Who is ULTIMATELY accountable for the protection of personal data collected by an organization?

The correct answer is B. Data owner. The data owner is ultimately accountable for personal data because they are the business-side authority who determines the purpose and use of the data and has accepted responsibility for its protection within the organization. Accountability cannot be delegated-even if…

Privacy Governance

Question

Options

AData processor
BData owner
CData custodian
DData protection officer

How the community answered

(59 responses)

A
8% (5)
B
86% (51)
C
3% (2)
D
2% (1)

Explanation

The data owner is ultimately accountable for personal data because they are the business-side authority who determines the purpose and use of the data and has accepted responsibility for its protection within the organization. Accountability cannot be delegated-even if day-to-day protection tasks are assigned to others, the data owner remains answerable. The data processor (A) handles data on behalf of others and is responsible but not ultimately accountable. The data custodian (C) manages and protects data operationally under the direction of the data owner. The Data Protection Officer (D) advises, monitors compliance, and acts as a point of contact, but the DPO role is advisory and does not carry ultimate accountability for the data itself.

Topics

#Data accountability#Data roles and responsibilities#Data governance#Personal data protection

Community Discussion

No community discussion yet for this question.

Full CDPSE Practice