Data roles: owner, controller, processor, custodian, steward, subject

Knowing who is responsible for what is central to asset security, and the exam frequently describes a person's duties and asks which role they hold. The roles come from two overlapping vocabularies. Organizational security uses owner, custodian, steward and user. Privacy law, especially the European Union's General Data Protection Regulation (GDPR), uses controller, processor and subject. One organization, or even one person, can hold roles from both vocabularies at once.