When an enterprise outsources to a third-party data center, who is accountable for the governance of data retention controls for the data that has been transferred?

The enterprise's internal audit team reviews the effectiveness of controls but is not accountable for establishing or governing the data retention policy itself.

The third party's data steward would be responsible for implementing or advising on retention within the third-party's scope, but not for the enterprise's overall accountability.

The third party's control operators are responsible for the operational execution of data retention controls within their infrastructure, not for the governance or ultimate accountability of the enterprise's data.

The enterprise's data owner is ultimately accountable for the data, including its lifecycle management, protection, and compliance with retention policies, regardless of where the data resides or who processes it. While the third-party data center operates the controls, the enterprise retains the governance responsibility to ensure those controls meet its requirements.