Section 7.61 Data Ownership

Question 1

Data Ownership

Answer 1

Process of identifying the individual responsible for maintaining the confidentiality, integrity, availability, and privacy of information assets

Question 2

Data Owner

Data Owner

Answer 2

A senior executive responsible for labeling information assets and ensuring they
are protected with appropriate controls

Not the creator of the data

Question 3

Data Controller

Answer 3

Entity responsible for determining data storage, collection, and usage purposes
and methods, as well as ensuring the legality of these processes

Holds ultimate accountability to any breeches of privacy and cannot delegate this responsibility.

Question 4

Data Processor

Answer 4

A group or individual hired by the data controller to assist with tasks like data
collection and processing

Question 5

Data Steward

Answer 5

Focuses on data quality and metadata, ensuring data is appropriately labeled and
classified, often working under the data owner

Ensure Data is appropriately classified

Question 6

Data Custodian

Answer 6

Responsible for managing the systems on which data assets are stored, including
enforcing access controls, encryption, and backup measures

Sytem administators

Question 7

Privacy Officer

Answer 7

Oversees privacy-related data, such as personally identifiable information (PII),
sensitive personal information (SPI), or protected health information (PHI),
ensuring compliance with legal and regulatory frameworks

Question 8

Data Ownership Responsibility

Answer 8

The IT department (CIO or IT personnel) should NOT be the data owner: data owners should be individuals from the BUSINESS SIDE who understand the data’s
content and can make informed decisions about classification

Question 9

Selection of Data Owners

Answer 9

Data owners should be designated within their respective departments based on their knowledge of the data and its significance within the organisation

Note: Proper data ownership is essential for maintaining data security, compliance, and effective data management within an organization. Different roles contribute to safeguarding and managing data appropriately