), 6.1 Data inclusion (planned) | |
| VI.3 | Data Documentation | |||
| VI.3.1 | Data Documentation – Responsibility Genome EDIC CC | European | 6.1 Data inclusion (planned), 8.10 Metadata and semantic interoperability (planned) | |
| VI.3.2 | Data Documentation – Responsibility 1+MG Data Provider | National | 5.2.6 Data transformation and documentation (planned), 6.1 Data inclusion (planned), 8.10 Metadata and semantic interoperability (planned) | |
| VI.3.3 | Data Documentation – Responsibility Genome EDIC Member Country | National | 6.1 Data inclusion (planned) | |
| VI.3.4 | Data Documentation – Responsibility 1+MG NCP | National | 5.2.1 1+MG NCP node and national catalogue (planned), 6.1 Data inclusion (planned) | |
| VI.4 | Establish Formal Availability | |||
| VI.4.1 | Establish Formal Availability – Responsibility Genome EDIC Member Countries | National | 6.1 Data inclusion (planned) | |
| VI.4.2 | Establish Formal Availability – Responsibility Genome EDIC CC | European | 6.1 Data inclusion (planned) | |
| VI.4.3 | Establish Formal Availability – Responsibility 1+MG Data Providers | National | 5.2.5 1+MG compliant local IT infrastructure (Data Host) (planned), 6.1 Data inclusion (planned), 8.12 Types of dataset | |
| VI.4.4 | Establish Formal Availability – Responsibility 1+MG NCP | National | 5.2.1 1+MG NCP node and national catalogue (planned), 6.1 Data inclusion (planned), 8.12 Types of dataset, ADR-0002 Who decides on access, per type of dataset | |
| VI.4.5 | Establish Formal Availability – Responsibility 1+MG Data Holders | 1+MG compliant datasets | National | 6.1 Data inclusion (planned), 8.12 Types of dataset |
| VI.4.6 | Establish Formal Availability – Responsibility 1+MG IT Infrastructure Provider | European, National | 4. Solution strategy (planned), 5.2.5 1+MG compliant local IT infrastructure (Data Host) (planned), 6.1 Data inclusion (planned), 7.3 Local deployment (planned), 8.1 Data protection by design and by default (planned), 8.12 Types of dataset, 8.2 Controllers, processors and responsibilities (planned) | |
| VII | Data Access Governance | |||
| VII.1 | Prior Registration of the User Organisation | |||
| VII.1.1 | Prior Registration of the User Organisation – Responsibility: 1+MG Data Holders | 1+MG compliant datasets | National | 6.2.1 Registration of the User Organisation (planned) |
| VII.1.2 | Prior Registration of the User Organisation – Responsibility: Genome EDIC CC | European | 5.1.3 User Organisation registry (planned), 6.2.1 Registration of the User Organisation (planned) | |
| VII.1.3 | Prior Registration of the User Organisation – Responsibility: User Organisation | User Organisation | 3.3 European, national and User Organisation scopes (planned), 5.1.3 User Organisation registry (planned), 5.3.1 User Organisation registration and user management (planned), 6.2.1 Registration of the User Organisation (planned), 8.12 Types of dataset, 8.4 Identity, authentication and authorisation (planned) | |
| VII.1.4 | Prior Registration of the User Organisation – Responsibility: Genome EDIC Member Country | National | 6.2.1 Registration of the User Organisation (planned) | |
| VII.2 | Data Discovery | |||
| VII.2.1 | Data Discovery – Responsibility: Genome EDIC CC | European | 3.2 Technical context (planned), 5.1.1 1+MG User Portal and central data catalogue (planned), 6.2.2 Data discovery (planned), 8.12 Types of dataset, ADR-0002 Who decides on access, per type of dataset | |
| VII.2.2 | Data Discovery Responsibility: 1+MG Data Holder/Genome EDIC CC | Research, Policy Development, QM in Healthcare | European, National | 5.2.7 Subject-level discovery endpoint (planned), 6.2.2 Data discovery (planned), 8.12 Types of dataset, 8.2 Controllers, processors and responsibilities (planned) |
| VII.2.3 | Data Discovery Responsibility: 1+MG IT Infrastructure Provider | Research, Policy Development, QM in Healthcare | European, National | 5.2.7 Subject-level discovery endpoint (planned), 6.2.2 Data discovery (planned), 8.5 Logging, monitoring and audit (planned) |
| VII.2.4 | Data Discovery Responsibility: Users | Research, Policy Development, QM in Healthcare | User Organisation | 6.2.2 Data discovery (planned), 8.12 Types of dataset |
| VII.2.5 | Data Discovery Responsibility: 1+MG NCPs | National | 5.2.1 1+MG NCP node and national catalogue (planned), 6.2.2 Data discovery (planned) | |
| VII.2.6 | Data Discovery Responsibility: 1+MG Data Providers | National | 6.2.2 Data discovery (planned) | |
| VII.3 | Data Access Request | |||
| VII.3.1 | Data Access Request Responsibility: Genome EDIC CC | European | 5.1.2 Access request management and 1+MG DAC support (planned), 5.1.1 1+MG User Portal and central data catalogue (planned), 6.2.3 Data access request (planned), 8.12 Types of dataset, ADR-0002 Who decides on access, per type of dataset, 11. Risks and technical debt (planned) | |
| VII.3.2 | Data Access Request Responsibility: 1+MG NCP | Research, Policy Development, QM in Healthcare | National | 5.2.1 1+MG NCP node and national catalogue (planned), 6.2.3 Data access request (planned) |
| VII.3.3 | Data Access Request Responsibility: Users | Research, Policy Development, QM in Healthcare | User Organisation | 6.2.3 Data access request (planned), 11. Risks and technical debt (planned) |
| VII.3.4 | Data Access Request Responsibility: Users | Healthcare reuse | User Organisation | 6.2.3 Data access request (planned) |
| VII.3.5 | Data Access Request Responsibility: User Organisation | Research, Policy Development, QM in Healthcare | User Organisation | 5.3 User Organisation scope (planned), 6.2.3 Data access request (planned) |
| VII.4 | Data Access Review | |||
| VII.4.1 | Data Access Review Responsibility: Genome EDIC CC | Research, Policy Development, QM in Healthcare | European | 5.1.2 Access request management and 1+MG DAC support (planned), 6.2.4 Review and decision (planned) |
| VII.4.2 | Data Access Review Responsibility: Genome EDIC CC | additional for Research, Policy Development | European | 5.1.2 Access request management and 1+MG DAC support (planned), 6.2.4 Review and decision (planned) |
| VII.4.3 | Data Access Review Responsibility: Genome EDIC CC | Healthcare reuse | European | 5.1.2 Access request management and 1+MG DAC support (planned), 6.2.4 Review and decision (planned), 8.12 Types of dataset, ADR-0002 Who decides on access, per type of dataset, 11. Risks and technical debt (planned) |
| VII.4.4 | Data Access Review Responsibility: 1+MG NCP | Research, Policy Development, QM in Healthcare | National | 5.2.1 1+MG NCP node and national catalogue (planned), 6.2.4 Review and decision (planned) |
| VII.4.5 | Data Access Review Responsibility: 1+MG NCP | Healthcare reuse | National | 6.2.4 Review and decision (planned), 8.12 Types of dataset |
| VII.4.6 | Data Access Review Responsibility: 1+MG Data Holder | 1+MG Compliant DataResearch, Policy Development, QM in Healthcare | National | 5.2.2 Access review and decision support (planned), 6.2.4 Review and decision (planned), 8.12 Types of dataset, ADR-0002 Who decides on access, per type of dataset |
| VII.4.7 | Data Access Review Responsibility: 1+MG Data Providers and/or Local DACs | 1+MG Cohort Data onlyResearch, Policy Development, QM in Healthcare | National | 5.2.2 Access review and decision support (planned), 6.2.4 Review and decision (planned), 8.12 Types of dataset, ADR-0002 Who decides on access, per type of dataset, 11. Risks and technical debt (planned) |
| VII.4.8 | Data Access Review Responsibility: User Organisations (where applicable) | Healthcare reuse | User Organisation | 5.3 User Organisation scope (planned), 6.2.4 Review and decision (planned) |
| VII.5 | Data Access Decision | |||
| VII.5.1 | Data Access Review Responsibility: 1+MG DAC | Research, Policy Development, QM in Healthcare | European | 5.1.2 Access request management and 1+MG DAC support (planned), 6.2.4 Review and decision (planned), 8.12 Types of dataset, ADR-0002 Who decides on access, per type of dataset, 11. Risks and technical debt (planned) |
| VII.5.2 | Data Access Review Responsibility: Genome EDIC Member Country | Research, Policy Development, QM in Healthcare | National | 5.2.2 Access review and decision support (planned), 6.2.4 Review and decision (planned), 11. Risks and technical debt (planned) |
| VII.5.3 | Data Access Review Responsibility: 1+MG NCP | Research (except for recruitment into clinical studies), Policy Development, QM in Healthcare | National | 5.2.1 1+MG NCP node and national catalogue (planned), 6.2.4 Review and decision (planned), 11. Risks and technical debt (planned) |
| VII.5.4 | Data Access Review Responsibility: 1+MG Data Holder | 1+MG Compliant Data | National | 5.2.2 Access review and decision support (planned), 6.2.4 Review and decision (planned), 8.12 Types of dataset, ADR-0002 Who decides on access, per type of dataset |
| VII.5.5 | Data Access Review Responsibility: Genome EDIC CC | European | 5.1.2 Access request management and 1+MG DAC support (planned), 6.2.4 Review and decision (planned), 8.12 Types of dataset, ADR-0002 Who decides on access, per type of dataset | |
| VII.5.6 | Data Access Review Responsibility: Genome EDIC General Assembly | European | 6.2.4 Review and decision (planned) | |
| VIII | Data Use | |||
| VIII.1 | Transparency and Communication Data Use | |||
| VIII.1.1 | Transparency and Communication on Data Use: Users | User Organisation | 6.3.4 Transparency and communication on data use (planned) | |
| VIII.1.2 | Transparency and Communication on Data Use: Genome EDIC CC | European | 5.1.4 Transparency and reporting services (planned), 6.3.4 Transparency and communication on data use (planned) | |
| VIII.1.3 | Transparency and Communication on Data Use: 1+MG NCP | National | 6.3.4 Transparency and communication on data use (planned) | |
| VIII.2 | Data use agreement | |||
| VIII.2.1 | Data use agreement - rights and responsibilities of Genome EDIC CC | European | 6.3.1 Data use agreement (planned) | |
| VIII.2.2 | Data use agreement - rights and responsibilities of Users | User Organisation | 6.3.1 Data use agreement (planned) | |
| VIII.3 | Processing in the SPE | |||
| VIII.3.1 | Processing in the SPE – rights and responsibilities of Users | User Organisation | 6.3.2 Processing in the SPE (planned), 8.4 Identity, authentication and authorisation (planned), 8.8 Output control (planned) | |
| VIII.3.2 | Processing in the SPE – rights and responsibilities of Genome EDIC CC | European | 5.2.3 Secure processing environment (SPE) (planned), 6.3.2 Processing in the SPE (planned), 8.8 Output control (planned) | |
| VIII.3.3 | Processing in the SPE – responsibilities of 1+MG IT Infrastructure Providers | European, National | 4. Solution strategy (planned), 5.2.3 Secure processing environment (SPE) (planned), 6.3.2 Processing in the SPE (planned), 8.12 Types of dataset, 8.7 Key-coded identifiers and data linkage (planned), ADR-0002 Who decides on access, per type of dataset | |
| VIII.3.4 | Processing in the SPE – rights and responsibilities of Genome EDIC Member Countries | Research only | National | 6.3.2 Processing in the SPE (planned) |
| VIII.4 | Special Processing in the SPE | healthcare reuse only | ||
| VIII.4.1 | Processing in the SPE – rights and responsibilities of Genome EDIC CC | European | 6.3.3 Healthcare reuse (planned) | |
| VIII.4.2 | Processing in the SPE – rights and responsibilities of Users | User Organisation | 6.3.3 Healthcare reuse (planned) | |
| VIII.4.3 | Processing in the SPE – rights and responsibilities of 1+MG Data Holders / Genome EDIC CC | European, National | 6.3.3 Healthcare reuse (planned) | |
| VIII.4.4 | Processing in the SPE – rights and responsibilities of treating healthcare professionals | National | 6.3.3 Healthcare reuse (planned) | |
| VIII.4.5 | Processing in the SPE – rights and responsibilities of 1+MG NCPs | healthcare reuse only | National | 5.2.3 Secure processing environment (SPE) (planned), 6.3.3 Healthcare reuse (planned) |
| VIII.5 | Reaching Back to Data Subjects | |||
| VIII.5.1 | Reaching Back to Data Subjects – Rights and Obligations: Users | User Organisation | 6.3.5 Reaching back to data subjects (planned) | |
| VIII.5.2 | Reaching Back to Data Subjects – Rights and Obligations: 1+MG NCP/1+MG Data Providers | National | 5.2.4 Data subject services (planned), 6.3.5 Reaching back to data subjects (planned) | |
| VIII.5.3 | Reaching Back to Data Subjects – Rights and Obligations: Genome EDIC CC | European | 6.3.5 Reaching back to data subjects (planned) | |
| VIII.5.4 | Reaching Back to Data Subjects – Rights and Obligations: Genome EDIC Member Countries | National | 6.3.5 Reaching back to data subjects (planned) | |
| VIII.6 | IP and Commercialisation | |||
| VIII.6.1 | IP and Commercialisation – Rights and Obligations: User Organisations | research only | User Organisation | 5.3 User Organisation scope (planned), 6.3.6 Results, publications, IP and enriched data (planned) |
| VIII.6.2 | IP and Commercialisation – Rights and Obligations: 1+MG Data Providers | National | 6.3.6 Results, publications, IP and enriched data (planned) | |
| VIII.6.3 | IP and Commercialisation – Rights and Obligations: Genome EDIC CC | research only | European | 6.3.6 Results, publications, IP and enriched data (planned) |
| VIII.7 | Publications | |||
| VIII.7.1 | Publications – Rights and Obligations: Users | User Organisation | 6.3.6 Results, publications, IP and enriched data (planned) | |
| VIII.7.2 | Publications – Rights and Obligations: Genome EDIC Assembly of Members | European | 6.3.6 Results, publications, IP and enriched data (planned) | |
| VIII.7.3 | Publications – Rights and Obligations: Genome EDIC CC | European | 5.1.4 Transparency and reporting services (planned), 6.3.6 Results, publications, IP and enriched data (planned) | |
| VIII.7.4 | Publications – Rights and Obligations: 1+MG NCP | National | 6.3.6 Results, publications, IP and enriched data (planned) | |
| VIII.8 | Archiving | research and healthcare reuse only | ||
| VIII.8.1 | Archiving – Rights and Obligations: Users | User Organisation | 6.3.7 Archiving (planned) | |
| VIII.8.2 | Archiving – Rights and Obligations: Genome EDIC CC | European | 6.3.7 Archiving (planned) | |
| VIII.8.3 | Archiving – Rights and Obligations: Genome EDIC Member Countries | National | 6.3.7 Archiving (planned) | |
| VIII.8.4 | Archiving – Rights and Obligations: 1+MG IT Infrastructure providers | European, National | 6.3.7 Archiving (planned) | |
| VIII.9 | Enriched and Improved Data | |||
| VIII.9.1 | Enriched and Improved Data – Obligations: Users | User Organisation | 6.3.6 Results, publications, IP and enriched data (planned) | |
| VIII.9.2 | Enriched and Improved Data – Obligations: Genome EDIC CC | European | 6.3.6 Results, publications, IP and enriched data (planned) | |
| VIII.10 | Data Subject Related Data | healthcare only | ||
| VIII.10.1 | Data Subject Related Data – Obligations: Users | User Organisation | 6.3.3 Healthcare reuse (planned) | |
| VIII.10.2 | Data Subject Related Data – Obligations: Genome EDIC CC | European | 6.3.3 Healthcare reuse (planned) | |
| VIII.11 | Incidental Findings | |||
| VIII.11.1 | Incidental Findings – Rights and Responsibilities: User | User Organisation | 6.3.8 Incidental findings (planned), 11. Risks and technical debt (planned) | |
| VIII.11.2 | Incidental Findings – Rights and Responsibilities: Genome EDIC CC | European | 6.3.8 Incidental findings (planned) | |
| VIII.11.3 | Incidental Findings – Rights and Responsibilities: 1+MG NCP | National | 6.3.8 Incidental findings (planned) | |
| VIII.11.4 | Incidental Findings – Rights and Responsibilities: 1+MG Data Provider | National | 6.3.8 Incidental findings (planned) |