Data Owner, Custodian, and Steward: Who Is Responsible for What
A data owner is accountable for a dataset, classifying it and deciding who may access it. A data custodian operates the controls, such as storage, backups, and access mechanisms. A data steward manages quality, definitions, and correct use. In privacy law, the controller decides why and how personal data is processed; the processor handles it on their behalf.
The operational roles
Most security frameworks, including the material covered in CISSP asset security, describe roughly the same set of roles. Titles vary between organisations; the separation of responsibilities is what matters.
Data owner
Usually a senior business role accountable for a dataset. The owner classifies it, decides who may access it and for what purpose, sets retention requirements, and accepts risk. The owner does not usually operate systems; they make decisions and are answerable for them.
Data custodian
Usually IT, platform, or database teams who implement and operate the controls the owner requires: storage, encryption, backups, access mechanisms, and logging. Custodians carry out decisions; they should not be deciding who gets access to data they merely host.
Data steward
Responsible for data quality and meaning: definitions, metadata, business rules, and whether data is used appropriately. Stewards are often embedded in business teams and bridge between owners and technical staff.
Data user
Anyone who accesses data to do their job, within the permissions the owner approved and the custodian implemented.
The legal roles
Privacy laws such as the GDPR define roles by what an organisation does with personal data, not by job title.
- Controller: the organisation that determines the purposes and means of processing personal data. It carries primary legal responsibility, including breach notification obligations.
- Processor: an organisation that processes personal data on the controller's behalf, such as a cloud or payroll provider, under a contract. Processors have their own obligations, including notifying the controller of breaches.
- Data subject: the individual the data is about.
A vendor breach is often a processor breach, which is why the controller still has to act when its customers' data is exposed at a supplier.
Why the split matters
Separating decision from operation creates a check. If the people who run the database can also grant themselves and others access without anyone accountable reviewing it, access grows unchecked. If owners decide but nobody implements, controls exist only on paper.
The split also prevents a common failure: data with no owner. Unowned datasets, such as exports, test copies, and legacy tables, are the ones nobody classifies, nobody reviews access to, and nobody deletes. They show up disproportionately in breaches.
During an incident
When data may be exposed, several decisions need an accountable person quickly: which systems to isolate, whether to take a service offline, which records are in scope, and whether notification thresholds are met. Knowing the owner of each affected dataset in advance removes a slow and stressful search during the incident.
Custodians supply the facts, such as logs, access records, and backup status. Owners, with legal and privacy advisers, make the decisions. Stewards help establish what the affected data actually contains and means, which is often less obvious than it seems.
Common confusions
- The DBA is not the owner. Administering a database makes someone a custodian of its data, not the person who decides who may use it.
- The system owner is not always the data owner. A platform team may own an application while business units own the different datasets it holds.
- Controller and owner are different concepts. Controller is a legal role held by an organisation; owner is an internal accountability assigned to a person or role.
- Stewardship is not security. A steward ensuring definitions are correct does not replace the owner's decisions about access and classification.
Putting it into practice
- Keep a data inventory that lists, for each significant dataset, its owner, custodian, classification, and retention period.
- Route access requests to owners for approval, and have custodians implement them.
- Review access periodically, with owners signing off.
- Assign owners to exports, copies, and test datasets, not just primary systems.
- Record the controller and processor relationship for every vendor handling personal data.
Frequently asked questions
- What is the difference between a data owner and a data custodian?
- The owner is accountable for the data and makes decisions about classification, access, and retention. The custodian implements and operates the technical controls that enforce those decisions, such as storage, encryption, backups, and access mechanisms. Owners decide; custodians execute and maintain.
- What does a data steward do?
- A data steward manages the quality and meaning of data: definitions, metadata, business rules, and whether it is used appropriately. Stewards are often part of business teams and connect owners with technical staff. Their focus is correct and consistent use of data rather than security controls.
- What is the difference between a data controller and a data processor?
- They are legal roles under privacy laws such as the GDPR. The controller determines why and how personal data is processed and carries primary responsibility. The processor handles personal data on the controller's behalf under contract. A cloud provider or payroll vendor is typically a processor for its customers.
- Why do data roles appear in CISSP?
- Data roles are part of the asset security domain because protecting information starts with knowing who is accountable for it, who operates its controls, and who may use it. Clear roles underpin classification, access control, retention, and incident decisions, which are all central to managing information security.