Data quality, governance and privacy guides

Guides to data quality, governance and privacy at work.

3to open now

Resource
Data quality checklist
Twelve checks before you publish anything.
Use it to
Fill in your own
Kind
Template
Open the resource

Resource

Data quality dimensions cheat sheet

Six dimensions, what each catches, and a rule for each.

Dimension	Definition	The question to ask
Completeness	Every value that shoul	Is anything missing th
Uniqueness	Each real-world thing	Could the same order,
Validity	Values fall within the	Could this value physi
Consistency	The same thing is reco	Would two people readi

Use it to: Check something fast
Kind: Cheat sheet

Open the resource

Resource
Anonymity threshold guide
When a group is too small to report on, and how to decide.
Use it to
Learn a method
Kind
Guide
Open the resource

Real published example	Rule	Source
ONS Secure Research Se	Default low-count thre	ONS SRS statistical di
NHS England (HES / ECD	Sub-national counts of	NHS England, disclosur

Back to Data quality, governance and privacy guides

Resource, template

Data quality checklist

Most bad data arrives through a job that ran perfectly.

Before: Before you publish anything built from this data.
Fill it in: Ten minutes, run against the actual rows, not from memory.
After: Signed off and filed with the report, so anyone can see what was checked.

Filled example, matched against Spot the Dirty Data's own planted faults.

All 12 checks reviewed · 7 failed

	Check	How to test it	Result
Completeness
✓	Row count matches what the source says it sent	Compare the loaded row count against the source system's own count or file manifest.	N/A
✓	Required fields have no blanks	Run a COUNT WHERE column IS NULL on every required column.	Fail (order 1010 has a blank quantity with a value present)
Uniqueness
✓	The key column has no duplicates	GROUP BY the key column and check every count is 1.	Fail (order 1002 appears twice, identical)
✓	No row appears twice after joins	Compare row counts before and after each join.	N/A
Validity
✓	Values sit in their allowed range (no negative quantities)	Check MIN() on quantity and value columns is not below the allowed floor.	Fail (order 1006 has a negative quantity)
✓	Dates are real dates and none are in the future	Parse every date value and check it against today's date and the calendar.	Fail (order 1014 is dated 30 February, which does not exist)
Consistency
✓	Categories are spelled one way only	List DISTINCT values in each category column and read them.	Fail (region appears as North, NORTH, N. and north; product as “Widget B” and “widget b”)
✓	The total matches the source system	Reconcile the aggregate total against the source system's own total for the same period.	N/A
Timeliness
✓	The data is as recent as the report claims	Compare the data's last-refreshed timestamp against the freshness the report states.	N/A
Accuracy
✓	One row traced end to end against the original	Pick one row, recompute it by hand from the source, and compare.	Fail (order 1018: eight units at €120 each is €960, the row shows €860)
✓	The largest and smallest values look sensible	Sort by value and eyeball the top and bottom five rows.	Fail (order 1017 is €45,000 for three units, against roughly €150 a unit everywhere else)
Definition
✓	The measure matches its written definition	Re-read the metric's written definition and check the query matches it field for field.	N/A

Checked by: Data Platform team (illustrative)
Date: 21 March 2026 (illustrative)

Blank template — copy or fill in

Complete this here or copy it into your own document. Edits are not saved when you leave the page.

Back to Data quality, governance and privacy guides

Resource, cheat sheet

Data quality dimensions cheat sheet

Six dimensions, what each catches, and a rule for each.

Side a · the dimensions

The six dimensions, one rule each

Dimension	Definition	The question to ask	A rule you can write
Completeness	Every value that should be there is there.	Is anything missing that should be filled in?	`customer_id is not null on 100% of orders.`
Uniqueness	Each real-world thing appears once.	Could the same order, customer or row be counted twice?	`One row per order_id.`
Validity	Values fall within the rules for that field.	Could this value physically or logically exist?	`order_date is between 2015-01-01 and today.`
Consistency	The same thing is recorded the same way everywhere.	Would two people reading this agree what it says?	`Region codes match the reference list.`
Timeliness	The data is as fresh as it claims, or needs, to be.	How old is this, and is that old enough to matter?	`Refreshed by 07:00 daily, flagged if older than 26 hours.`
Accuracy	The value matches the real-world fact it represents.	If you traced this back to its source, would it match?	`Total revenue reconciles to the ledger within 0.5%.`

Profiling checklist

Run this before you write a single quality rule, it tells you where to point them.

Row count, against what the source says it sent

Nulls per column

Distinct counts per column

Min and max on every numeric and date column

Top values on every category column

Duplicates on the key column

Cross-referenced: The data quality checklist's twelve checks

Dimension	Check
Completeness	Row count matches what the source says it sent
Completeness	Required fields have no blanks
Uniqueness	The key column has no duplicates
Uniqueness	No row appears twice after joins
Validity	Values sit in their allowed range (no negative quantities)
Validity	Dates are real dates and none are in the future
Consistency	Categories are spelled one way only
Consistency	The total matches the source system
Timeliness	The data is as recent as the report claims
Accuracy	One row traced end to end against the original
Accuracy	The largest and smallest values look sensible
Definition	The measure matches its written definition

Score it

This page's own 0 to 3 scale for how well-covered each dimension is on a dataset you own.

Score	Meaning	What it looks like
0	Not checked	No test exists for this dimension on this dataset.
1	Checked, fails	A test exists and is currently failing or was recently found failing.
2	Checked, passes with known gaps	A test exists and passes, but doesn't cover every case (e.g. only checks one table of several).
3	Checked, passes, full coverage	A test exists, passes, and covers the whole dataset it claims to.

Side b · score your own dataset

One row per dimension. Write the rule you'd actually write, then score it.

Dimension	Your rule	Score (0 to 3)
Completeness
Uniqueness
Validity
Consistency
Timeliness
Accuracy

Back to Data quality, governance and privacy guides

Resource, guide

Anonymity threshold guide

When a group is too small to report on, and how to decide.

Why a number can identify a person

An average, a total or even a percentage calculated over a small enough group can be reversed to name the one person it describes, especially when the reader already knows who is likely to be in that group.

The threshold rule

Do not report a statistic for a group of fewer than 5 people, and do not report a group whose complement (everyone else in the total) is fewer than 5 either. Many organisations use 10 instead of 5, pick one, write it down, and apply it to everyone, including the people asking.

Real published example	Rule	Source
ONS Secure Research Service (DfE data)	Default low-count threshold of 10, counts below 10 aren't published without exception approval.	ONS SRS statistical disclosure control policy, 2025
NHS England (HES / ECDS)	Sub-national counts of 1-7 are suppressed and shown as ‘*’ when the national total is 8 or more.	NHS England, disclosure control methodology for HES/ECDS

There is no single universal threshold, published UK examples range from about 5 to 10, and vary by dataset. Pick one, write it down, and apply it consistently.

Secondary disclosure: Two safe tables, one unsafe combination

Each report on its own clears the threshold. Combined, they don't.

Report	Group	Size
Pay by gender	Women in Data	6
Pay by age band	Data, over 50	5
Overlap	Women in Data over 50	1

Six people, then five people, then one. That last row is the one nobody published, and the one that identifies someone. Check combinations, not just each report in isolation.

The Five tests

Small numbers

Any cell below your threshold.

Complement

The group not in the cell is also below the threshold (e.g. “38 of 40” reveals the 2 as clearly as the 2 would on its own).

Zero and full counts

“0 of 6 women were promoted” or “6 of 6” both name every person in the group, whatever the threshold.

Rare values

A category so unusual that one row obviously belongs to one person (the only person over 60, the only contractor).

Linkage with public information

Could someone match this to a name using LinkedIn, a press release, or an org chart?

The motivated-intruder test

Would a determined person, with the public information actually available to them, be able to identify someone? Assume they try.

What to do instead of refusing to publish

Suppress

Replace the cell with a marker (‘*’ or ‘c’), not a blank, a blank invites guessing.

Aggregate categories

Merge small groups into a bigger one (combine two age bands, or grades).

Round

Round to the nearest 5 or 10, but rounding alone does not defeat combination with other known facts.

Report ranges

“5-9 people” instead of an exact count.

Delay

Publish once the group has grown, or once a leaver can no longer be inferred from a before/after comparison.

Worked example: A 40-person department

Pay by grade and gender, threshold of 5. Four cells suppressed, for two different reasons.

Grade	Gender	People	Decision
Grade 3	Women	12	Publish
Grade 3	Men	9	Publish
Grade 4	Women	6	Publish
Grade 4	Men	4	Suppress (below threshold)
Grade 5	Women	2	Suppress (below threshold)
Grade 5	Men	7	Publish, but check the complement

Grade 5 has 9 people total: 2 women, 7 men. Publishing “7 men” makes the 2 women just as identifiable as publishing “2 women” would, so both cells in that row are suppressed, not just the small one.

The decision flow

Is the group size below your threshold?

Is the complement below your threshold?

Does this combine with another published table to isolate someone?

Is it a zero, full, or rare-value count?

Would a motivated intruder identify someone using public information?

Any ‘yes’ → suppress, aggregate, round, range, or delay. All ‘no’ → publish.

Checklist for HR and people analysts

Threshold agreed and written down before you start (5 or 10, not decided per-request)

Every cell checked against the threshold, including totals and subtotals

Complements checked, not just the small cell itself

Checked against every other report already published on the same population

Zero and full counts treated the same as small ones

Rare or unusual categories reviewed by someone who knows the team

Motivated-intruder test applied, not just a threshold tick-box

Suppressed cells marked, not left blank

The GDPR link

Anonymised data is out of scope of GDPR only when re-identification is not reasonably likely, taking into account the means reasonably available to do so, not merely because names were removed. Pseudonymised data (a name replaced with an ID you can still map back) is still personal data under GDPR and is not the same as anonymised data.

Analytics cookies

Data quality, governance and privacy guides

Data quality checklist

Data quality dimensions cheat sheet

Anonymity threshold guide

Data quality checklist

Data quality dimensions cheat sheet

Side a · the dimensions

The six dimensions, one rule each

Profiling checklist

Cross-referenced: The data quality checklist's twelve checks

Score it

Side b · score your own dataset

Anonymity threshold guide

Why a number can identify a person

The threshold rule

Secondary disclosure: Two safe tables, one unsafe combination

The Five tests

What to do instead of refusing to publish

Worked example: A 40-person department

The decision flow

Checklist for HR and people analysts

The GDPR link