Data Governance Roles: DPO, Data Owner, Data Steward and Data Custodian (CIPT Guide)
Introduction
In the IAPP Certified Information Privacy Technologist (CIPT) Body of Knowledge, the privacy technologist is expected to understand who in an organization is accountable, responsible and operationally involved in managing personal data. Four roles appear again and again: the Data Protection Officer (DPO), the Data Owner, the Data Steward and the Data Custodian. This guide explains why these roles matter, what each one does, how they work together, and how to answer exam questions about them.
1. Why Data Governance Roles Are Important
Accountability: Privacy laws such as the GDPR (Article 5(2)) require organizations to demonstrate compliance. Clearly assigned roles show regulators who is answerable for each data set and each control.
Avoiding gaps and overlaps: Without defined roles, tasks such as classification, retention, access approval and deletion fall through the cracks, or are done inconsistently by several teams.
Separation of duties: Splitting decision-making (owner), quality and policy enforcement (steward), technical operation (custodian) and independent oversight (DPO) reduces fraud, error and conflicts of interest.
Privacy by Design: Privacy technologists must know whom to consult when building systems. The data owner approves purposes and access, the custodian implements controls, the steward ensures definitions and quality, and the DPO advises on risk and DPIAs.
Incident response: During a breach, the organization must quickly know who decides (owner), who acts technically (custodian), who knows the data lineage (steward) and who handles regulator and data subject communication or advice (DPO).
2. What Each Role Is
A. Data Protection Officer (DPO)
Source: Formally defined in GDPR Articles 37 to 39. Similar roles exist under Brazil's LGPD (encarregado), Singapore's PDPA and others.
When mandatory under GDPR: (1) the processing is carried out by a public authority or body (except courts acting judicially); (2) core activities involve regular and systematic monitoring of data subjects on a large scale; or (3) core activities involve large-scale processing of special categories of data (Article 9) or criminal conviction data (Article 10).
Tasks (Art. 39): inform and advise the controller or processor and employees of their obligations; monitor compliance, including assignment of responsibilities, awareness raising, training and audits; advise on and monitor Data Protection Impact Assessments (DPIAs); cooperate with the supervisory authority; act as the contact point for the authority and for data subjects.
Key characteristics (Art. 38): must be involved properly and in a timely manner in all data protection issues; must be independent and receive no instructions on how to perform tasks; cannot be dismissed or penalized for performing tasks; reports to the highest management level; must be given adequate resources; is bound by confidentiality; may hold other duties only if they do not create a conflict of interest (for example, a CIO, CISO, head of HR or head of marketing who determines purposes and means is usually conflicted); may be internal staff or an external contractor; a group of undertakings may appoint a single DPO if easily accessible.
Important: The DPO is not personally liable for non-compliance. The controller or processor remains accountable. The DPO advises and monitors; it does not make the business decisions.
B. Data Owner
Who: Typically a senior business leader or executive (for example, the head of HR owns employee data, the VP of Sales owns CRM data).
Responsibilities: ultimate accountability for a specific data set or data domain; determines classification (public, internal, confidential, restricted); approves who may access the data and for what purpose; defines acceptable use, retention requirements and risk tolerance; approves sharing with third parties; signs off on risk acceptance; funds and prioritizes controls.
Key idea: The owner decides. Ownership is a business role, not an IT role. The owner can delegate tasks but not accountability.
C. Data Steward
Who: Usually a subject-matter expert within a business unit or a data governance office, often reporting to the data owner or to a Chief Data Officer.
Responsibilities: day-to-day management of data quality, integrity, definitions and metadata; maintaining the business glossary and data dictionary; ensuring data is used in line with policy and stated purposes; tracking data lineage and the data inventory; handling data quality issues, such as accuracy which supports the GDPR accuracy principle; acting as the bridge between business (owner) and technology (custodian); helping with data subject requests by knowing where data lives.
Key idea: The steward manages and enforces policy on behalf of the owner. Think "business-side caretaker of meaning and quality."
D. Data Custodian
Who: IT staff such as database administrators, system administrators, cloud operations or security engineers. An external processor such as a cloud provider can also act in a custodial capacity.
Responsibilities: technical safekeeping of data; implementing access controls as approved by the owner; encryption, backups, restoration, patching and logging; implementing retention and secure deletion technically; maintaining infrastructure availability; monitoring and reporting security events.
Key idea: The custodian implements and operates. The custodian does not decide who gets access or how long data is kept; it executes the owner's decisions.
3. How the Roles Work Together
Consider a new analytics project using customer data:
1. The Data Owner (head of Customer Operations) decides whether customer data may be used for analytics, approves the purpose and grants access to the analytics team.
2. The DPO advises that a DPIA is required, checks the lawful basis and purpose compatibility, recommends pseudonymization and monitors the outcome. The DPO does not approve the project; it gives independent advice.
3. The Data Steward identifies which fields are needed, documents definitions, ensures data minimization in the data set and confirms data quality and lineage.
4. The Data Custodian provisions the environment, applies role-based access control, implements pseudonymization or encryption, configures logging and sets automated deletion per the retention schedule.
A RACI view:
Accountable: Data Owner (and, at the organizational level, the controller and senior management).
Responsible (operational): Data Steward (business-side), Data Custodian (technical side).
Consulted / Monitoring: DPO.
Informed: users, executives, and regulators where required.
Relation to controller and processor: Do not confuse these internal roles with the legal roles. Controller and processor describe organizations' legal positions. Owner, steward and custodian are internal governance roles. A processor such as a SaaS vendor often performs custodian-like functions, but the controller's data owner remains accountable for decisions.
Related roles you may see: Chief Privacy Officer (CPO), a management role that may decide privacy strategy and therefore differs from the independent DPO; Chief Information Security Officer (CISO), who owns security strategy; Chief Data Officer (CDO), who leads data governance and stewardship programs; Data User, who consumes data under the owner's authorization; and the Privacy Technologist, who translates privacy requirements into technical controls and works with all of the above.
4. Memory Aids
Owner = Decides (who, why, how long, how sensitive).
Steward = Defines and Cares (quality, meaning, metadata, policy adherence).
Custodian = Does (the technical implementation and safekeeping).
DPO = Advises and Monitors (independent, reports to top management, contact point for the regulator).
A simple phrase: "The Owner decides, the Steward guides, the Custodian provides, the DPO oversees."
5. Exam Tips: Answering Questions on Data Governance Roles
Tip 1: Identify the verb in the question. "Approve", "classify", "authorize access" or "accept risk" point to the Data Owner. "Maintain quality", "define", "metadata" or "glossary" point to the Steward. "Back up", "encrypt", "patch", "implement" or "store" point to the Custodian. "Advise", "monitor", "DPIA" or "contact point for the supervisory authority" point to the DPO.
Tip 2: Accountability always sits with the business, not IT. If an answer says the database administrator decides who may access sensitive data, it is almost certainly wrong.
Tip 3: The DPO advises; it does not decide. Be wary of options where the DPO "approves" processing, "signs off" on risk, or is "liable" for fines. Under GDPR, the controller is accountable and the DPO is independent and protected from dismissal for doing the job.
Tip 4: Watch for conflicts of interest. A question asking who would be the least appropriate DPO usually expects an answer such as the CEO, CIO, CISO, head of IT, head of marketing or head of HR, who determine purposes and means. A compliance or legal professional with expertise and independence is usually the better choice.
Tip 5: Know when a DPO is mandatory. Memorize the three GDPR triggers: public authority, large-scale regular and systematic monitoring, and large-scale special-category or criminal data as a core activity. Distractors often include "any company with over 250 employees". That threshold relates to the Article 30 record-keeping exemption, not to DPO appointment.
Tip 6: Know the DPO reporting line. The DPO reports to the highest management level, such as the board, not to the head of IT.
Tip 7: In scenario questions, choose the most specific role. If the scenario is about inaccurate customer addresses spreading across systems, the steward is the best fit, even if the owner is ultimately accountable. If the question asks who is ultimately accountable, choose the owner, or the controller or senior management if those are the options.
Tip 8: Distinguish internal roles from legal roles. If the options mix controller, processor, owner and custodian, read carefully whether the question concerns legal liability (controller or processor) or internal operations (owner, steward or custodian).
Tip 9: Think separation of duties. The best answer often keeps decision-making, implementation and oversight in different hands. Options that merge them, such as a custodian approving their own access, are usually wrong.
Tip 10: Link roles to privacy principles. Accuracy ties to the steward, security and integrity to the custodian, purpose limitation and access approval to the owner, and accountability and DPIA oversight to the DPO. CIPT questions often test this mapping indirectly.
Tip 11: Eliminate absolute words. Options containing "always", "never" or "solely" are often incorrect. For example, a claim that the DPO is solely responsible for GDPR compliance is wrong.
Tip 12: Remember the technologist's perspective. CIPT focuses on how a privacy technologist works with these roles. The best answer typically involves engaging the data owner early, consulting the DPO on risk, collaborating with stewards on data inventories and mapping, and working with custodians to implement privacy-enhancing controls.
6. Sample Practice Questions
Q1: A database administrator receives a request from a marketing analyst to access a table containing customer health information. Who should authorize the access?
Answer: The Data Owner. The custodian implements access only after the owner approves it.
Q2: Which task is the DPO responsible for under GDPR?
A) Approving the organization's marketing campaigns. B) Providing advice on and monitoring the performance of DPIAs. C) Determining the retention period for HR data. D) Configuring database encryption.
Answer: B. Option A is a business decision, C belongs to the owner, and D belongs to the custodian.
Q3: Customer records contain duplicate and conflicting entries across three systems, causing incorrect responses to access requests. Which role is best placed to resolve the issue?
Answer: The Data Steward, who is responsible for data quality, definitions and lineage.
Q4: Which individual would most likely have a conflict of interest if appointed DPO?
Answer: The Chief Information Officer, because they determine the means of processing.
7. Quick Summary Table (Text Form)
DPO: independent advisor and monitor, legally defined, reports to top management, regulator contact point, not liable.
Data Owner: senior business role, accountable, classifies data, approves access, use, sharing and retention, accepts risk.
Data Steward: business or data governance role, manages quality, metadata, definitions and policy adherence, bridges business and IT.
Data Custodian: IT or operational role, implements and operates technical controls, handles storage, backup, encryption and deletion, follows the owner's direction.
Final Takeaway
On the exam, ask yourself: Who decides? Who manages the meaning and quality? Who operates the technology? Who independently advises and monitors? Matching the scenario's action to these four questions will lead you to the correct answer nearly every time.
