**Data governance** is a set of processes that define *how an organisation manages information*. Governance often includes policies that specify how to keep **data private, accurate, available, and secure** throughout its lifecycle. Effective data governance is a collaborative activity that relies on people. Data governance policies commonly categorise individuals into a specific role: - *Data owner*: the person that decides who can access, edit, use, or destroy their information - *Data custodian*: anyone or anything that's responsible for the safe handling, transport, and storage of information - *Data steward*: the person or group that maintains and implements data governance policies set by an organisation ### Protecting data at every stage Most security plans include *a specific policy that outlines how information will be managed* across an organisation. This is known as a **data governance policy**. These documents clearly define procedures that should be followed to participate in keeping data safe. They place limits on who or what can access data. Security professionals are important participants in data governance. As a data custodian, you will be responsible for ensuring that data isn’t damaged, stolen, or misused. ### Data subjects Data subjects are individuals *whose personal data is being processed*. This can include customers, employees, and partners. Data subjects often have rights regarding their data, such as the right to access, correct, or request the deletion of their data.” ### Data owners A data owner is the person that decides who *can access, edit, use, or destroy their information*. Data owners have administrative control over specific information hardware or software and are accountable for the classification, protection, access, and use of company data. For example, consider a situation where an employee gains unauthorised access to software they do not need to use for work. This kind of security event would be escalated to the data owner of that software. ### Data controllers Data controllers *determine the procedure and purpose for processing data*. This role largely focuses on collecting the personal information of customers. The data controller determines how that data is used. The data controller also ensures that data is used, stored, and processed in accordance with relevant security and privacy regulations. If sensitive customer information was at risk, that event would be escalated to data controllers. ### Data processors Data processors *report directly to the data controller and are responsible for processing the data on behalf of the data controller*. The data processor is typically a vendor and is often tasked with installing security measures to help protect the data. Data processing issues are typically escalated to the individual who oversees the third-party organisation responsible for data processing. ### Data custodians Data custodians *assign and remove access to software or hardware*. Custodians are responsible for implementing security controls for the data they are responsible for, *granting and revoking access to that data, creating policies regarding how that data is stored and transmitted, advising on potential threats to that data, and monitoring the data*. Data custodians are notified when data security controls need to be strengthened or have been compromised. ### Data protection officers (DPOs) Data protection officers are **responsible for monitoring the internal compliance of an organisation’s data protection procedures**. These individuals advise the security team on the obligations required by the organisation's data protection standards and procedures. They also conduct assessments to determine whether or not the security measures in place are properly protecting the data as necessary. DPOs are notified when set standards or protocols have been violated. ### Data stewards Data stewards are individuals who *carry out the intent of the data controller* and are delegated responsibility from the controller. **Data owner**: The data owner is accountable for specific data, so this person is often a senior officer of the organisation. **Data controller**: A data controller manages the processing of the data. For example, a payroll department would be a data controller, and a payroll servicing company would be the data processor. **Data steward**: The data steward manages access rights to the data. In this example, the IT team would be the data steward. **Data processor**: The data processor is often a third-party that processes data on behalf of the data controller.