Safety Norms: Database Administration and Data Engineering

1Purpose, Scope, and Safety Principles

These norms apply to anyone who administers database platforms, designs or operates data pipelines, or changes data stores, including employees, contractors, and students working under supervision. They cover on-premises server rooms, colocation facilities, cloud consoles, laptops used for remote administration, and laboratory environments. They do not replace employer safety programs, facility rules, or manufacturer manuals.

Three principles guide every rule below. First, people come before uptime: no one works in an unsafe physical area to restore a service. Second, least privilege and separation of duties limit what any single person can change. Third, every change must be reversible, recorded, and reviewed. Rules marked mandatory are required by this document or by a local policy adopted from it. Recommendations describe good practice that teams should adopt unless a documented reason exists not to.

2Roles, Competence, and Accountability

The data platform owner is accountable for the safe operation of each database service, including its access model, backup regime, and retention rules. The database administrator performs configuration, patching, performance tuning, and recovery. The data engineer builds and maintains pipelines, schema transformations, and scheduled jobs. A data protection lead approves the handling of personal or regulated data. The facilities or site manager controls physical access, power, cooling, and fire systems in any room that houses equipment. Each role must be named in a current responsibility register.

Competence means documented training and supervised experience on the specific platform, not general familiarity. Privileged access is granted only after the requester completes platform-specific training, signs the acceptable use terms, and receives approval from the platform owner. Work on electrical distribution, uninterruptible power supplies, battery banks, generators, or rack-mounted hardware is outside the scope of database staff and must be performed by qualified facilities or vendor technicians.

• Mandatory: no one performs production changes without an approved change record and a named reviewer.
• Mandatory: contractors receive the same access briefing and site induction as employees before entering any server room.
• Recommendation: assign a deputy for each privileged role so that work stops safely when the primary person is unavailable.

3Hazard Identification and Risk Assessment

Database and data engineering work involves physical, electrical, ergonomic, chemical, and information hazards. Physical hazards include lifting heavy chassis, sliding racks, and working near raised floors and cable trays. Electrical hazards include energized power distribution units, stored energy in battery systems, and residual charge in power supplies. Ergonomic hazards arise from long periods at workstations, poor screen placement, and repetitive keyboard use during migrations. Chemical and environmental hazards include lead-acid batteries, refrigerant leaks from cooling systems, and disposal of failed drives. Information hazards include exposure of personal data, credentials stored in scripts, and corrupted records that harm customers or the public.

Each platform must have a written risk assessment that rates likelihood and severity on a simple scale, such as low, medium, and high, and records control measures and residual risk. Assessments must be revisited when hardware changes, when a new facility is used, and after any incident. Public harm is a primary concern where databases support healthcare records, payment processing, transport scheduling, utilities, or emergency communications. In these settings the assessment must consider how data errors and downtime affect people outside the organization.

• Example: a migration script that drops a patient or payment table is high severity and requires a rehearsed rollback plan before execution.
• Example: replacing drives in a live rack presents pinch and lifting hazards, so two people and a mechanical lift are required.
• Example: a pipeline that exports customer addresses to an unapproved storage bucket is a privacy incident with potential public impact.

4Preventive Controls and Safe Work Practices

Preventive controls reduce the chance that a hazard becomes harm. Changes to production systems follow a staged path: design, peer review, testing in a non-production environment using masked or synthetic data, approval, execution in an agreed window, verification, and closure. Each change record states the expected effect, the rollback method, the time required to restore service, and the person who decides whether to roll back. Automated migration tools must not be run against production by a single person without a second reviewer present or available on call. Changes should be rehearsed against a recent copy of the production schema so that timing and locking behavior are understood before the live run.

Physical work in server rooms follows a separate set of controls. Staff must not enter raised floor voids or climb onto racks. Equipment is lifted using approved lifts or carts, never by hand beyond the manufacturer's stated limits. Work on power distribution, uninterruptible power supplies, and battery strings is performed only by qualified technicians under a permit to work. Permits record the scope, isolation points, the person in charge, and the expected end time. Where isolation is required, lock-out and tag-out procedures apply and must be verified with a suitable test instrument before work starts. Permits are closed in writing when work finishes, even if the work was not completed.

• Mandatory: no production schema change, data deletion, or access grant is executed without a recorded approval from the data platform owner.
• Mandatory: destructive commands such as drop, truncate, and bulk delete require a verified backup taken within the agreed window and a documented restore test.
• Mandatory: credentials are stored only in approved secret managers. They are never hard coded in scripts, notebooks, or tickets.
• Mandatory: no one works alone in a server room outside normal hours without an agreed check-in arrangement.
• Recommendation: run long migrations during low-load windows and set query time limits to avoid resource exhaustion.

5Equipment, Environment, Information, and Protective Safeguards

Equipment and facilities must be maintained by their responsible owners. Cooling, fire suppression, and power systems require scheduled inspection against manufacturer instructions and local codes, which vary by jurisdiction. Verify these requirements with the authority having jurisdiction or a qualified engineer. Do not rely on any figure in this document for temperature, humidity, load, or battery limits. Use the values in current vendor documentation and site design records. Racks must be secured to prevent tipping, cable routes must keep walkways clear, and emergency exits must remain unobstructed.

Personal protective equipment is required where a task creates a specific hazard. Safety footwear is required when handling heavy equipment. Cut-resistant gloves are appropriate when removing sheet metal from racks, and eye protection is required when cutting cable ties or working near battery terminals. Hearing protection applies in rooms where cooling noise or generator testing exceeds local exposure guidance. Anti-static wrist straps are recommended for drive handling, but they must never replace electrical isolation. Ergonomic measures include adjustable chairs, monitors set at eye level, and regular breaks from continuous keyboard work.

Information safeguards apply to all data work. Production data copied to development is masked or synthesized unless the data protection lead approves otherwise. Logs and exports are encrypted in transit and at rest where the platform supports it. Screens are locked when unattended, and sensitive output is not printed or left on shared displays. Retention and deletion schedules follow the organization's data policy and applicable privacy law, which is jurisdiction dependent and must be confirmed with legal counsel.

6Incident Reporting, Emergency Response, and Escalation

Every incident, near miss, and unsafe condition is reported within the shift in which it is noticed. This includes database outages, data corruption, unauthorized access, accidental exposure of personal information, electrical smells, overheating equipment, water near racks, and injuries. The person who notices the event makes the immediate area safe, contacts the on-call contact, and records what they observed. They do not attempt to repair energized equipment or open battery enclosures.

Emergency response follows the site plan. For fire, gas, electrical injury, or flooding, staff evacuate, raise the alarm, and contact emergency services using the local number. Nobody re-enters a hazardous area to retrieve equipment. For data incidents, the on-call administrator contains the event by revoking access or halting jobs, preserves logs, and escalates to the platform owner. Where personal data may be exposed, the data protection lead decides on notification obligations. These are jurisdiction dependent and must be checked with the relevant authority or legal counsel within the deadlines those rules set.

• Mandatory: report electrical injury or fire to emergency services first, then notify the site manager.
• Mandatory: do not delete logs, rebuild servers, or overwrite evidence before the incident lead authorizes it.
• Mandatory: suspected security breaches are escalated to the security team immediately, regardless of the hour.
• Recommendation: hold blameless post-incident reviews within a short, agreed period and track actions to closure.

7Records, Training, Inspection, and Review

Records prove that controls operate. Keep current risk assessments, responsibility registers, access approvals, change records, permits to work, inspection reports, backup test results, and incident logs. Records are retained for the period required by internal policy and applicable law, which varies by jurisdiction. Training is refreshed when platforms, tools, or facilities change and whenever an incident reveals a gap. Training records must show who was trained, on what version of the procedure, and who verified competence.

Monitoring and review close the loop. Teams review metrics such as failed changes, rollback events, access exceptions, overdue inspections, and near misses at a regular planning meeting. Trends guide improvements to tooling, documentation, and staffing. This document and every local procedure derived from it should be reviewed when laws, vendor instructions, or organizational structures change, and whenever an incident reveals a weakness. Verify current applicable standards with competent authorities, qualified professionals, and manufacturers.

• Mandatory: all privileged users complete platform and site safety training before first unsupervised access.
• Recommendation: run restore drills on a scheduled basis and record how long recovery actually took, then compare that result with the stated recovery objective.

Implementation checklist

• Confirm your role, privileges, and training are recorded before using any production access.
• Verify a current backup and a tested restore path before running destructive commands.
• Obtain a recorded approval and named reviewer for every production change.
• Use a permit to work and verified isolation before any power or battery related task.
• Lift equipment with approved aids and never climb racks or raised floors.
• Keep credentials in the approved secret manager and mask personal data in non-production copies.
• Report incidents, near misses, and unsafe conditions within the same shift.
• Call emergency services and evacuate for fire, electrical injury, or flooding.
• Confirm that the risk assessment and procedures are current and verified with local authorities.