Privacy Roles and Responsibilities

Privacy Roles and Responsibilities (CDPSE – Privacy Governance)

Introduction
Privacy Roles and Responsibilities is a core topic within the Privacy Governance domain of the ISACA Certified Data Privacy Solutions Engineer (CDPSE) certification. It covers who is accountable for protecting personal data, who carries out privacy tasks, and how those duties are assigned, documented and overseen across an organization and its third parties. Many CDPSE questions are really asking one thing: whose job is this? Answering them well depends on knowing these roles in depth.

Why Privacy Roles and Responsibilities Are Important
1. Accountability is a legal requirement. Regulations such as the GDPR (Article 5(2), the accountability principle), CCPA/CPRA, LGPD, PIPEDA, HIPAA and many others require organizations to show who is responsible for compliance. Without clearly defined roles, an organization cannot prove accountability to regulators.
2. Avoiding gaps and overlaps. When nobody owns a privacy task, it does not get done, for example responding to data subject requests or reporting breaches. When too many people own it, the work is duplicated, inconsistent or contradictory.
3. Supporting privacy by design. Engineers, architects, developers and product owners must know their part in building privacy into systems. Privacy is not only a legal or compliance function.
4. Managing third-party risk. Data processors, sub-processors and vendors handle personal data on the organization's behalf. Their responsibilities must be defined in contracts such as Data Processing Agreements (DPAs).
5. Incident and breach response. Regulatory deadlines are short, such as the GDPR's 72-hour notification window. Clear roles let the organization respond quickly and correctly.
6. Segregation of duties and independence. Some roles, such as the Data Protection Officer (DPO), must stay independent to avoid conflicts of interest. Assigning roles carelessly can create regulatory violations.
7. Building a privacy culture. When everyone understands their responsibilities, privacy becomes part of daily operations rather than a checkbox exercise.

What Privacy Roles and Responsibilities Are
Privacy roles fall into three groups: (a) regulatory/legal roles defined by law, (b) organizational/governance roles defined by the enterprise, and (c) operational/technical roles that carry out privacy controls day to day.

A. Regulatory and Legal Roles
Data Subject: The identified or identifiable natural person whose personal data is processed. Data subjects hold rights such as access, rectification, erasure, restriction, portability, objection, and rights related to automated decision-making.
Data Controller: The entity that alone or jointly determines the purposes (why) and means (how) of processing personal data. The controller carries primary accountability for compliance. Under CCPA this role is similar to a 'business'.
Joint Controllers: Two or more controllers who jointly determine purposes and means. They must set out their respective responsibilities in an arrangement.
Data Processor: The entity that processes personal data on behalf of the controller and only on the controller's documented instructions. Under CCPA this role is similar to a 'service provider'. Processors have their own obligations, such as security, record keeping, and notifying the controller of breaches without undue delay.
Sub-processor: A processor engaged by another processor. It usually requires the controller's prior authorization, and the same contractual obligations must flow down to it.
Supervisory Authority / Data Protection Authority (DPA): The independent public body that enforces privacy law, investigates complaints, and imposes fines. Examples include the ICO in the UK and the CNIL in France.
Third Party / Recipient: An entity other than the data subject, controller or processor that receives personal data.
EU Representative: Required under GDPR Article 27 for some non-EU organizations that target EU residents.

B. Organizational and Governance Roles
Board of Directors: Holds ultimate oversight of enterprise risk, including privacy risk. The board approves the privacy strategy and risk appetite and ensures adequate resources.
Senior Management / Executive Leadership: Owns accountability for the privacy program, sets the tone at the top, approves policies, and allocates budget.
Chief Privacy Officer (CPO): A senior executive who designs, leads and manages the enterprise privacy program. Duties include strategy, policies, training, metrics, and alignment with business objectives. The CPO is usually a management role and can be involved in decisions about processing.
Data Protection Officer (DPO): A role mandated under GDPR Articles 37–39 for public authorities, for large-scale systematic monitoring, and for large-scale processing of special categories of data. Key characteristics:
- Must have expert knowledge of data protection law and practice.
- Must be independent. The DPO must not receive instructions on how to perform tasks and cannot be dismissed or penalized for performing them.
- Reports to the highest management level.
- Must not hold a position that determines the purposes and means of processing. This means the DPO should generally not be the CIO, CISO, CEO, head of HR, or head of marketing, because of conflict of interest.
- Tasks: inform and advise, monitor compliance, advise on DPIAs, cooperate with the supervisory authority, and act as the contact point for data subjects and the authority.
- The DPO is not personally liable for non-compliance. The controller or processor remains accountable.
Privacy Steering Committee / Privacy Council: A cross-functional body (legal, IT, security, HR, marketing, risk, business units) that coordinates privacy decisions, prioritizes initiatives, and resolves conflicts.
Legal Counsel: Interprets laws and regulations, drafts and reviews contracts and notices, and advises on lawful bases and cross-border transfers.
Chief Information Security Officer (CISO): Responsible for security controls that protect personal data, covering confidentiality, integrity and availability. Security supports privacy but is not the same as privacy.
Chief Information Officer (CIO) / Chief Technology Officer (CTO): Responsible for IT infrastructure and technology strategy, including how systems handle personal data.
Chief Data Officer (CDO): Responsible for data governance, data quality, and data as an enterprise asset. Works closely with privacy on data inventories and classification.
Risk Management / Compliance: Integrates privacy risk into enterprise risk management (ERM) and monitors regulatory compliance.
Internal Audit: Provides independent assurance that privacy controls are designed and operating effectively. Internal audit should not design or operate the controls it audits.
Human Resources: Manages employee personal data, privacy training, onboarding and offboarding, and disciplinary processes for privacy violations.
Procurement / Vendor Management: Ensures privacy due diligence and contractual clauses are applied to third parties.

C. Operational and Technical Roles
Data Owner: Usually a senior business manager accountable for a specific data set. The data owner decides classification, who may access the data, retention, and acceptable use. Data owners are accountable for the data.
Data Steward: Manages data quality, metadata and day-to-day governance on behalf of the data owner.
Data Custodian: Usually IT. The custodian implements and maintains the technical controls (storage, backup, encryption, access provisioning) according to the owner's decisions. Custodians are responsible for carrying out the work, not for deciding policy.
Privacy Engineer / Privacy Solutions Engineer: The role at the heart of CDPSE. Privacy engineers translate privacy requirements into technical controls, architectures and processes. Examples include de-identification, pseudonymization, encryption, consent management platforms, data minimization, and privacy-enhancing technologies (PETs).
System / Application Owners: Responsible for the privacy posture of specific systems across the system development life cycle (SDLC).
Developers and Architects: Implement privacy by design and by default in code and architecture.
Privacy Champions / Privacy Liaisons: Embedded representatives in business units who promote privacy practices and escalate issues to the privacy office.
Data Users / Employees: Every person who handles personal data. They must follow policies, complete training, and report incidents.
Incident Response Team: Detects, contains, investigates and coordinates notification of privacy breaches.

How Privacy Roles and Responsibilities Work in Practice
1. Establishing a governance structure. The organization defines a privacy charter approved by senior management. The charter sets the mission, scope, authority and reporting lines of the privacy function. It often places the CPO under the CEO, General Counsel, or Chief Risk Officer, and the DPO with direct access to the board.
2. Using a RACI matrix. A RACI (Responsible, Accountable, Consulted, Informed) chart maps each privacy activity to roles. For example, for a Data Protection Impact Assessment (DPIA):
- Accountable: Controller / business owner
- Responsible: Project manager / privacy engineer
- Consulted: DPO, legal, CISO
- Informed: Steering committee
Each activity should have exactly one 'Accountable' party.
3. Documenting roles in policies and job descriptions. Privacy duties are written into policies, standards, procedures and job descriptions so that responsibility is clear and enforceable.
4. Contractual allocation with third parties. Controller–processor relationships are governed by DPAs. These specify the subject matter, duration, nature and purpose of processing, data types, security measures, sub-processor rules, audit rights, breach notification, and return or deletion of data at the end of the contract.
5. The three lines model.
- First line: business and operational management, who own and manage privacy risk.
- Second line: privacy office, compliance and risk management, who set the framework, monitor, and challenge.
- Third line: internal audit, who provide independent assurance.
6. Training and awareness. Role-based training ensures each group understands its specific duties. For example, developers learn privacy by design, customer service staff learn to handle data subject requests, and executives learn accountability.
7. Monitoring and metrics. KPIs and KRIs, such as DSAR response times, training completion and DPIA completion, measure whether roles are being performed effectively.
8. Continuous review. Roles are reviewed when laws change, after mergers and acquisitions, after reorganizations, or after incidents.

Common Scenarios Illustrating Roles
- A company uses a cloud CRM provider to store customer data. The company is the controller. The CRM provider is a processor. The provider's hosting subcontractor is a sub-processor.
- Marketing wants to use customer data for a new purpose. The data owner and the controller's management decide. The DPO/privacy office advises on whether a lawful basis exists and whether a DPIA is needed. Legal may review notices.
- A breach is discovered at a vendor. The processor must notify the controller without undue delay. The controller is responsible for notifying the supervisory authority and, where required, the data subjects.
- An organization wants its CISO to also act as DPO. This creates a conflict of interest, because the CISO determines the means of processing and security. A separate, independent DPO is preferred.

Exam Tips: Answering Questions on Privacy Roles and Responsibilities
Tip 1: Know the difference between accountability and responsibility. Accountability, the ultimate answerability, sits with the controller, senior management, or the data owner. It cannot be delegated or outsourced. Responsibility, the doing of the task, can be delegated to processors, custodians or engineers. If a question asks who is ultimately accountable, choose the controller, senior management, or data owner, not IT, the vendor, or the DPO.
Tip 2: The DPO advises and monitors; the DPO does not decide. Watch for answer options that make the DPO responsible for deciding purposes of processing, approving risk, or being liable. These are usually wrong. The DPO's role is to inform, advise, monitor, and cooperate with authorities.
Tip 3: Independence and conflict of interest are frequently tested. When a question describes someone holding two roles (DPO plus CIO, auditor plus control designer, data owner plus custodian), look for the answer that addresses the conflict of interest or segregation of duties.
Tip 4: Controller versus processor. Ask yourself: 'Who decides why and how the data is processed?' That party is the controller. If the party only follows instructions, it is a processor. If a processor begins using data for its own purposes, it becomes a controller for that processing.
Tip 5: Outsourcing does not transfer accountability. A common distractor suggests that hiring a vendor shifts compliance obligations entirely to that vendor. The correct answer recognizes that the organization (the controller) remains accountable. It must perform due diligence, put contracts (DPAs) in place, and monitor the vendor.
Tip 6: Data owner versus data custodian. The owner (business) decides classification, access, and retention. The custodian (IT) implements controls. If a question asks who should approve access to personal data, the answer is generally the data owner, not IT or security.
Tip 7: Senior management sets the tone. For questions about the most important factor in a successful privacy program, or the first step in establishing one, the answer is often senior management support/commitment or an approved privacy charter/policy.
Tip 8: Internal audit provides independent assurance. If a question asks who should evaluate the effectiveness of privacy controls independently, choose internal audit or an external auditor, not the privacy office that designed the controls.
Tip 9: Think like a privacy engineer. CDPSE is a technical and operational certification. When a question asks what a privacy solutions engineer should do first or best, favor answers that:
- Identify and understand requirements (legal, regulatory, contractual) before implementing controls.
- Collaborate with the data owner, legal and the DPO.
- Embed privacy by design early in the SDLC.
- Use risk-based approaches such as DPIAs and PIAs.
Tip 10: Look for the 'BEST', 'MOST', 'FIRST' qualifiers. ISACA questions often have several plausible answers. Pick the one that is most strategic, preventive, and governance-aligned. For example, defining roles in a policy or RACI chart is better than reacting after an incident.
Tip 11: Breach notification chains. Remember the flow: processor notifies controller, then controller notifies the supervisory authority (within 72 hours under GDPR where required), then controller notifies data subjects when there is a high risk to their rights and freedoms.
Tip 12: Data subject requests are the controller's obligation. Processors assist controllers in fulfilling DSARs but are not usually directly responsible for responding to data subjects unless the contract says so.
Tip 13: Use the RACI concept to eliminate wrong answers. If an option gives accountability to more than one party, or to a party with no decision-making authority, it is likely incorrect.
Tip 14: Do not confuse security with privacy. The CISO protects data. The privacy office ensures data is processed lawfully, fairly, transparently, and for legitimate purposes. A question about whether data should be collected or used is a privacy or governance question, not a security one.
Tip 15: Watch for jurisdictional terms. 'Business' and 'service provider' (CCPA), 'covered entity' and 'business associate' (HIPAA), and 'controller' and 'processor' (GDPR) map to similar concepts. Recognize the equivalents.

Sample Practice Question
An organization outsources payroll processing to a third-party provider. Which of the following is MOST accurate regarding accountability for the protection of employee personal data?
A. The payroll provider is fully accountable because it processes the data.
B. The organization remains accountable and must ensure appropriate contractual and oversight controls.
C. Accountability is shared equally under a joint controller arrangement.
D. The DPO is personally accountable for the provider's compliance.
Answer: B. The organization is the controller and retains accountability. Outsourcing transfers tasks, not accountability. The DPO is not personally liable. Joint controllership does not apply, because the provider follows the organization's instructions.

Summary
Privacy Roles and Responsibilities provide the structure that makes a privacy program work. The key points to master are:
- The controller, processor and data subject distinction.
- The independent advisory nature of the DPO versus the leadership role of the CPO.
- Data owner versus custodian.
- The three lines model.
- RACI-based assignment of duties.
- The principle that accountability cannot be outsourced.
On the exam, read each scenario carefully and identify who decides, who does, who advises, and who assures. Then choose the answer that best reflects sound governance, independence, and accountability.