Data Roles and Responsibilities

1. The Vice President of Sales at a publicly traded company is identified as the data owner for all customer relationship data. She has never logged into the CRM system and does not manage the database servers. Why is she the data owner, and what are her primary responsibilities in that role?

A. She is data owner because she created the CRM system; her responsibility is to configure access permissions in the database B. She is data owner because customer relationships fall within her organizational authority; her responsibilities include classifying data sensitivity, approving access permissions, defining retention requirements, and being ultimately accountable for proper use and protection of that data C. She cannot be data owner because she does not have technical access to the data; data ownership requires direct system access D. She is data owner because she is the most senior person in the organization; all data belongs to the most senior available executive

2. A company's payroll department determines which employees are paid, their salary amounts, pay schedules, and tax withholdings. They send this information to an external payroll company that processes direct deposits and maintains employee records. What is the correct role classification for each party?

A. The payroll department is the data processor because they create the original payroll data; the payroll company is the data owner because they store employee records B. The payroll department is the data controller because they determine the purposes and means of payroll processing; the payroll company is the data processor because they process the data according to the department's instructions C. Both parties are data controllers because both have access to employee data D. The payroll company is the data controller because they manage the data systems; the payroll department is the data custodian because they maintain the records

3. A healthcare organization stores patient records in a cloud platform. A breach at the cloud provider exposes patient data. The cloud provider claims they are not responsible because they were just storing what the hospital gave them. Under HIPAA data governance, what is the cloud provider's actual security obligation?

A. The cloud provider has no responsibility; the hospital as data owner is solely responsible for all security controls B. The cloud provider, as data processor (and HIPAA business associate), is independently responsible for implementing appropriate security controls to protect the PHI they process; a business associate agreement must be in place C. The cloud provider is responsible only if they were contractually required to encrypt the data; otherwise no responsibility D. The cloud provider is responsible only if they sold the data; passive storage is not considered processing under HIPAA

4. A data custodian is assigning sensitivity labels to files in the corporate document management system. She finds a document containing trade secrets about an unreleased product, future acquisition targets, and detailed security system architectures. Which sensitivity label is most appropriate, and what access controls should follow?

A. Internal — all internal documents should be labeled internal regardless of content; access controls are applied uniformly B. Restricted (or Confidential) — trade secrets, acquisition targets, and security architectures are among the most sensitive data categories; access should require formal authorization and be tightly controlled with logging of all access C. Public — unreleased product information should be labeled public so marketing can use it D. Confidential — but no access controls are needed if the document system requires login to access

5. A data controller suffers a breach at its third-party data processor. The controller argues it cannot be held responsible because it outsourced processing to a reputable vendor. What does data governance and GDPR actually say about controller responsibility in this situation?

A. The controller is fully absolved; selecting a reputable processor transfers all legal responsibility to the processor B. The controller cannot escape accountability by outsourcing to a processor; the controller remains responsible for ensuring the processor implements adequate security controls, and must have a data processing agreement in place; both controller and processor may face regulatory consequences C. The controller is absolved as long as the processor signed a non-disclosure agreement before the breach D. GDPR only applies to the processor because they were the ones who held the data; the controller faces no regulatory liability

6. An IT administrator is responsible for managing access permissions to the company file server, implementing encryption for sensitive directories, configuring audit logging of file access, and running backup jobs nightly. Which data governance role best describes this administrator's function?

A. Data owner — the administrator has the highest level of access to the data and therefore owns it B. Data custodian (or data steward) — the administrator manages the day-to-day operational protection, access controls, technical safeguards, and monitoring of the data C. Data controller — the administrator controls access to the data and therefore determines how it is processed D. Data processor — the administrator processes data access requests submitted by users

Matching: Data Governance Roles

Match each role (1–4) to its correct description (A–D).

1Data Owner

2Data Controller

3Data Processor

4Data Custodian

ADetermines the purposes for which and means by which personal data is processed; bears primary legal responsibility under privacy regulations for lawful data use

BSenior organizational leader accountable for a specific data asset; classifies sensitivity, approves access, defines retention, and is ultimately responsible even without direct technical access

CManages day-to-day operational protection of data; assigns sensitivity labels, manages permissions, implements encryption, backups, and audit logging

DProcesses personal data on behalf of and under the instructions of another entity; often a third party such as a payroll company, cloud provider, or managed service provider

Data Roles and Responsibilities — Quiz