Security Architecture · Topic 6 of 7
Data Roles, Handling, Life Cycle and Compliance
Security+ data roles from owner to subprocessor, data handling and geofencing, the data management life cycle, and compliance for regulated data.
- 5 min
- The data owner is accountable and decides classification and access.
- The custodian runs the technical care, and the steward looks after quality and proper use.
- The controller decides how personal data is used, and a subprocessor works for a processor.
What it is
Protecting data is not only a technical job. Someone must decide the rules, someone must run the controls, and the data must be handled correctly from the day it is created until the day it is destroyed.
This page covers the people who are responsible for data, the rules for handling it, its life cycle and the kinds of data that laws and standards protect.
How it works
Data protection roles
| Role | Responsibility |
|---|---|
| Data owner | Senior person accountable for a dataset, who decides its classification and who may access it |
| Data custodian | Runs the technical care of the data, such as storage, backups and access settings, as the owner directs |
| Data steward | Looks after the quality, meaning and proper use of the data, such as definitions and labeling |
| Data operator | Works with the data in daily operations and must follow the handling rules |
| Data controller | Decides why and how personal data is processed, and is accountable under privacy law |
| Data subprocessor | A third party hired by a processor to process personal data for the controller |
A processor processes personal data on behalf of a controller. When that processor passes some of the work to another company, that company is a subprocessor, and the controller's rules and contracts must still apply to it.
Data handling
| Practice | Meaning |
|---|---|
| Endpoints | Data on laptops, phones and removable media needs encryption, data loss prevention and control of copying |
| Marking and labeling | Showing the classification on the data itself, such as a header, watermark or metadata tag |
| Geofencing | Allowing or blocking access based on the device's physical location |
| Data location | Where the data is physically stored, which decides which laws apply |
| Data placement | Choosing which systems, zones or regions may hold each class of data |
Labels let both people and tools, such as data loss prevention (DLP) systems, recognize sensitive data. Without labels, a DLP tool cannot tell which file must not leave.
Geofencing can stop a sensitive application from opening outside the country or outside the office. Data location and placement link to data sovereignty, because the place of storage decides which country's laws apply.
Data management life cycle
| Stage | Security focus |
|---|---|
| Creation | Classify and label the data as it is created or collected, and collect only what is needed |
| Management | Store it securely, control access and keep it accurate |
| Distribution | Share it only with authorized parties, over protected channels |
| Retention | Keep it for the period that law, contract or policy requires, and no longer |
| Disposal | Destroy it securely when retention ends, and keep proof where required |
Keeping data longer than needed raises the impact of a breach and the cost of storage. A retention schedule states how long each type of data must be kept and when it must be deleted.
Data compliance
| Data | What compliance looks like |
|---|---|
| Standards | Industry rules such as the Payment Card Industry Data Security Standard (PCI DSS) for payment card data |
| Health data | Medical records, protected in the United States by the Health Insurance Portability and Accountability Act (HIPAA) |
| Personal information | Data about an identifiable person, protected in the European Union by the General Data Protection Regulation (GDPR) |
| Financial | Account and transaction records, often covered by banking rules and audit requirements |
| Child/minor data | Data about children, which many laws protect more strictly, such as requiring parental consent |
| Intellectual property | Designs, code and trade secrets, protected by tight access and DLP |
| Legal data | Contracts and case records, which may be placed on legal hold so they are not deleted |
Which rules apply depends on the type of data, where it is stored and where the people it describes live. One organization often has to meet several sets of rules at once.
How the exam asks about this
- "A cloud vendor hires another company to run its backups of customer data." -> That company is a data subprocessor.
- "A finance app must not open when the laptop is outside the country." -> Geofencing.
- "Old customer records are kept forever just in case." -> A retention problem, fixed with a retention schedule and secure disposal.
What to remember for the exam
- The data owner is accountable and decides classification and access.
- The custodian runs the technical care, and the steward looks after quality and proper use.
- The controller decides how personal data is used, and a subprocessor works for a processor.
- Marking and labeling let people and DLP tools recognize sensitive data.
- Geofencing applies rules based on location.
- Data location decides which laws apply, and data placement decides where each class of data may live.
- The life cycle is creation, management, distribution, retention and disposal.
- Keep data only as long as the retention schedule requires.
- Health, personal, financial, child and legal data each carry their own legal duties.
For a role question, ask who decides and who does. The owner or controller decides, and the custodian, processor or subprocessor carries out the work.
Common mistakes
Confusing owner and custodian. The owner is accountable and decides. The custodian carries out the technical care.
Forgetting subprocessors. The controller's privacy duties still apply when a vendor passes data on to another vendor.
Skipping labels. Unlabeled data cannot be handled correctly by people or recognized by DLP tools.
Treating retention as keep everything. Retention sets both a minimum and an end point, after which data should be disposed of.
Deleting data under legal hold. Data that may be needed for a legal case must be preserved, even if its normal retention period has ended.
Disposal is part of the life cycle. Data left on old drives or backups is still data you are responsible for.
Check yourself
Who is accountable for a dataset and decides how it is classified?
The data owner.
What is a data subprocessor?
A third party engaged by a processor to process personal data on behalf of the controller.
What are the stages of the data management life cycle?
Creation, management, distribution, retention and disposal.
Topic 6 of 7 in Security Architecture
Test yourself on Security Architecture
The full CompTIA Security+ SY0-801 question bank has 998 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by CompTIA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.