The organisation shall establish governance proportionate to the scope, complexity, sensitivity and consequence of the land referencing work.

The governance framework shall define:

accountable client or commissioning authority;

land referencing lead;

technical authority;

information owner;

data protection and information security responsibilities;

author, checker and approver roles;

change authority;

issue and escalation routes;

interface owners; and

conformity authority.

One person may perform more than one role where competence and independence requirements are satisfied and the arrangement is recorded.

Responsibilities shall be assigned for:

approving the project instruction and profiles;

determining applicable requirements;

approving interpretations and assumptions;

accepting findings and residual risks;

approving spatial specifications and tolerances;

approving data and outputs;

authorising access and exchange;

approving retention and disposal; and

declaring conformity.

No person shall approve work beyond their delegated authority.

The organisation shall determine the competence required for each role and shall retain evidence that assigned personnel meet that requirement.

Competence shall take account of:

land referencing knowledge;

relevant property and public-law context;

geospatial and data skills;

evidence assessment;

information governance;

communication and engagement;

quality assurance; and

limits of professional authority.

Work performed by a person developing competence shall be supervised and reviewed at a level appropriate to risk.

The project instruction shall define matters requiring independent checking or approval.

The checker shall have sufficient competence, access to evidence and independence from the original work to identify material error or bias.

Self-checking may be used for low-risk intermediate work only where permitted by the quality plan. A final controlled output shall receive the level of independent review defined by its consequence and applicable requirements.

A quality plan shall define:

applicable requirements and acceptance criteria;

quality-status scheme;

planned reviews and checks;

sampling basis, where sampling is used;

spatial validation;

data and cross-output validation;

approval points;

nonconformity and corrective-action process;

quality records; and

reporting and escalation.

Sampling shall not be used where complete checking is necessary to meet a legal, procedural or high-consequence requirement. Where sampling is used, the population, method, sample size, result and response to failure shall be recorded.

Technical review shall assess, as applicable:

conformity with this document and applicable profiles;

correct conceptual classification;

adequacy and traceability of evidence;

completeness and currency;

treatment of conflict and uncertainty;

spatial integrity and lineage;

party identity and authority;

requirement-right linkage;

consistency of plans, schedules and datasets;

protection of personal and confidential information; and

fitness for intended use.

Review findings shall be recorded, assigned, resolved or accepted by an authorised role before approval.

The organisation shall identify its role and responsibilities under applicable data protection law for each processing activity.

It shall document:

purpose and lawful basis;

controller, joint-controller or processor arrangements;

categories of personal data and data subjects;

necessity and proportionality;

sources and recipients;

access controls;

retention and disposal;

rights-handling arrangements;

transfer arrangements; and

required impact or risk assessments.

Personal data shall be accurate and, where necessary for the purpose, kept up to date. Access shall be limited to authorised users with a defined need.

Special-category, sensitive or high-risk personal data shall be collected only where necessary and lawful and shall receive enhanced controls.

JURISDICTIONAL NOTE (informative)
UK work is subject to the UK data-protection regime, including the UK GDPR and Data Protection Act 2018. Work in the Republic of Ireland is subject to the EU GDPR and the Irish Data Protection Act 2018. Controller and processor roles depend on actual decision-making and cannot be assigned solely by the label used in a contract.

The organisation shall establish a retention schedule that reconciles:

legal and procedural requirements;

client and contractual requirements;

evidential and limitation needs;

continuing operational need;

data-protection storage limitation;

intellectual-property and licence restrictions; and

archive or public-record obligations.

At the end of the retention period, information shall be securely disposed of, anonymised or transferred to an authorised archive. Disposal shall be suspended where a legal hold, dispute, investigation, inquiry or continuing requirement applies.

Disposal and transfer shall be recorded.

The organisation shall protect the confidentiality, integrity and availability of land referencing information.

Controls shall address:

user identity and access;

least-privilege permissions;

secure storage and transfer;

encryption where appropriate;

backup and recovery;

protection of portable and paper records;

supplier and system access;

logging and monitoring;

incident response;

secure disposal; and

continuity of access to authoritative records.

The control set should be aligned with an established information-security framework appropriate to the organisation and risk.

Evidence and data shall be used, copied, exchanged and published only within applicable confidentiality, copyright, database-right and licence conditions.

The organisation shall record restrictions that affect:

capture;

onward disclosure;

derived products;

publication;

retention; and

use after the project.

An output shall include required attributions and limitations.

When a nonconformity is identified, the organisation shall:

record and contain it;

assess affected land, rights, parties, outputs and users;

correct affected information where authorised;

determine cause where proportionate;

take action to prevent recurrence;

notify affected recipients where necessary;

verify effectiveness; and

retain the record.

A correction shall not obscure the original audit trail.

Material change shall be assessed before implementation for its effect on:

scope and applicable requirements;

requirement baseline;

information model;

spatial specification;

evidence and inquiries;

parties and communications;

derived parcels;

outputs;

data protection and security; and

programme and resources.

The change authority shall approve or reject the change and record required downstream action.

The organisation shall plan audits proportionate to risk and intended claims of conformity.

Audit shall use defined criteria, retain evidence and be performed by a person with sufficient independence from the work audited.

Audit results shall identify conformities, nonconformities, observations and improvement opportunities and shall be reported to the responsible authority.

A claim of conformity with this document shall:

identify the organisation, project or dataset to which the claim applies;

identify the version of this document;

identify applicable jurisdictional and procedural profiles;

identify any permitted exclusions and their rationale;

state the assessment method and assessor;

identify unresolved nonconformities; and

be approved by an authorised role.

Conformity shall not be claimed where a requirement stated as “shall” is not fulfilled, unless the requirement is demonstrably not applicable and the basis is recorded.

Conformity with this document does not constitute legal compliance, professional accreditation, ISO certification or approval by SoLR.

At defined intervals and at project close, the organisation should review:

achievement of intended outcomes;

audit and quality results;

recurring findings and nonconformities;

data and source limitations;

interface performance;

stakeholder feedback;

changes in law, standards and technology;

competence needs; and

improvements to profiles, instructions, schemas and controls.

Lessons affecting the SoLR standard should be submitted through the SoLR standards review process.