[GDPR Step 3] How to Confirm Data Owners

“Who owns data?” has always been a difficult question to answer. In the context of the General Data Protection Regulation (GDPR), certain questions assume more significance, such as:

• Does the data subject own it or the organization?
• Within the organization, how do we assign ownership?
• Should the ownership be single-point or collaborative?

Talend recently hosted an on-demand webinar, Practical Steps to GDPR Compliance, that focuses on a comprehensive 16-step plan to help organizations set themselves up for GDPR compliance.

Here are the the first two steps of this plan: creating policies and controls and a data taxonomy. Assigning data owners is the third step.

What is Data Ownership?

Data ownership refers to the explicit assignment of owners to every data element in the taxonomy. Data owners are either individuals or teams who make decisions such as who has the right to access and edit data and how it’s used. Owners may not work with their data every day, but are responsible for overseeing and protecting a data domain.

In the context of the GDPR, data owners are accountable for the quality, integrity, and protection of their data space.

Data owners can be directly in charge of remediating issues with data, or delegate those tasks to data stewards. Data stewards work with data on a daily basis, ensuring that it’s accurate, de-duplicated, and consolidated to a single version of truth.

For example, the customer contact number, address, and email could be different in different systems. The data steward may then choose to pick the address from the ordering system, mobile number from the sales system, and email address from the marketing system.

The term “data ownership” is often confused with legal data ownership, which, as established by the GDPR, remains with the data subject. However, the context of data ownership in this article is within the organization and ownership refers to accountability.

The Importance of Assigning Data Owners

In most organizations, as data passes through different teams and systems, assigning data owners can be cumbersome. However, this is a critical step for GDPR compliance.

Here’s why assigning data owners is important:

1. Accountability — Ownership creates accountability. Since GDPR introduces many controls on personal data, assigning responsibilities ensures that data will be continuously monitored for compliance by the owners.

2. Defining policies — As they have a vested interest in the integrity of their data, owners focus on defining policies (for example retention or deletion policies) and standards that ensure the alignment of their data to the GDPR.

3. Creating trusted data — Data ownership is a key ingredient to gain customer trust and achieve measurable business benefits. Poor data could easily result in bad customer experiences and ultimately losing customers. In particular, when personal data is not reconciled into a data subject 360° view, compliance with data subject access rights, such as rights of portability or rights to be forgotten cannot be fully achieved.

4. Eliminating redundancies — As organizations strive to put the appropriate governance framework in place for GDPR, one common frustration is a loss of productivity. This issue stems from multiple teams addressing the same problem either because there isn’t a clear understanding of data or they’re not even aware that the problem has been resolved by another team. Federated ownership eliminates these painful issues.

How to Identify Data Owners: Three Questions to Ask

The mandatory introduction of a data protection officer (DPO) role by GDPR in most organizations effectively creates a master data owner. Each and every element in a data taxonomy needs an individual owner, however, and there is little likelihood that a single DPO can hold this responsibility on such a large scale. In addition, this could create a security issue. Delegation and segregation of duties are needed.

Asking the right questions helps. Once these questions have been answered, the data owner should become more clear:

1. Who is most impacted by data accuracy?

Consider an order placed by a customer in an investment bank. The customer talks to the sales person who initiates the order. The order is then passed on to the trading team, which does the actual booking of the trade. At the end of the day, the operations team performs reconciliations on these trade bookings and resolves conflicts.

Now, who is impacted if the trade data is incorrect? Perhaps, all of them. But, who is impacted the most?

2. Who has authority to decide the next step?

In this example, the sales team has to tell the customer about the problem, which risks customer trust. The reconciliation team has the responsibility to resolve issues resulting from the incorrect trade booking. The tech team deals with the IT repercussions of the incorrect trade.

However, the trading team is the one that has to take the ownership and rebook the trade with the correct details. The trading team’s core function is impacted by this wrong booking. It is also the team that has the ultimate authority to decide on the changes.

The reconciliation and tech teams may already know what the issue is, but they do not have the rights to make the decision. They may act as data stewards and eventually end up making the change, but in this scenario, the trading team owns the “trade” data.

3. Who owns the related data attributes?

Now, consider this: A trade is associated with a customer in this example. Who owns the customer details? Although, the customer is linked to the trade, the trading team certainly doesn’t own the customer information. The sales team is more likely to own this.

The flow of data through a company is complex; by repeating this process for each element, businesses get clarity on how data is used. By looking at related attributes and their ownerships, and continuing the chain of analysis, the big picture on data ownership emerges. Once the owner is assigned, it then becomes easier to enforce GDPR compliance.

Using Talend for Assigning Ownership

Talend Metadata Manager helps catalog the data owners and data stewards for data categories and subcategories identified in Step 2, and assign their related roles and workflows.

Talend Data Stewardship engages these data owners and data stewards within workflows with secured and auditable, role-based access controls to operationalize self-service processes. Some of these processes include: data arbitration, error resolution, and approval of data standards, as you can see below.

Figure 1: Assigning roles for collaborative arbitration, error resolution, and merging/grouping campaigns in Talend Data Stewardship

Next Steps to GDPR Compliance

After assigning ownership comes the important step of identifying critical data sets and data elements.

← Step 2  |  Step 4 →