Last updated:
CISSP decision trap
What is the difference between a data owner and a data custodian?
Direct answer
The data owner is the business role accountable for the data: they classify it, approve who may access it and accept risk to it. The data custodian looks after it day to day: they apply the owner's decisions, grant approved access, run backups and keep the agreed protections working. In a CISSP question, ask whether the stem needs someone to decide or someone to carry out a decision. The owner decides; the custodian acts and escalates.
data owner and custodian roles: a practical decision framework
| Check | How to use it |
|---|---|
| Objective | Match decision rights to the owner and execution duties to the custodian while checking the organization’s defined governance model. |
| First move | identify whether the question asks who decides or who implements |
| Common trap | Giving classification or risk-acceptance authority to the administrator who operates the storage system. |
data owner and custodian roles in practice
A database administrator discovers an unlabeled dataset and can apply encryption, but lacks business context to determine its sensitivity or approve user access.
The custodian should protect and escalate; the accountable owner classifies the data and defines access, after which the custodian implements the approved controls.
Owner and custodian duties side by side
The split is decision rights against execution: the owner sets the requirements and the custodian meets them.
A custodian often has more technical access than the owner. That access does not carry the authority to decide what the data is worth or who should see it.
- Classification: the owner assigns it; the custodian labels and handles the data to match.
- Access: the owner approves who may use the data; the custodian grants and removes access as approved.
- Protection: the owner sets requirements such as encryption and retention; the custodian implements and runs them.
- Risk: the owner accepts or rejects residual risk; the custodian reports problems to the owner.
- Backup and recovery: the custodian runs them to the owner's retention and recovery requirements.
Where the other data roles fit
The ISC2 CISSP outline lists these data roles in Domain 2: owners, controllers, custodians, processors, and users or subjects.
Controllers and processors come from privacy law. The controller decides why and how personal data is processed, and the processor handles it on the controller's behalf. Users work with the data under the access they were granted, and subjects are the people the personal data describes.
A data steward is not on the outline's list. Where an organization uses the title, read the scenario for what the steward is authorized to do; it does not replace the owner's accountability. A system owner is accountable for the system that holds the data, and can be a different person from the data owner.
The common mistake: the administrator who can, but may not
Wrong answers usually hand an owner's decision to the person with technical access.
Distractors let the database administrator classify a dataset, approve a user's access or accept a risk because they manage the system. Technical ability is not authority. The custodian's best move is to protect the data under existing policy and take the decision to the owner.
Check the rule on a changed scenario
Change who is acting and confirm that the decision still goes back to the owner.
- A backup operator finds sensitive data on an unencrypted share: protect it under policy, then report it to the owner.
- A manager asks IT to give a contractor full access: IT confirms the owner's approval before granting it.
- An auditor finds data kept past its retention period: the owner decides what happens; the custodian deletes it as directed.
Sources and fact check
Source checked: 2026-10-26
- CertArc is an independent exam-preparation platform and is not affiliated with or endorsed by ISC2.
- CertArc uses original practice questions, not live or recalled exam items, and does not reproduce the CISSP CAT algorithm.
- Practice performance is study evidence, not a pass prediction or guarantee.
Frequently asked questions
What is the difference between a data owner and a data custodian?
The data owner is the business role accountable for the data: they classify it, approve who may access it and accept risk to it. The data custodian looks after it day to day: they apply the owner's decisions, grant approved access, run backups and keep the agreed protections working. In a CISSP question, ask whether the stem needs someone to decide or someone to carry out a decision. The owner decides; the custodian acts and escalates.
Who classifies data, the owner or the custodian?
The data owner. The custodian applies the classification the owner sets and asks the owner when data turns up unlabeled.
Is the data owner the same as the system owner?
Not necessarily. The data owner is accountable for the information; the system owner is accountable for the system that stores or processes it. One person can hold both roles, but exam questions treat them separately.
What is the difference between a data custodian and a data steward?
The ISC2 CISSP outline names custodians but not stewards. A custodian runs storage, backups and access controls for the owner. Where an organization also has a steward, check what that role is authorized to do; neither role takes over the owner's accountability.
Can a data custodian accept risk on the owner's behalf?
No. A custodian can report a risk and propose controls, but accepting it belongs to the owner or to whoever the organization has delegated that authority to.
