In this lesson,
we are going to talk about data ownership
and some of the things that are important inside of it.
Now, when we talk about data ownership,
this is the process of identifying the person responsible
for the confidentiality, integrity, availability,
and privacy of the information assets.
Now, you might think that the data owner
is the person who created the file
but that's not what we're talking about.
In an enterprise environment,
there are different roles that fall
under this idea of data ownership.
These include things like the data owner themselves,
the data controller, the data processor, the data custodian,
the data steward, and the data privacy officer.
Let's take a look at each of these.
First, we have our data owner.
This is going to be a senior executive role
and they have the ultimate responsibility
for maintaining the confidentiality, integrity,
and availability of the information asset.
So, what is the real role here as the data owner?
It's not the person who created the file,
it's the senior executive.
And this data owner is going to be responsible
for labeling the asset,
ensuring that it's protected with the appropriate controls.
So the data owner is going to say this type of information
when we're dealing with it.
Let's say, the balance sheets for the corporation,
they should be protected as financial information.
So, anybody who creates it will now follow my rules
and label as financial information
and we're going to protect financial information
by doing X, Y, and Z, whatever those controls are.
Next, the data controller.
The entity that holds the responsibility
for deciding the purposes
and methods of data storage, collection, and usage,
and for guaranteeing the legality
of these processes is known as the data controller.
The data controller holds the ultimate accountability
for any breaches of privacy,
cannot delegate this responsibility to another party.
Next, the data processor.
The data processor is a group or individual hired
by the data controller to help with tasks like collecting,
storing, or analyzing the data.
They work under the direction of the data controller
and follow their instructions for data collecting
or processing.
Now, the data steward
is a role that's focused on the quality
of the data and the associated metadata.
The data steward is going to be somebody
who is working for the data owner.
They're going to be involved with making sure
that the data is appropriately labeled and classified.
So, we said that all financial data
should be labeled as financial data,
and it should be taken care of this way.
That's going to be the role of the data steward
to make sure that actually happens.
Now, as we go down further, we get to our data custodian.
That is the role that is responsible
for handling the management of the system
which data assets are stored.
So, who might be a data custodian?
Well, a system administrator.
These are the people responsible
for enforcing the access control, the encryption,
and the backup recovery measures that protect this data
based on the requirements set forth by the data owner.
And so, you can see how all of this goes upward as you go.
Then we have our privacy officer.
Now, this is a role that is responsible
for the oversight of any kind of privacy related data.
Things like PII, SPI, or PHI,
any of those things that are managed by the company
fall under the realm of the privacy officer.
This is the person who's going to really be on the hook
if you have a data breach,
because normally, when you have a data breach,
what people are concerned about
is the privacy of user data that has been expelled,
and so, that is going to be what they're focused on.
They have to make sure that we are complying
with legal and regulatory frameworks
and make sure that we have the right purpose,
limitations, and consent.
We're doing data minimization,
data sovereignty, data retention,
all the stuff we've been talking about in this section
falls under the privacy officer.
Now, the real question is who should own the data?
Now, in a lot of organizations,
they try to make the CIO or the IT department
in charge of all the information and be the data owners,
but that is the wrong answer because,
as the IT personnel, we don't know much about the data,
we know about the systems.
We should be the data custodians.
Instead, the data owners should be somebody
from the business side.
People who are creating this information.
Each data owner can actually be specified
inside their own department.
So, for instance, you might have the accountant department
have their leader be the data owner,
and they would have a data owner over their information,
because if I, as the IT person,
am looking at some accounting data,
I don't know it well enough to be able to classify it
at the right level.
So, this is one of those things
that I think is really important
is that IT people should not be the data owners,
and the data owners should really be the people
who know more about the data
based on the context of the company.
So, if your company is a software development company,
then the software design department
should probably be the data owner.
If you're an accountant firm,
it should be the financial department or the CFO,
somebody who knows about the data
who can make the right decisions
as far as labeling and classification.
That is who your data owner should be.