Data handlers
1. Data Subject
Who they are: The individual (natural person) to whom the personal data relates. This is the person whose information is being collected, processed, or stored.
What they do: They are the rights-holder under privacy regulations (GDPR, CCPA, etc.). They can exercise rights like access, rectification, erasure, and portability.
Data Lifecycle Stage: Creation/Collection — they are the source of data. They also appear at Disposal when exercising the "right to be forgotten."
CISSP Relevance: Domain 2 (Asset Security) — understanding whose data you protect; Domain 1 (Security & Risk Management) — legal/regulatory compliance.
2. Data Owner
Who they are: A senior-level individual (often a business unit head or C-level executive) who has ultimate accountability for a specific dataset. They "own" the data from a business perspective.
What they do:
- Determines data classification and sensitivity levels
- Authorizes access and approves data sharing
- Ensures data quality and proper use
- Bears responsibility for data breaches within their domain
Data Lifecycle Stage: Present across all stages, but most active at Creation/Collection (classification decisions) and Use/Sharing (access authorization).
CISSP Relevance: Domain 2 (Asset Security) — data classification and ownership; Domain 5 (Identity & Access Management) — access control decisions.
3. Data Auditor
Who they are: An independent party (internal or external) responsible for reviewing and verifying that data handling practices comply with policies, standards, and regulations.
What they do:
- Conducts audits of data access logs and processing activities
- Verifies compliance with data protection regulations
- Identifies control gaps and non-compliance
- Produces audit reports for management and regulators
Data Lifecycle Stage: Primarily active during Use/Processing and Retention stages, but audits can span the entire lifecycle.
CISSP Relevance: Domain 1 (Security & Risk Management) — governance, risk, and compliance; Domain 7 (Security Operations) — monitoring and auditing.
4. Data Steward
Who they are: Operational-level role responsible for day-to-day management and oversight of data assets on behalf of the Data Owner. They are the "hands-on" custodians.
What they do:
- Implements data policies and standards set by the Data Owner
- Manages data quality, metadata, and documentation
- Handles data access requests and user provisioning
- Ensures data is properly labeled, stored, and maintained
Data Lifecycle Stage: Active across all stages, particularly Storage, Use/Processing, and Retention.
CISSP Relevance: Domain 2 (Asset Security) — data handling and maintenance; Domain 5 (Identity & Access Management) — operational access control.
5. Data Controller
Who they are: The entity (person, organization, or authority) that determines the purposes and means of processing personal data. They make the "why" and "how" decisions.
What they do:
- Decides what data to collect and for what purpose
- Determines legal basis for processing (consent, contract, legitimate interest, etc.)
- Bears primary legal responsibility for data protection compliance
- Must maintain records of processing activities (ROPA)
Data Lifecycle Stage: Creation/Collection (deciding what to collect and why), Use/Processing (determining how data is used), and Disposal (retention schedules).
CISSP Relevance: Domain 1 (Security & Risk Management) — legal/regulatory compliance; Domain 2 (Asset Security) — data governance.
6. Data Processor
Who they are: An entity that processes personal data on behalf of the Data Controller. They do not decide the purpose or means — they execute the Controller's instructions.
What they do:
- Performs operations like storage, retrieval, analysis, or transmission
- Must process data only per the Controller's documented instructions
- Implements security measures to protect data
- Must notify the Controller of breaches
- Often requires a Data Processing Agreement (DPA)
Data Lifecycle Stage: Primarily Storage, Use/Processing, and sometimes Sharing (if sub-processors are involved).
CISSP Relevance: Domain 2 (Asset Security) — third-party/vendor risk; Domain 1 (Security & Risk Management) — contractual and legal obligations.
7. Data Custodian
Who they are: The technical/IT professional responsible for the physical and logical protection of data assets. Unlike the Data Steward (business-focused) or Data Owner (accountability-focused), the Custodian is hands-on technical — they manage the systems, infrastructure, and controls that house the data.
What they do:
- Implements and maintains security controls (encryption, backups, access controls)
- Manages storage infrastructure, databases, and cloud environments
- Performs backups, recovery, and disaster recovery operations
- Configures and monitors technical access controls (firewalls, permissions, DLP)
- Ensures data availability, integrity, and confidentiality at the technical layer
- Handles data migration, archiving, and secure deletion
Data Lifecycle Stage: Active across all stages, but most critical during:
- Storage — managing where and how data resides
- Use/Processing — maintaining system availability and performance
- Retention — enforcing retention policies and archival
- Disposal — executing secure deletion, degaussing, or destruction
CISSP Relevance:
- Domain 2 (Asset Security) — data handling requirements, classification enforcement
- Domain 3 (Security Architecture & Engineering) — designing secure storage and processing systems
- Domain 7 (Security Operations) — backup, recovery, and monitoring
- Domain 5 (Identity & Access Management) — technical access control implementation
How Data Custodian Differs from Data Steward
| Aspect | Data Custodian | Data Steward |
|---|---|---|
| Focus | Technical protection | Business/data quality |
| Responsibility | How data is secured | What data means and how it's used |
| Tasks | Backups, encryption, patching | Metadata, quality rules, access requests |
| Reports to | IT/Security leadership | Data Owner / Business unit |
| CISSP Domain | 2, 3, 7 | 2, 5 |
Simple analogy: The Data Owner is the homeowner, the Data Steward is the property manager who handles tenant rules, and the Data Custodian is the security guard and maintenance crew who physically protect and maintain the building.
Summary Table
| Role | Primary Responsibility | Key Lifecycle Stage | CISSP Domain |
|---|---|---|---|
| Data Subject | Rights-holder | Creation/Collection | 1, 2 |
| Data Owner | Accountability & classification | All (esp. Creation, Use) | 2, 5 |
| Data Auditor | Compliance verification | Use, Retention | 1, 7 |
| Data Steward | Operational data management & quality | All stages | 2, 5 |
| Data Custodian | Technical protection & infrastructure | Storage, Retention, Disposal | 2, 3, 7 |
| Data Controller | Determines purpose & means | Creation, Use, Disposal | 1, 2 |
| Data Processor | Executes processing on behalf | Storage, Use, Sharing | 1, 2 |
Top comments (0)