GRC Data roles and responsibilities

Data Owner

Usually a high-level executive (e.g., VP of Sales, Treasurer) who is legally responsible for a data set, classifying it, and deciding who has access.

Data Custodian

A custodian turns security policies into action by setting permissions on a file share, configuring SQL firewalls, or running backups.

Data Processor

Acts on behalf of the Data Controller to handle, store, or process the data (e.g., a third-party payroll provider).

Data Controller vs. Processor

Data Controller: Determines the "Why" and "How" (the purpose and means)

Data Controller

Defines how and why data is collected and used (e.g., the HR department managing employee records).

Data Steward

A steward ensures that data is properly labeled and that privacy rules (e.g., GDPR) are applied to the business logic of the data.

Difference from Custodian: Stewards focus on data content and business rules, while Custodians focus on technical systems and storage.

Privacy Officer / DPO (Data Protection Officer)

A mandatory position in many organizations responsible for ensuring compliance with regulations like GDPR or HIPAA.