6.6 Data

govstack-cfr-data 2.0.0

#1 Use only Unicode for Text (REQUIRED IMMUTABLE) (previously 5.18)

All textual content is encoded using Unicode (UTF-8) to ensure consistency across systems and languages.

#2 Use ISO8601/UTC for Timestamps (REQUIRED IMMUTABLE) (previously 5.19)

All timestamps follow ISO 8601 in UTC (e.g., 2025-11-12T13:30:00Z). Time zones are explicitly defined when necessary.

#3 Use Standardized Data Formats for Interchange (REQUIRED REPLACEABLE) (previously 5.23)

JSON SHOULD be used for data models/services wherever possible. See https://www.json.org/json-en.html. Where JSON exhange is not possible, building blocks must use other standard data formats (such as XML).

#4 Use Existing Standards for Data Interchange, Where Available (RECOMMENDED EXTENSIBLE) (previously 5.24)

If an existing standard is available, it should be used, e.g. DICOM/Hl7/FHIR for healthcare. TMForum has a large library of standardized APIs and data models that can be used.

Building blocks and building block solutions MUST leverage existing standards, especially those listed in the Standards section below.

#5 Comply with GDPR Principles (RECOMMENDED IMMUTABLE) (previously 5.9)

Building Blocks conform to GDPR principles, including:

• Consent-based data collection,

• Right to access and delete personal data,

• Purpose limitation and data minimization,

• Privacy-by-design and privacy-by-default.

Localization of these principles to national frameworks are supported.

Note that these requirements may vary by region and building blocks must conform to regulatory requirements wherever they are deployed.

#6 Deleting records in databases, by default, preserves logical records (soft delete), except where hard deletion is mandated by law. (RECOMMENDED REPLACEABLE)

Deletion preserves logical records for auditing, except when hard deletion is explicitly required by regulation or user request.

All deletions MUST be timestamped and traceable.

#7 All data is exportable in both machine-readable (e.g. JSON, XML, CSV) and human-readable formats. (RECOMMENDED REPLACEABLE)

Each Building Block defines and publishes its data model and metadata schema following the GovStack Schema Registry specification. Metadata should comply with DCAT-AP, Dublin Core, or ISO 11179 principles.

All stored data is exportable in:

• Machine-readable formats (JSON, XML, CSV), and

• Human-readable formats (PDF, TXT, HTML).

APIs SHOULD expose an endpoint for exporting individual or bulk records.

#8 Data Lineage and Provenance Tracking (RECOMMENDED EXTENSIBLE)

Every Building Block should track the origin, transformations, and usage of data elements.

Metadata MUST capture:

• source system ID,

• timestamps of modification,

• responsible service or agent.

This ensures traceability and auditability across services.

#9 Data Quality and Validation (RECOMMENDED EXTENSIBLE)

Data validation is automated at ingestion and update points. Constraints are declared in schemas (e.g., JSON Schema, XML Schema). Quality metrics (completeness, accuracy, timeliness) are monitored through observability mechanisms.

#10 Data Retention and Archival Policy (RECOMMENDED EXTENSIBLE)

Retention periods are defined per data type. Archived data is stored securely, in compliance with encryption and access control policies. Retention and destruction events is logged for compliance.

#11 Data Sovereignty and Localization (RECOMMENDED EXTENSIBLE)

Building Blocks supports data residency requirements based on national regulations. Sensitive data is possible to remain within the jurisdiction unless explicitly exempted by legal agreement.