Data Roles and Responsibilities

Data Owner and Data Controller

Effective data governance requires clearly defined accountability for every data asset the organization holds. Without explicit role assignments, responsibilities blur, security controls go unenforced, and compliance obligations fall through the gaps. The data owner and data controller roles address the highest-level accountability questions: who is ultimately responsible for the data, and who decides how it is used.

Data Owner

The data owner is the individual or department with ultimate accountability for a specific data asset. This is typically a senior leader or manager, not a technical role. Data owners are responsible for the data under their organizational authority, even if they do not personally manage the technical systems that store it.

• Organizational, not technical: The VP of Sales owns customer relationship data not because they manage the CRM database, but because customer relationships fall within their organizational scope. The Treasurer owns financial data. Human Resources owns employee records. The role follows organizational responsibility, not technical system ownership.
• Accountability: The data owner is ultimately accountable if that data is improperly used, disclosed, or protected. If a data breach involves customer relationship data, the VP of Sales carries ultimate organizational accountability, even if the breach occurred through a technical vulnerability in a system they did not personally manage.
• Responsibilities: Data owners commonly classify data sensitivity (assigning the appropriate sensitivity label), approve access permissions (who is authorized to access this data), define retention requirements (how long the data should be kept), and establish acceptable data usage policies.
• Works with security: Data owners do not implement security controls themselves. They work with IT and security teams to ensure controls align with the data's classification and business requirements. They approve the security posture of systems that hold their data.

Data Controller

The data controller is the entity that determines the purposes for which, and the means by which, personal data is processed. This concept is especially significant under privacy regulations like GDPR, which places primary legal responsibility on the data controller.

• Decision-making role: The data controller decides why data is collected, what data is required, how it is used, and how long it is retained. The controller does not necessarily handle the data directly but makes the fundamental decisions about processing.
• Legal responsibility: Privacy laws place significant legal responsibility on data controllers. Under GDPR, the controller must ensure that processing activities are lawful, that data protection requirements are followed, and that data subjects' rights are respected.
• Controller responsibilities: Defining processing objectives, approving third-party processing arrangements, ensuring legal compliance, managing data subject requests (right of access, deletion, portability), and maintaining records of processing activities.
• Controller vs. owner: In many organizations, the data owner and data controller are effectively the same person — the senior leader accountable for the data is also the one who decides how it is processed. The distinction matters most in the context of privacy regulations and when third-party processors are involved.

Data Processor and Third-Party Processing

Data Processor

A data processor is an entity that processes personal data on behalf of the data controller. The fundamental distinction between a controller and a processor is authority: the controller decides why and how data is processed; the processor carries out those decisions following the controller's instructions.

• Follows instructions: Data processors do not determine why data is processed. They act according to the controller's documented instructions. A processor that begins making independent decisions about data use may become a co-controller under privacy regulations, changing its legal obligations.
• Third-party processors: Processors are frequently external to the organization — payroll companies, cloud service providers, managed service providers, marketing platforms, HR systems vendors. Outsourcing data processing does not remove the controller's responsibility for ensuring that processing is compliant and secure.
• Security obligations: Although processors follow the controller's instructions, they are still independently responsible for implementing appropriate security controls to protect the data they process. A processor's security failure that exposes the controller's data creates liability for both the processor and the controller.
• Data processing agreements: Under GDPR, controllers must enter into a data processing agreement with each processor. The agreement specifies: what data is processed, for what purpose, what security measures are required, how breaches are reported to the controller, and how data is returned or destroyed when the relationship ends.

The Payroll Example

The payroll relationship is the classic illustration of the controller-processor distinction used in Security+ training:

• Payroll department (data controller): Determines which employees are paid, what amounts are owed, what the pay schedule is, and what taxes are withheld. Makes all the decisions about what data is collected and how payroll processing must occur. Provides these instructions to the payroll company.
• Payroll company (data processor): Processes the payroll per the instructions received from the payroll department. Has access to employee names, bank account details, salary information, and tax records. Executes the payroll processing, produces the direct deposit transactions, and stores employee records — but only as instructed by the payroll department.
• Key distinction: The payroll company does not decide who gets paid or how much. Those decisions belong to the payroll department (the controller). The payroll company carries out the process. If the payroll company were to independently decide to use employee data for a purpose not instructed by the payroll department, it would be violating the processing agreement and likely privacy law.

Other Common Processor Relationships

• Cloud providers: When an organization stores customer data in a cloud service, the cloud provider is a processor. The organization (controller) decides what data is stored and for what purpose; the cloud provider stores and processes it per the contractual instructions.
• Marketing analytics platforms: An organization sends customer data to a marketing platform to analyze purchasing behavior. The organization is the controller; the marketing platform is the processor.
• Managed Security Service Providers (MSSPs): MSSPs monitoring an organization's logs process data on behalf of the organization. The organization controls what is monitored and retained; the MSSP carries out the monitoring.

Data Custodian, Data Steward, and Operational Data Management

Data Custodian / Data Steward

While data owners hold high-level accountability and data controllers make processing decisions, someone must handle the operational day-to-day work of protecting and managing data. This is the role of the data custodian or data steward — the terms are often used interchangeably, though some organizations distinguish them.

• Works directly with data: Unlike data owners (who may be executives with no direct system access) and data controllers (who make policy decisions), data custodians actually interact with the data systems. They are typically IT staff, database administrators, or information management professionals.
• Data accuracy and privacy: Custodians are responsible for ensuring that the data is accurate, complete, and handled in accordance with privacy requirements. They enforce the data quality and privacy standards set by the data owner and controller.
• Compliance: Data custodians ensure the organization is compliant with applicable laws and regulations for the data under their care. They implement and monitor the technical controls required to maintain compliance.

Sensitivity Labels

One of the most important custodian responsibilities is assigning sensitivity labels to data and enforcing the access controls associated with those labels:

• Public: Information that can be freely shared with anyone, including the general public. No access restrictions. Example: marketing materials, press releases, published annual reports.
• Internal: Information for internal use only. Not for external distribution but not highly sensitive. Example: internal policies, meeting notes, general procedures.
• Confidential: Sensitive information requiring restricted access. Example: business strategy documents, client contracts, employee performance reviews.
• Restricted (or Top Secret/Classified): Highest sensitivity. Access tightly controlled with formal authorization required. Example: security system details, classified government data, trade secrets, source code for critical systems.

The data custodian assigns these labels to data assets and then configures access controls (permissions, DLP policies, encryption requirements) to match the sensitivity level. This creates a chain from classification to protection.

Access Management

Data custodians commonly manage the practical aspects of access control:

• User permissions: granting, modifying, and revoking access rights based on role and need-to-know
• Authentication systems: managing the mechanisms by which users prove their identity before accessing data
• Authorization controls: ensuring that authenticated users can access only the data their role permits
• Periodic access reviews: auditing user access to ensure that permissions remain appropriate and that former employees or role-changers do not retain stale access

Security Control Implementation

Data custodians implement the technical safeguards that protect data confidentiality, integrity, and availability:

• Encryption: Implementing encryption at rest and in transit for sensitive data categories
• Backup and recovery: Managing backup schedules, testing recovery procedures, and ensuring data can be restored if lost or corrupted
• Logging and monitoring: Configuring audit logs to record data access and changes; monitoring those logs for anomalous activity
• Intrusion detection: Deploying and managing security monitoring tools that detect unauthorized access attempts
• Data loss prevention (DLP): Implementing controls that prevent unauthorized exfiltration of sensitive data