Data custodian

The data custodian implements the protections that the data owner has specified. Custodians, usually IT or operations staff, perform backups and test restores, apply the access permissions the owner has approved, patch and maintain the systems holding the data, and keep storage and handling in line with the data classification label. The custodian does the day-to-day work of protection; the owner decides what that protection must achieve.

The custodian is responsible, never accountable: the exam’s favourite trap in this area is an answer that has the custodian classifying data or approving access, which is always wrong. The custodian also sits within a wider cast of data roles: the data controller determines why and how personal data is processed, the data processor handles it on the controller’s behalf, and data users are the staff who work with the data day to day and must follow the handling rules its classification imposes.

Exam relevance: if a scenario mentions performing backups, applying approved permissions, or maintaining the storage environment, the answer is data custodian. The nearest confusable is the data owner: the owner decides and is accountable, the custodian executes and is responsible. When a question offers both roles, ask whether the action is a decision about the data or work done to the data; decisions belong to owners, work belongs to custodians.