Data Custodian

A data custodian is the technical role responsible for safely operating the systems where data lives. While the data owner decides policy (who may access the data, how it is classified) and the steward maintains business context, the custodian implements the controls: provisioning storage, applying access permissions and encryption, running backups, managing retention and disposal, and ensuring platform availability and performance. Custodians typically sit in IT, database administration, or platform engineering teams.

The distinction matters because it separates decision rights from implementation. A custodian should never decide on their own who gets access to customer data — they execute the owner's approved policy. Conversely, an owner should not need database privileges to fulfill their accountability.

For a Saudi Data Management Office, the custodian role is central to evidencing the security and operations controls of the NDMO framework and the safeguard obligations of the PDPL, which require appropriate technical and organizational measures to protect personal data. In audits, the question is rarely just "is the data encrypted?" but "who is responsible for ensuring it is, and can you show the assignment?" Recording custodianship alongside ownership and stewardship in the data catalog gives the DMO that answer for every asset.