What is a data owner?
Definition
A data owner is the person or role accountable for a set of data and for deciding how it is collected, used, protected and disposed of. In security frameworks, it is the official who sets the controls for that information.
- Category
- Data
- Also called
- information owner, data custodian owner
- Last updated
NIST's glossary defines an information owner as an official with statutory or operational authority for specified information, and responsibility for establishing the controls for its generation, collection, processing, dissemination and disposal. "Data owner" is the common name for the same role in many organisations.
What a data owner does
The data owner is not usually the person who runs the servers. They decide who may see the data, how long it is kept, how sensitive it is and what protections it needs. Day-to-day handling is done by others, often called data custodians or stewards, who apply the owner's rules. A typical example: a head of HR is the owner of staff records, while the IT team stores and backs them up.
The everyday meaning
Outside security frameworks, people also use the phrase for the person the data is about. You are, in a plain sense, the owner of your own personal details. In privacy laws, though, the relevant terms are usually "data subject" for the person and "controller" for the organisation that decides how data is used. Which of these applies depends on your country's law, so check your local regulator.
Why it matters
When data has no clear owner, nobody decides who can access it, how long it stays or what happens when it leaks. Unowned files pile up and get copied. When a company sells or shares customer details, the question of who was accountable is what regulators and customers ask first.
Close terms
- Data steward looks after the quality and rules of data day to day.
- Data controller is the legal term in privacy laws such as the GDPR.
- Data subject is the person the data is about.
How to protect yourself
- 1
Ask who is responsible for your data
When a company collects your details, check its privacy policy for who is accountable and how to contact them with requests.
- 2
Use your rights
Many countries let you ask what an organisation holds about you and request correction or deletion. Check your local privacy regulator for how.
- 3
Give less in the first place
Share only the details a service really needs. Data you never hand over can't be leaked.
- 4
Check where else your details are listed
Companies that you never dealt with, such as data brokers, may hold your details. Serus finds the sources that list your address and phone number and requests removal for you.
See where your personal data is exposed
Serus finds it on data brokers and people-search sites and removes it.
Frequently asked
What is the difference between a data owner and a data custodian?
The owner decides how data may be used and protected. The custodian runs the systems and applies the owner's rules.
Who owns my personal data?
Legally this varies. Many privacy laws give you rights over data about you, such as access and deletion, rather than treating it as property. Check your local law.
Is the data owner the same as the data controller?
Not exactly. Data owner is a security and governance role inside an organisation. Data controller is a legal term in privacy laws for the organisation that decides why and how personal data is used.
Sources
Something wrong or out of date? Tell us and we'll re-check it.