Who Plays Which Data Role?

About this interactive

Different laws and standards define these words a little differently, as the lesson warns, so this activity uses the standard meanings it teaches. Data controller: decides that data will be collected and what happens to it. Usually an organization, such as the business collecting the data. Data subject: the person the data is collected from or about. Data steward: appointed by the controller to look after the data's quality, so that it is accurate and used correctly. Data custodian: appointed to keep the data secure: the protections, backups and access settings. Often the IT team. Data processor: does the processing for the controller. Often the controller processes its own data, but it can hire a third party to do it, and that third party works on the controller's instructions. Data Protection Officer (DPO): a role GDPR requires of some organizations, such as those handling sensitive data on a large scale. It is one named person who advises the organization on its data protection duties, monitors its compliance and is the contact for regulators. The organization itself, as controller, stays answerable for following the law. To sort a card, ask what this person or organization does with the data.

What you'll learn

Name the data role someone plays from what they do with the data: data controller, data subject, data steward, data custodian, data processor or Data Protection Officer
Tell the steward, who looks after the data's quality and accuracy, from the custodian, who keeps it secure, and the controller, who decides, from the processor, who does the work on its behalf

Aligned to

CompTIA Security+

5.1 Summarize elements of effective security governance.

5.4 Summarize elements of effective security compliance.

ISC2 CISSP

2.4 Manage data lifecycle

Key terms

Data Controller: The entity that determines the purposes and means of processing personal data and is responsible for its lawful use.
Data Subject: An individual whose personal data is being collected and processed by another party.
Data Custodian: The IT or administrative group responsible for technically managing access rights and permissions to data.
Data Processor: An entity that processes personal data on behalf of the data controller, sometimes as a third party.
Personally Identifiable Information: Personally Identifiable Information is any data that can be used alone or in combination to identify, contact, or locate an individual, requiring protection under privacy laws and organizational security policies.

Topics

Data Roles Privacy Governance Interactive Categorize

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →