Identifying Data Roles: Who is the Data Subject?

Identity and Access Management

A company's marketing department collects, modifies, and stores sensitive customer data. The infrastructure team is responsible for securing the data while in transit and at rest. Which of the following data roles describes the customer?

Processor
Custodian
Subject Source Reference Answer
Owner

Community Votes

100%

100% of anonymous learners picked answer C. Votes are pick records left by other test-takers — they are not the verified answer.

Community Insight

The exam tests the precise definition of GDPR/privacy terminology where the 'Subject' is the person described by the data, while the 'Owner' is the internal organizational role responsible for governance.

This question tests the definition of data roles in privacy frameworks, specifically distinguishing between the entity holding data and the individual it describes. The community consensus confirms that customers are 'Data Subjects' because they are the individuals to whom the personal data pertains.

Candidates often select 'Owner' (D) because, in general legal terms, individuals own their data. However, in cybersecurity compliance contexts (like ISO 27001 or NIST), 'Data Owner' refers to an internal business executive who authorizes access and defines requirements, not the external customer.

Community Discussion (14 comments)

EOtero 👍 15

From Professor Messer study notes: Data subject • Any information relating to an identified or identifiable natural person – An individual with personal data • This includes everyone – Name, ID number, address information, genetic makeup, physical characteristics, location data, etc. – You are the data subject • Laws and regulations – Privacy is ideally defined from the perspective of the data subject Data owner – Accountable for specific data, often a senior officer – VP of Sales owns the customer relationship data – Treasurer owns the financial information I'm also going with C.

Etc_Shadow28000 👍 7 Selected: C

C. Subject In the context of data roles, the customer whose sensitive data is being collected, modified, and stored is referred to as the "Subject." The data subject is the individual to whom the data pertains. Therefore, the correct answer is: C. Subject

9149f41 👍 4 Selected: C

Easy to remember the role: Owner (D): The hospital (owns and controls the data). Processor (A): The cloud service provider (processes the data on behalf of the hospital). Custodian (B): The IT team (manages the technical aspects of the data). Subject (C): The patient (the individual whose data is being collected). The question says: Which of the following data roles describes the customer? So, the customer is always a SUBJECT.

Dimpo_Oz 👍 1 Selected: C

Data is object person interacting with object is subject

AutoroTink 👍 3 Selected: C

The Marketing Department Head or other senior-level manager is likely something like the Data Protection Officer or Owner, responsible for the data. The Infrastructure Team are likely the Custodians. The data is likely being collected and processed by lower-level employees and/or automated processes. These would be the Data Processors. That leaves the customer whose data is being collected. They aren't the owners of their own data (like others have stated), but they are the data subject. So C is the most accurate answer.

Fhaddad81 👍 1

D is the correct Answer as Data subject is who own the data while Owner is the customer that data subject given their data. Data subject is not mentioned on Udemy course !!

qacollin 👍 1 Selected: C

chat gpt

dbrowndiver 👍 3 Selected: C

In this scenario, the customers are the data subjects because the sensitive information collected, modified, and stored by the marketing department pertains to them. The customers are the individuals whose data is being processed.

Shaman73 👍 1 Selected: C

C. Subject

hasquaati 👍 2 Selected: C

Answer is c. Technically the customer does own their own data, however in the Cybersecurity context the Owner is someone within the organization. According to ISO/IEC 27001, the data owner is responsible for ensuring the confidentiality, integrity, and availability of information assets.

Xavierallen9711 👍 1 Selected: D

Owner is the right answer

Yoez 👍 4 Selected: C

C. Subject In this scenario, the customer is the subject of the sensitive data being collected, modified, and stored by the marketing department. The customer's data is being processed and managed by the marketing department, but the customer themselves is the subject of that data. They are the individuals to whom the data pertains.

e5c1bb5 👍 2 Selected: C

although not covered in study material ive looked at, the customer is definately not the processor or the controller. owners are usually senior management so thats out. going with subject.

Ochopperfan 👍 2 Selected: D

Why wouldn't the customer be the data owner? I don't remember Data Subject being apart of the 701 Course

Comments & Corrections

No comments yet — spotted an error or have a note? Share it below.

Expert Analysis

Why the Answer Is Correct

In data privacy frameworks such as GDPR and HIPAA, a Data Subject is defined as any living individual who can be identified, directly or indirectly, by the data being processed. Since the marketing department is collecting sensitive information about the customers, those customers are the subjects of that data. This aligns perfectly with Option C.

Why the Other Options Are Wrong

Option A (Processor) refers to the entity processing data on behalf of a controller (e.g., a cloud provider or IT vendor). Option B (Custodian) typically refers to the technical team (like Infrastructure) that maintains and secures the data but does not have decision-making authority over it. Option D (Owner) is the most common trap; in corporate security, the Data Owner is an internal employee (e.g., Marketing Director) accountable for the data classification and protection policies, not the external customer.

Community Comment Notes

Comment [3] provides an excellent mnemonic: Owner = Senior Management, Custodian = IT Team, Processor = External Service Provider, Subject = Patient/Customer. Comment [7] clarifies that while customers legally own their identity, the term 'Data Owner' in certification exams strictly refers to the internal asset owner. Comment [5] correctly identifies that the Marketing Head would likely be the Data Owner or Data Protection Officer.

Official Reference

https://gdpr.eu/what-is-gdpr/

Exam Strategy

When answering questions about data roles, always look for context clues regarding 'internal vs. external' and 'technical vs. managerial'. If the option describes the person the data is about, it is the Subject. If it describes the person accountable for the data within the company, it is the Owner.

Related Analysis

Practice All SY0-701 Questions

Access 100 questions with complete answers and detailed explanations.

View Full SY0-701 Practice Test →

← Back to SY0-701 Study Guide