Who owns your data? Owner, steward and custodian, decided

The failure this fixes

A finance analyst leaves. Four months later someone notices that the margin figure in the monthly pack has been calculated on a stale cost table since March. Nobody was negligent. The pipeline ran, the report rendered, the number was wrong, and the honest answer to "whose job was it to notice?" is that it was nobody's.

That is not a tooling problem and no catalogue will fix it. It is an accountability problem, and it has a three-line solution that costs nothing to write down and some genuine political effort to agree.

The data owner

The owner is a named business leader who is accountable for a dataset. Not responsible — accountable. They are unlikely to touch the data. What they do is decide: who may use it, what it may be used for, what standard it is held to, and whether a proposed change is acceptable.

Three tests for whether you really have one:

• It is a person, not a title. "The Finance Director" is not an owner; Sarah Whitfield is. Titles cannot be asked a question.
• They accepted it. Ownership assigned in a spreadsheet by a consultant is not ownership. Somebody has to say yes, out loud, in a meeting where declining was an option.
• They are on the business side. If the owner of customer data is in IT, you have named a custodian and called them an owner. The person accountable for whether customer data is fit for use is the person whose targets depend on it.

Time cost, realistically: about ninety minutes to set a dataset up properly, and an hour a month afterwards. If you cannot find an hour a month, you have not found an owner.

The data steward

The steward does the work. They maintain the definitions, run or review the quality checks, keep the metadata current, and field the questions that arrive when someone cannot reconcile two numbers. In a business of this size the steward is usually a senior analyst or an operations manager who already knows the data better than anyone.

This is the role that makes the whole thing function, and it is the role most commonly handed to someone as a fifth priority with no time attached. Budget one to two hours a week per steward, per domain, and say the figure out loud when you assign it. A steward who has not been given the time will keep the register accurate for about a quarter.

One steward can cover several related datasets. What does not work is one steward covering everything, because the job is mostly judgement about meaning, and meaning is domain-specific.

The data custodian

The custodian operates the machinery: the pipelines, the storage, the access controls, the backups. In most mid-market businesses this is one or two people in IT, or an outsourced partner, and they are already doing the job without the label.

The label matters anyway, for one reason. When nobody has named an owner, the custodian ends up making ownership decisions by default — they are the ones being asked for access, so they are the ones deciding who gets it. That is an unfair position to put a systems engineer in, and it is how a business ends up with permissions nobody can explain.

Can one person hold two of these?

Yes, and in a business of 80 people they usually will. A head of operations can be the owner of operational data and the steward of it too. What must not collapse is owner and custodian, because that removes the only separation the model actually depends on: the person who decides who may see something should not be the same person who quietly configures it.

Write the doubling-up down rather than leaving it implied. "Owner: Sarah Whitfield. Steward: Sarah Whitfield." reads oddly and is honest. A blank steward field reads fine and is a lie.

What about the DPO?

Most organisations of 50 to 1,000 people are not required to appoint a Data Protection Officer under UK GDPR — the obligation turns on public authority status, large-scale monitoring, or large-scale special category processing, not on headcount. So the normal case is that you do not have one.

You still need the review the DPO would have done. Name whoever holds it — a governance lead, the company secretary, an external adviser on a retainer — and make one rule: the person reviewing a dataset for personal data must not be the person registering it.

How to actually assign them

Do not start with an org chart. Start with the list of things that break.

1. List the datasets and reports the business runs on. Most companies this size find between 60 and 300. It is a morning's work with the people who build reports.
2. Mark the ones where a wrong number would be visible outside the company — to a customer, a regulator, a lender, the board. That is usually 15 to 40 of them, and that is your first pass.
3. For each of those, write a name in the owner column. Not a department. If you cannot, that is the finding, and it is worth more than any assessment you could buy.
4. Take the list to the people you named. This is the hard part and the part that cannot be delegated to a tool. Expect two or three refusals and one genuine argument about who owns customer data. The argument is the value.
5. Record who accepted, and when. Ownership that is not dated is ownership that will be disputed.

The rest of the register can wait. Nobody has ever regretted starting with the forty that matter.