CDPSE · Question #251
When data processing is performed at a third-party data center, ownership of the risk PRIMARILY rests with the:
The correct answer is B. data controller. The data controller is the entity that determines the purpose and means of processing personal data. Even when processing is outsourced to a third party (the data processor), the data controller retains ultimate accountability and risk ownership - this is a core principle in…
Question
When data processing is performed at a third-party data center, ownership of the risk PRIMARILY rests with the:
Options
- Adata custodian.
- Bdata controller.
- Cdata processor.
- Ddata scientist.
How the community answered
(23 responses)- B91% (21)
- C4% (1)
- D4% (1)
Explanation
The data controller is the entity that determines the purpose and means of processing personal data. Even when processing is outsourced to a third party (the data processor), the data controller retains ultimate accountability and risk ownership - this is a core principle in frameworks like GDPR. The data processor (Option C) is contractually obligated to follow the controller's instructions but does not own the risk. The data custodian (Option A) handles day-to-day data stewardship but has no ownership of strategic risk. The data scientist (Option D) is an operational role with no formal risk ownership. Outsourcing processing does not transfer risk; it transfers tasks.
Topics
Community Discussion
No community discussion yet for this question.