Data roles and responsibilities

Asset security works only when everyone knows who decides, who does the work and who answers when something goes wrong. The 2024 outline lists the data roles the CISSP expects you to know as part of managing the data life cycle: owners, controllers, custodians, processors, users and subjects. Some of these terms come from management practice and some from privacy law, and they overlap in ways that confuse many candidates. This lesson defines each role, shows how the roles fit together in a typical organization and in an outsourced cloud arrangement, and gives you a way to answer the frequent exam question: who is responsible here?

The business roles

The data owner, sometimes called the information owner or business owner, is the senior person accountable for a set of data or an information asset. The owner is usually a business manager, not a technologist: the head of human resources owns employee records, the chief financial officer owns the general ledger, the head of sales owns the customer relationship database. The owner decides the classification, approves who may have access and at what level, sets or approves handling and retention requirements within policy and law, and accepts residual risk for the asset. Owners are also responsible for ensuring that the controls they require are funded and working, which is why ownership should sit with someone who has budget and authority.

The system owner is accountable for a system that processes data, such as an application or a platform. The system owner makes sure the system meets the security requirements set by the data owners whose data it holds, plans for maintenance and patching, and handles authorization to operate where that process exists. One person can be both data owner and system owner, but in larger organizations the roles are often separate: the payroll application's system owner may sit in IT, while the payroll data owner sits in human resources.

The custodian is the person or team responsible for the day-to-day protection of data on the owner's behalf. Custodians implement the controls the owner specifies: they configure access, take and test backups, apply patches, maintain encryption, keep logs and restore data when needed. Database administrators, system administrators, storage teams and managed service providers commonly act as custodians. The key distinction is that the custodian does what the owner decides; the custodian does not decide the classification or approve access on their own authority.

The administrator, a role some sources list separately, grants and revokes access according to the owner's decisions, often through an identity and access management system. Users are people who access and use data to do their jobs. Users must follow policy and handling rules, protect their credentials and report incidents, but they do not decide classification or grant access. Finally, auditors, whether internal or external, review whether the controls are designed well and working as intended, and report independently to management or the board.

The privacy law roles

Privacy laws use a different vocabulary, originating largely in European data protection law and now found worldwide. The data subject is the identifiable living person the personal information is about: a customer, an employee, a patient. The data controller is the organization that determines the purposes and means of processing personal data, in other words, why and how it is processed. The data processor is an organization that processes personal data on behalf of the controller and under its instructions, such as a payroll service, a cloud email provider or a marketing agency sending emails for a client. Under the European Union's General Data Protection Regulation (GDPR), controllers carry primary responsibility, processors have their own direct obligations such as security and record keeping, and the relationship must be governed by a written contract under Article 28.

US privacy laws use various terms for the same roles. HIPAA distinguishes covered entities, such as health plans and most health care providers, from business associates that create, receive, maintain or transmit protected health information on their behalf, and requires a business associate agreement between them. State comprehensive privacy laws such as the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA) use business and service provider or contractor, while many other states, such as Virginia and Colorado, use controller and processor. GLBA's Safeguards Rule requires financial institutions to oversee their service providers through selection, contracts and periodic assessment.

Mapping between the business roles and the privacy roles helps on the exam. The organization as a whole is usually the controller; inside it, a named data owner exercises the controller's decisions for a particular data set. An outsourced provider is usually the processor and also acts as a custodian for the data it handles. The data subject is the person the data describes, and is never the owner in the management sense, although privacy laws give subjects rights over their data, including access and correction, and in some jurisdictions deletion and portability.

Other roles you may meet

Several further roles appear in organizations and in exam questions. A data steward is responsible for the quality, definitions and proper use of data within a business area, a role common in data governance programs. Stewards help owners by maintaining data dictionaries, resolving quality problems and making sure data is used consistently, but they do not replace owners' accountability. A chief data officer leads data governance and data strategy at the executive level. A privacy officer or data protection officer advises on privacy law and monitors compliance; the GDPR requires a data protection officer for some organizations, and Canadian and US laws require or encourage a designated privacy lead. The chief information security officer sets security policy and leads the security program, but is not the owner of business data.

Responsibilities in the cloud

Cloud services make the roles more important, not less. Under the shared responsibility model, the cloud provider secures the underlying infrastructure while the customer remains responsible for its data, its identities and access, and the configuration of the services it uses. The split shifts with the service model. With infrastructure as a service, the customer manages operating systems, applications and data; with platform as a service, the provider manages more of the stack; with software as a service, the provider runs almost everything, but the customer still owns the data and decides who can access it. In every model the customer is the controller and the data owner remains accountable, which is why so many cloud breaches stem from customer-side misconfigurations rather than provider failures.

Contracts make roles real

Roles across organizations are defined in contracts. A processing agreement, business associate agreement or data protection addendum should set out what data is processed and why, the security controls required, confidentiality obligations for the processor's staff, rules for engaging sub-processors, breach notification timelines, audit and assessment rights, assistance with data subject requests, data location, and what happens to the data at the end of the contract: return, destruction or both, with evidence. Lesson 8 returns to the last point, because providers' backups and replicas often outlive the main copy. A role that exists only in an organization chart, without contract terms, policy and funding behind it, will not survive the first incident.

Separation and conflicts

Role design should respect separation of duties from Domain 1. The person who approves access should not be the one who grants it without oversight; the administrator who manages backups should not be able to delete the logs that record their own actions; the custodian should not also audit their own work. In small organizations one person may hold several roles, and compensating controls such as independent review, logging and periodic access recertification help reduce the risk. Access recertification, in which owners periodically confirm that each user still needs their access, is one of the most effective ways for owners to exercise their accountability in practice.

Thinking like a manager

Exam scenarios often describe a problem and ask who should act. If the question is about deciding classification, approving access or accepting risk, the answer is the owner. If it is about running backups, patching or restoring, the answer is the custodian. If it is about the purposes and means of processing personal data, the answer is the controller; if about processing on someone else's behalf, the processor. And if a scenario tempts you to let the security team or IT make a business decision on the owner's behalf, be wary: security advises, the owner decides, and the custodian implements.