A breach notice lands on a CISO's desk: the company's payroll provider used a cloud storage service that exposed employees' tax forms. Within an hour three questions come up. Who decided the data could go to that provider? Who was supposed to configure its protection? Who has to tell the regulator? Each question has a different answer, and each answer is a role.
On the CompTIA Security+ SY0-801 exam, data roles sit under objective 3.3, which expects you to know who answers for data and what each role is responsible for. This lesson covers the internal governance roles (owner, custodian, steward and operator) and the privacy-law roles (controller, processor and subprocessor), and shows how scenario wording points to each one. The thread running through all of them is the difference between who decides and who does the work.
The data owner is the business leader accountable for a data set
The data owner is a senior person in the business, usually not in IT, who is accountable for a specific data set. The vice president of human resources owns employee records. The CFO owns the general ledger. The head of sales owns the pipeline in the CRM. Owners are named per data set, so a large organization has many of them.
The owner makes the decisions about that data:
- Its classification label, under the organization's classification policy.
- Who may access it and at what level, which in practice means approving access requests.
- How it may be used and shared, including whether it may go to a third party.
- How long it must be kept, within the limits set by law and the retention policy.
- How much risk to accept when a control is expensive or inconvenient.
Ownership sits in the business because the business understands the data's value and the harm of losing it. IT knows how the payroll database works; HR knows what happens if salaries leak or paychecks are wrong. The owner can delegate tasks but not accountability. If an auditor asks why a contractor could read every employee's salary, the answer has to come from the owner.
Don't confuse the data owner with a system owner. The system owner is responsible for an application or platform, such as the HR system as a whole, including its patching and availability. One system can hold data from several data owners.
On the exam, wording such as "who should determine the classification", "who approves access" or "who is ultimately accountable for the data" points to the data owner. The CISO is a tempting distractor. The CISO builds the security program and the policies that tell owners how to classify, but doesn't own the business's data.
The data custodian implements the controls the owner chose
The data custodian has day-to-day possession of the data and implements the protections the owner decided on. Custodians are usually IT: database administrators, system and storage administrators, backup operators and cloud operations teams.
Typical custodial duties include configuring permissions and group memberships, turning on encryption and managing its keys through the key management process, running backups and testing restores, patching the servers and databases that hold the data, and monitoring for integrity problems. A custodian's access request work looks like this:
REQ-20431 Access request: SG-HR-Payroll-Read for jsmith
Requested by: jsmith (finance analyst)
Approved by: M. Ortiz, VP Human Resources (data owner) 2026-10-19 14:02
Fulfilled by: k.lee, database team (data custodian) 2026-10-19 15:37
Change: jsmith added to SG-HR-Payroll-Read
The owner decided; the custodian carried it out. If a database administrator grants access because a manager asked in the hallway, without the owner's approval, the custodian has stepped outside the role. The reverse also applies: a custodian who notices that payroll exports land unencrypted on a file share should raise it with the owner, who decides what to do and whether to accept the risk.
This split is a form of separation of duties. The person who decides access isn't the person who technically grants it, so an access change with no matching owner approval stands out in any audit.