Two business units disagree about how sensitive a customer analytics data set hosted in the cloud should be considered. The data set belongs to the marketing division, whose director is formally designated as its data owner. Who should assign the classification?
Select an answer to reveal the explanation.
Short Explanation
The person who's accountable for the data gets to say how precious it is. That's the data owner, and you should send the decision their way every time. Custodians, processors and the provider carry out the protection, but they don't set the classification.
Full Explanation
Data classification is a governance decision, and accountability for it sits with the data owner, the business role responsible for the data set, its value and its risk. The owner assigns the classification, approves who may access the data and determines the level of protection, often with input from security, privacy and legal teams. Once classified, other roles implement the decision. The data custodian, typically IT or operations, implements and maintains the technical controls, such as storage, backup, encryption and access configuration, according to the owner's classification; the custodian does not decide it. The cloud service provider operates the infrastructure and is responsible for its side of the shared responsibility model, but it has no authority over the customer's classification of its own data. A data processor acts on behalf of and under the instructions of the controller; it executes processing tasks and should not determine how sensitive the data is. Exam caveat: when business units disagree, the answer is not a technical role but the accountable owner, with escalation through data governance if ownership itself is contested. Operational check: confirm every data set in the inventory has a named owner and that the classification record shows the owner's approval.