Identifying Data Roles: Who is the Data Subject?

SY0-701 By islever Editorial Last updated

Short answer

C Subject

Question

A company's marketing department collects, modifies, and stores sensitive customer data. The infrastructure team is responsible for securing the data while in transit and at rest. Which of the following data roles describes the customer?
  1. Processor
  2. Custodian
  3. Subject Correct Answer
  4. Owner

Key Takeaways

The exam tests the precise definition of GDPR/privacy terminology where the 'Subject' is the person described by the data, while the 'Owner' is the internal organizational role responsible for governance.

This question tests the definition of data roles in privacy frameworks, specifically distinguishing between the entity holding data and the individual it describes. The community consensus confirms that customers are 'Data Subjects' because they are the individuals to whom the personal data pertains.

Common mistake: Candidates often select 'Owner' (D) because, in general legal terms, individuals own their data. However, in cybersecurity compliance contexts (like ISO 27001 or NIST), 'Data Owner' refers to an internal business executive who authorizes access and defines requirements, not the external customer.

Expert Analysis

Why the Answer Is Correct

In data privacy frameworks such as GDPR and HIPAA, a Data Subject is defined as any living individual who can be identified, directly or indirectly, by the data being processed. Since the marketing department is collecting sensitive information about the customers, those customers are the subjects of that data. This aligns perfectly with Option C.

Why the Other Options Are Wrong

Option A (Processor) refers to the entity processing data on behalf of a controller (e.g., a cloud provider or IT vendor). Option B (Custodian) typically refers to the technical team (like Infrastructure) that maintains and secures the data but does not have decision-making authority over it. Option D (Owner) is the most common trap; in corporate security, the Data Owner is an internal employee (e.g., Marketing Director) accountable for the data classification and protection policies, not the external customer.

Community Comment Notes

Comment [3] provides an excellent mnemonic: Owner = Senior Management, Custodian = IT Team, Processor = External Service Provider, Subject = Patient/Customer. Comment [7] clarifies that while customers legally own their identity, the term 'Data Owner' in certification exams strictly refers to the internal asset owner. Comment [5] correctly identifies that the Marketing Head would likely be the Data Owner or Data Protection Officer.

Official Reference

https://gdpr.eu/what-is-gdpr/

This link opens the official vendor documentation in a new tab.

Exam Strategy

When answering questions about data roles, always look for context clues regarding 'internal vs. external' and 'technical vs. managerial'. If the option describes the person the data is about, it is the Subject. If it describes the person accountable for the data within the company, it is the Owner.

Community Votes

C
100%

100% of anonymous learners picked answer C. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 14 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 14

  1. EOtero 👍 15
    From Professor Messer study notes: Data subject • Any information relating to an identified or identifiable natural person – An individual with personal data • This includes everyone – Name, ID number, address information, genetic makeup, physical characteristics, location data, etc. – You are the data subject • Laws and regulations – Privacy is ideally defined from the perspective of the data subject Data owner – Accountable for specific data, often a senior officer – VP of Sales owns the customer relationship data – Treasurer owns the financial information I'm also going with C.
  2. Etc_Shadow28000 👍 7 Answered C
    C. Subject In the context of data roles, the customer whose sensitive data is being collected, modified, and stored is referred to as the "Subject." The data subject is the individual to whom the data pertains. Therefore, the correct answer is: C. Subject
  3. 9149f41 👍 4 Answered C
    Easy to remember the role: Owner (D): The hospital (owns and controls the data). Processor (A): The cloud service provider (processes the data on behalf of the hospital). Custodian (B): The IT team (manages the technical aspects of the data). Subject (C): The patient (the individual whose data is being collected). The question says: Which of the following data roles describes the customer? So, the customer is always a SUBJECT.
  4. Yoez 👍 4 Answered C
    C. Subject In this scenario, the customer is the subject of the sensitive data being collected, modified, and stored by the marketing department. The customer's data is being processed and managed by the marketing department, but the customer themselves is the subject of that data. They are the individuals to whom the data pertains.
  5. AutoroTink 👍 3 Answered C
    The Marketing Department Head or other senior-level manager is likely something like the Data Protection Officer or Owner, responsible for the data. The Infrastructure Team are likely the Custodians. The data is likely being collected and processed by lower-level employees and/or automated processes. These would be the Data Processors. That leaves the customer whose data is being collected. They aren't the owners of their own data (like others have stated), but they are the data subject. So C is the most accurate answer.
Show 9 more comments
  1. dbrowndiver 👍 3 Answered C
    In this scenario, the customers are the data subjects because the sensitive information collected, modified, and stored by the marketing department pertains to them. The customers are the individuals whose data is being processed.
  2. hasquaati 👍 2 Answered C
    Answer is c. Technically the customer does own their own data, however in the Cybersecurity context the Owner is someone within the organization. According to ISO/IEC 27001, the data owner is responsible for ensuring the confidentiality, integrity, and availability of information assets.
  3. e5c1bb5 👍 2 Answered C
    although not covered in study material ive looked at, the customer is definately not the processor or the controller. owners are usually senior management so thats out. going with subject.
  4. Ochopperfan 👍 2 Answered D
    Why wouldn't the customer be the data owner? I don't remember Data Subject being apart of the 701 Course
  5. Fhaddad81 👍 1
    D is the correct Answer as Data subject is who own the data while Owner is the customer that data subject given their data. Data subject is not mentioned on Udemy course !!
  6. Dimpo_Oz 👍 1 Answered C
    Data is object person interacting with object is subject
  7. Xavierallen9711 👍 1 Answered D
    Owner is the right answer
  8. Shaman73 👍 1 Answered C
    C. Subject
  9. qacollin 👍 1 Answered C
    chat gpt

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

CCTV and Surveillance Signs as Security Controls

S-grade

When Should an Engineer Decommission a Network Device?

S-grade

Which Controls Secure Remote Access to Sensitive PHI Applications?

S-grade

Which Zero Trust Component Belongs to the Data Plane?

S-grade

Practice All SY0-701 Questions

Access 100 questions with complete answers and detailed explanations.

View Full SY0-701 Practice Test →

← Back to SY0-701 Study Guide