Data custodian

What is a data custodian?

Data custodians are directly responsible for the technical safekeeping, security, accessibility, and proper maintenance of an organization’s data assets. Normally an IT role, they implement and maintain the business and technical data governance rules required to manage data assets to ensure accuracy, security and compliance on a day-to-day basis. 

Data custodians ensure that only authorized users access data, maintain access logs for audit purposes, and ensure systems are secure. They are especially important when it comes to achieving compliance with standards such as GDPR, HIPAA, or SOX. Data custodians provide the technical foundation for data access and sharing within an organization, and are essential to both protecting data assets and ensuring that they are managed effectively to deliver value.

What is the difference between a data custodian, a data owner and a data steward?

Data custodians, data owners and data stewards work closely together to ensure data governance and to provide compliant access to data. The three roles are distinct:

• Data owners are senior leaders responsible for determining how data is used and who can access it. They have overall responsibility for data.
• Data stewards are subject matter experts who ensure data is managed and performs according to policies.They are commonly responsible for data content, context, and associated business rules.
• Data custodians are often system administrators, and are responsible for the technical, day-to-day handling, storage, transport, and protection of data.

While data owners and data stewards are focused on what the data asset itself contains and means, data custodians are responsible for the technical aspects around it.

What are the responsibilities of a data custodian?

Data custodians are responsible for the technical and infrastructure aspects of managing data. Their responsibilities therefore include:

• Maintaining the technical environment where data resides, such as databases, including auditing any changes for compliance.
• Ensuring data is stored in a correct and compliant manner, including that it is backed up and protected, and that data security protocols are enforced.
• Ensuring that data is transported between systems in a safe and compliant way.
• Implementing dataset-specific standards, policies, and procedures, including ensuring that any new data meets these standards.
• Protecting data and implementing security and privacy policies.
• Controlling access to data, ensuring that any access is monitored, logged and audited to ensure compliance and governance.
• Focusing on data integrity and ensuring data quality and accuracy at a technical level, including running regular data quality checks and implementing integrity safeguards.
• Complying with relevant regulations around data (such as GDPR), as well as meeting organizational governance policies.

What skills does a data custodian require?

Data custodians must be able to demonstrate a mix of technical, compliance and soft skills.

Technical skills

Required technical skills include a deep knowledge of handling, protecting and storing data across all systems within the organization, including database management. They must be able to implement robust data security controls, ensure confidentiality, monitor access and log any breaches, while being responsible for auditing data and making it available to the business.

Compliance skills

Data custodians need to understand all regulatory requirements around data, particularly national, international, and industry specific legislation. They should be able to audit all activities to demonstrate compliance and aid reporting.

Soft skills

While the data custodian role is primarily technical, they need to be able to work closely with the business, particularly other members of the data team, such as data stewards, data owners and end users of data within the business. This requires a range of soft skills, such as strong communication and listening capabilities, the ability to problem-solve within often complex data stacks, and meticulous attention to detail when it comes to ensuring accuracy and auditing.