What is a data owner?
A data owner is the person accountable for a specific set of data, usually a senior leader in the business unit that creates or depends on it rather than someone in IT. The vice president of human resources owns employee records, the CFO owns the general ledger, and the head of sales owns the customer pipeline. A large organization has many data owners, each named for a data set. Ownership sits in the business because the business understands what the data is worth and what happens if it leaks, is lost or is wrong. IT knows how the payroll database runs; HR knows what happens if salaries leak or paychecks are wrong.
What a data owner decides
- Classification: which label the data carries under the classification policy, such as Confidential or Restricted.
- Access: who may read or change the data, which in practice means approving access requests and confirming access in periodic reviews.
- Use and sharing: whether the data may go to a vendor, a partner or another department.
- Retention: how long it is kept, within legal limits and the retention policy.
- Risk acceptance: whether to accept a risk when a control is expensive or inconvenient.
An owner can delegate tasks but not accountability. If an auditor asks why a contractor could read every employee's salary, the answer has to come from the owner.
Example: an access request
A finance analyst asks for read access to payroll data for a budgeting project. The request goes to the vice president of human resources as data owner, who approves read-only access for 90 days. A database administrator, acting as data custodian, then adds the analyst to the read-only payroll group and sets the expiry date. If the administrator had granted access because a manager asked in the hallway, the custodian would have made the owner's decision, and the audit trail would show a change with no owner approval behind it.
Data owner vs. custodian, steward, system owner and controller
| Role | Focus |
|---|---|
| Data owner | Decides classification, access, sharing, retention and risk |
| Data custodian | Implements permissions, encryption, backups and patching, usually in IT |
| Data steward | Keeps data accurate and properly used: definitions, metadata, label accuracy |
| System owner | Responsible for an application or platform, which may hold several owners' data |
| Data controller | The organization that decides why and how personal data is processed under privacy laws such as GDPR |
| Data processor | An organization that processes personal data on the controller's instructions |
Controller and owner sit at different levels. The controller is the legal entity; the owner is the internal person accountable for one data set. A retailer is the controller of its customer data, and its marketing vice president may be the owner of the mailing list. The CISO is a frequent distractor: the CISO runs the security program and writes the policy that tells owners how to classify, but does not own the business's data. A data protection officer advises on and monitors privacy compliance but does not make the owner's decisions.
Data owner on the CompTIA Security+ exam
Data roles fall under SY0-801 objective 3.3, which deals with knowing what data an organization holds and how it is protected. Wording such as "who should determine the classification", "who approves access to the data" or "who is accountable for the data set" points to the data owner. Look for the verb: decides, approves, classifies and accepts risk belong to the owner, while implements, configures, backs up and maintains belong to the custodian. If the scenario is about personal data under a privacy law and asks which organization decides the purpose of processing, the answer is the data controller instead. Common distractors are the CISO, the database administrator, the data steward and the system owner.