What is a data custodian?
A data custodian has day-to-day care of data and carries out the protections the data owner has decided on. Custodians are usually IT staff: database administrators, system and storage administrators, backup operators and cloud operations teams. The owner decides what should happen to the data; the custodian makes it happen and keeps it running. A custodian holds technical control of the data without holding the authority to decide how it is classified or who may use it.
What a data custodian does
- Configures permissions and group memberships, but only as the owner has approved.
- Turns on encryption at rest and in transit and handles keys through the key management process.
- Runs backups, protects the backup copies and tests restores.
- Patches and hardens the servers, databases and storage that hold the data.
- Monitors for integrity problems, failed jobs and unusual access, and keeps the logs.
- Applies retention schedules and secure disposal according to policy.
Example: owner decides, custodian implements
A sales operations contractor needs read access to the CRM for a six-month engagement. The ticket shows the split:
| Step | Who | Action |
|---|---|---|
| Request | Sales operations manager | Asks for read-only CRM access for the contractor |
| Approval | Head of sales (data owner) | Approves read-only access until the contract end date |
| Fulfillment | CRM administrator (data custodian) | Creates the account in the read-only role with an expiry date matching the contract |
The same owner's policy says customer exports are Restricted, so the custodian also enables database encryption, keeps the keys in the key management system and confirms that nightly backups of the CRM are encrypted. This split is a form of separation of duties: the person who decides access is not the person who technically grants it, so a change with no matching owner approval stands out in an audit. When a custodian spots a problem, such as CRM exports landing unencrypted on a file share, the right move is to raise it with the owner, who decides how to fix it or whether to accept the risk.
Data custodian vs. data steward, owner and processor
- Data owner: the accountable business leader who classifies the data, approves access and accepts risk.
- Data steward: looks after the data's quality and proper use, such as definitions, metadata, fixing duplicates and checking that records carry the right labels. Stewards are usually subject-matter experts in the business. A common split is that the steward handles what the data means and whether it is right, and the custodian handles keeping it safe and available. Some organizations merge the roles or draw the line differently.
- Data operator: people who work with the data hands-on, such as entering records and running reports, under rules others set.
- Data processor: under privacy law, a separate organization that processes personal data for a controller. An in-house administrator is a custodian, not a processor.
The word custodian also appears in two unrelated senses. Chain of custody is the record of who handled a piece of evidence. In e-discovery, a custodian is any person whose files or mailbox may hold information relevant to a legal matter. Neither is the data custodian role.
Data custodian on the CompTIA Security+ exam
Data roles fall under SY0-801 objective 3.3, which deals with knowing what data an organization holds and how it is protected. Scenario wording that describes someone who implements, configures, backs up, encrypts, patches or maintains data storage, especially an administrator acting on someone else's approval, points to the data custodian. If the person decides the label, approves access or is accountable for the data, it is the owner. If the person maintains definitions, metadata or data quality, it is the steward. Distractors often include the data controller and data processor, which are privacy-law roles for organizations rather than internal IT duties.