---
title: "Data Owner vs Data Steward vs Data Custodian | Dawiso"
description: "Data owner vs data steward vs data custodian: who decides, who maintains and who implements. A side-by-side comparison table, RACI example and common mix-ups."
url: "https://www.dawiso.com/glossary/data-owner-vs-data-steward-vs-data-custodian"
language: "en"
---

November 5, 2026

data owner vs data stewarddata custodian vs data stewarddata owner vs data custodiandata custodiandata governance roles

# Data Owner vs Data Steward vs Data Custodian

The **data owner**, **data steward**, and **data custodian** are the three roles that share accountability for an organization's data. The data owner **decides**: who may use the data, what quality is good enough, and which definition is the official one. The data steward **maintains**: turns those decisions into glossary definitions, quality rules, classifications, and access reviews. The data custodian **implements**: runs the storage, permissions, encryption, and backups that enforce the decisions in the systems.

The roles are easy to confuse because all three "look after" data, and in a small company one person may hold two of them. Keeping them apart matters because each answers a different question, and a governance program missing any one of them fails in a predictable way. This page compares the three roles side by side. For each role in depth, see [data ownership](https://www.dawiso.com/glossary/data-ownership) and [what is a data steward](https://www.dawiso.com/glossary/data-steward).

TL;DR

The **data owner** is a business leader **accountable** for a data domain and makes the decisions about it. The **data steward** is a domain expert **responsible** for applying those decisions day to day: definitions, quality, metadata, and access reviews. The **data custodian** is an IT or platform role **responsible** for the technical environment that holds and protects the data. In RACI terms the owner is the A, and the steward and custodian are the R for business and technical work respectively. The owner decides what, the steward keeps it that way, the custodian makes the systems enforce it.

## Data Owner, Steward and Custodian Comparison Table

| Dimension | Data owner | Data steward | Data custodian |
| --- | --- | --- | --- |
| Core question | What should this data be, and who may use it? | How do we keep it that way every day? | How do we store, secure, and deliver it? |
| Type of accountability | Accountable for the domain's data and its business value | Responsible for definitions, quality, documentation, and access reviews | Responsible for the technical environment and controls |
| Typical job title | VP, director, or head of a business function | Business analyst, domain expert, or process lead | DBA, data or platform engineer, cloud or security administrator |
| Usually sits in | The business | The business (business steward) or IT (technical steward) | IT or the data platform team |
| Decides | Access policy, quality thresholds, the official definition | Within limits the owner delegates; escalates the rest | How a control is implemented, not whether it applies |
| Day-to-day work | Little: approvals, escalations, periodic reviews | Glossary terms, quality monitoring, classification, access reviews, issue triage | Permissions, encryption, backups, retention jobs, pipeline operations |
| RACI letter for domain decisions | A (accountable) | R (responsible) for business governance tasks | R (responsible) for technical tasks |
| Example with customer data | Decides that personal data is visible only to support and billing | Classifies the personal data fields and reviews each access request | Creates the database role and applies column masking |
| What breaks without it | Disputes cannot be settled and decisions stall | Policies stay on paper and quality slowly degrades | Decisions are never enforced in the systems |

## Data Owner vs Data Steward

The difference between a data owner and a data steward is **authority versus execution**. The owner holds decision rights over a data domain and answers for the outcome. The steward does the ongoing work that makes those decisions real, and often acts as the owner's delegate for routine cases.

- **Seniority.** Owners are senior business leaders with budget and organizational authority; stewards are usually closer to the data and the daily process.
- **Time on the role.** An owner might spend a few hours a month on governance decisions. A steward spends a defined part of every week on it.
- **Number per domain.** A domain has exactly one accountable owner. It can have several stewards, for example one per subdomain or source system.
- **Escalation.** When two departments disagree on a definition, the steward prepares the options and the owner decides. If the disagreement crosses domains, the governance council decides.

A practical test: if the question is "may we?" or "which one is right?", it belongs to the owner. If the question is "is it documented, classified, and correct?", it belongs to the steward.

## Data Steward vs Data Custodian

The data steward and the data custodian both do hands-on work, which is why they are most often mixed up. The difference is **meaning versus mechanics**. The steward is responsible for what the data means and whether it is fit for use. The custodian is responsible for the systems that hold the data and the technical controls on them.

- The steward decides that a column contains personal data and must be masked for most users; the custodian implements the mask in the database or warehouse.
- The steward defines a quality rule, such as "every order has a valid customer ID"; the custodian or a data engineer builds the check and keeps the pipeline running.
- The steward reviews whether an analyst should get access; the custodian grants or revokes the technical permission once it is approved.

Note that a **technical data steward** is a different role from a custodian. A technical steward governs technical metadata and how rules are applied in a system, while a custodian operates the infrastructure. In smaller teams the same engineer may do both.

## Data Owner vs Data Custodian

The data owner and the data custodian sit at opposite ends of the chain. The owner is a **business** role that decides policy; the custodian is a **technical** role that enforces it. The owner says "only finance managers may see payroll data"; the custodian configures the identity and access management policy, encryption, and audit logging that make the rule true in every system that holds payroll data.

The most damaging confusion is treating the custodian as the owner because the custodian holds the admin rights. When whoever can grant access is also the one who decides, access decisions are made on technical convenience instead of business need, and nobody in the business answers for them.

## How the Three Roles Work Together

The roles are easiest to understand in a single flow. Here is what happens when an analyst asks for access to customer personal data:

The same division of labor repeats in other situations. The table below shows who does what in five that come up in every governance program:

| Situation | Data owner | Data steward | Data custodian |
| --- | --- | --- | --- |
| A new KPI needs an official definition | Approves the definition and settles disagreements | Drafts the definition, collects input, links it to the data | Exposes the approved logic in the warehouse or semantic model |
| An analyst requests access to sensitive data | Sets the policy; approves exceptions | Reviews the request against classification and purpose | Grants, logs, and later revokes the technical permission |
| A data quality incident hits a board report | Is informed; decides on priority if fixes compete | Investigates the cause and coordinates the fix | Fixes or reruns the pipeline, restores data if needed |
| A source system changes its schema | Is informed of business impact | Checks downstream impact and updates documentation | Adapts integrations and storage |
| Records reach the end of their retention period | Approves the retention rule for the domain | Confirms which data falls under the rule | Runs the deletion or archiving job and keeps evidence |

## RACI Example

Many organizations write the split as a RACI matrix: **R**esponsible (does the work), **A**ccountable (makes the final call, exactly one per decision), **C**onsulted, and **I**nformed. For the three roles, the default pattern is simple:

| Decision or task | Data owner | Data steward | Data custodian |
| --- | --- | --- | --- |
| Approve a business definition | A | R | I |
| Set a data quality threshold | A | R | C |
| Approve access to sensitive data | A | R | I |
| Implement an access control | A | C | R |
| Back up and restore data | I | I | A, R |

Note the last row: purely technical operations such as backup and recovery are usually both owned and executed in IT, so the custodian side holds the A as well. For a fuller RACI that adds the governance council and data consumers, see the [data governance operating model](https://www.dawiso.com/glossary/data-governance-operating-model).

## Why Definitions of These Roles Conflict

If you compare definitions from different sources, you will find contradictions. They come from different traditions using the same words:

- **Data governance (DAMA-DMBOK and practice).** The usage on this page: the owner is a business decision-maker, the steward a domain expert who executes, the custodian an IT role.
- **US federal information security (NIST).** The NIST glossary defines an *information owner* as an official with statutory or operational authority for specified information and responsibility for establishing the controls for its generation, collection, processing, dissemination, and disposal. Its definition of an *information steward* is almost word for word the same, describing an agency official. NIST adds that the two terms are related but not identical. In that vocabulary a steward is close to what data governance calls an owner.
- **Security certifications.** Security curricula use owner and custodian much as this page does: the owner is a management role that classifies data, the custodian a technical role that protects it according to the owner's instructions.
- **Privacy law.** The [GDPR](https://www.dawiso.com/glossary/gdpr) defines the *controller*, which determines the purposes and means of processing personal data, and the *processor*, which processes it on the controller's behalf. These are legal entities, usually whole organizations, not internal roles. A data owner is not the controller.

The practical lesson: do not rely on the words alone. Write your own one-line definitions of owner, steward, and custodian into the governance charter, together with the decisions each one holds, and use the same terms in your tools.

## Common Mistakes

- **Making IT the data owner.** IT runs the systems but rarely knows what the data means or who should use it. Ownership belongs to the business function that creates and depends on the data.
- **Letting admin rights decide access.** If the custodian approves access because they can, nobody in the business is accountable for who sees what.
- **One person holding all three roles in name only.** Combining roles is fine in a small team, as long as the person has time and knows which hat they wear for each decision.
- **A steward without authority.** A steward who cannot approve anything and has no time allocated becomes an unpaid help desk. Delegate routine decisions explicitly.
- **Owners at table level.** Assigning an owner to each of thousands of tables produces a list nobody maintains. Assign owners by domain and stewards by subdomain or system.
- **No backup.** When the only steward of a domain changes jobs, the knowledge leaves with them. Name a deputy and keep the knowledge in the catalog, not in one person's head.

## How Dawiso Supports the Three Roles

Role definitions only work when people can see them where they use the data. In Dawiso, an admin can assign a **data owner and a data steward** to any data asset, so anyone who finds a table, report, or glossary term in the [Data Catalog](https://www.dawiso.com/product/data-catalog) also sees who decides about it and who to ask.

- **Workflows that follow the split.** In the default workflow a data steward moves an object to review and then approves or cancels it, and custom workflows let admins define who may change each state.
- **A record of decisions.** The changelog shows who changed what and when, which is the evidence auditors ask for.
- **Shared context for all three roles.** The [Business Glossary](https://www.dawiso.com/product/business-glossary) holds the owner's approved definitions, and [Interactive Data Lineage](https://www.dawiso.com/product/interactive-data-lineage) shows stewards and custodians what a change will affect before it is made.

The custodian's technical controls stay in the source platforms, such as the warehouse, database, or identity provider. Dawiso documents the decisions and the people behind them across those platforms.

## Sources

- NIST Computer Security Resource Center, glossary: [information owner](https://csrc.nist.gov/glossary/term/information_owner) and [information steward](https://csrc.nist.gov/glossary/term/information_steward).
- DAMA International, [DAMA Data Management Body of Knowledge (DAMA-DMBOK)](https://dama.org/learning-resources/dama-data-management-body-of-knowledge-dmbok/).
- GDPR, [Article 4, Definitions](https://gdpr-info.eu/art-4-gdpr/) (controller and processor).
- Dawiso Help, [Role of ownership in data governance](https://help.dawiso.com/actual/role-of-ownership-in-data-governance/).
- Dawiso Help, [Workflows overview](https://help.dawiso.com/actual/workflows-overview/).
- Dawiso Help, [Activities (Comments) and Changelog](https://help.dawiso.com/actual/activities-comments-changelog/).

[See it in action](https://www.dawiso.com/product/data-catalog)

Data & Analytics Catalog

Create a unified view of your data assets and gain insights faster with automated data discovery.

### Table of contents

Data Owner, Steward and Custodian Comparison TableData Owner vs Data StewardData Steward vs Data CustodianData Owner vs Data CustodianHow the Three Roles Work TogetherRACI ExampleWhy Definitions of These Roles ConflictCommon MistakesHow Dawiso Supports the Three RolesSources

## Related Terms

### [Data Ownership](https://www.dawiso.com/glossary/data-ownership)

Data ownership defines who is accountable for data assets - their quality, access, and usage. Learn how to assign ownership and build a governance culture.

Read more →

### [What Is a Data Governance Operating Model?](https://www.dawiso.com/glossary/data-governance-operating-model)

A data governance operating model sets who decides what about data, from the council to domain owners. Compare centralized, federated, and decentralized.

Read more →

### [What Is a Data Consumer?](https://www.dawiso.com/glossary/data-consumer)

A data consumer uses data to get work done - analysts, scientists, business users, applications, AI agents, regulators. Learn the types and what each needs.

Read more →

### [What Is a Chief Data Officer (CDO)?](https://www.dawiso.com/glossary/chief-data-officer)

The Chief Data Officer (CDO) is the executive accountable for data strategy, governance, and value. How the role differs from CIO and CISO, and its AI-era mandate.

Read more →

### [What Is a Data Steward? Role, Responsibilities and Types](https://www.dawiso.com/glossary/data-steward)

A data steward keeps one data domain defined, accurate and governed. What the role does day to day, the four steward types, skills and how to measure it.

Read more →

### [What Is a Data Catalog?](https://www.dawiso.com/glossary/data-catalog)

Learn what a data catalog is, how it works, and why it's the foundation of modern data governance.

Read more →