Every business we talk to has a privacy statement on its website and a data register tucked away in a folder on the server. Ask who within the company is responsible for the personal data it processes, and the room goes quiet. Not because nobody knows, but because nobody ever wrote it down.
That is what this article is about. Not whether you comply with privacy law on paper, but who in your organisation actually owns the data of your customers, employees, drivers and suppliers. And what that ownership means in practice.
Personal data is everywhere, ownership rarely is
In a wholesale business, customer data sits in the CRM, purchasing contacts with suppliers, and personnel files with HR. In a transport company, add driving licence details, driver location data and time registration. In manufacturing companies, there is often data on temporary staff and subcontractors as well.
All that data has a place, but rarely an owner. There is a system administrator who manages access, an HR employee who keeps the files, and a director who signed the privacy statement. But who decides how long a driver’s record stays in the system after they leave? Who decides who can see payslips? Who approves a new supplier asking for access to the customer database?
Without a clear answer to those questions, ownership is formally with management, since they carry legal responsibility, but in practice it belongs to no one. You only notice this the moment someone asks about it: a regulator, a customer, or a departing employee who wants to see their own file.
Ownership is a governance choice, not an ICT task
We often get asked whether we, as an ICT partner, can arrange privacy for a business. We cannot, and that should not be the intention. Technology can restrict access, encrypt data and let retention periods expire automatically. But technology cannot decide what the right retention period is, or who should have access to which file. Those are governance choices.
Ownership means someone, with a name and a role, is responsible for a category of data. Not because that person carries out every task themselves, but because they can explain why a particular choice was made. In one organisation that sits with the director, in another with an HR manager or operations manager. The exact role matters less than the fact that it is clearly assigned somewhere, rather than silently ending up with the ICT department.
Measure first, then set policy
Before you can decide who is responsible for what, you need to know what you actually have. That is why we never start this process with a policy document, but with an inventory: which personal data you process, which systems hold it, who currently has access, and how long it is kept. That inventory is often surprising. Customer data turns up in a spreadsheet nobody uses anymore, or an old CRM system is still quietly running inside a backup.
Without that starting point, any privacy policy is just paper. You can write a beautiful document about retention periods, but if you do not know where the data actually sits, that policy cannot be carried out or checked.
Policy before technology, technology follows
Only once the inventory exists and ownership is assigned does it make sense to look at technology. Do you want data from former employees automatically removed after a set period? Then agree and record that period first, and only then look for the technical solution that enforces it. It does not work well the other way round. A system that cleans up automatically without policy behind it can just as easily clean up the wrong things, or at the wrong time.
Bring people along before you make it mandatory
Recording ownership is one step, but it only works once the people who handle that data daily understand why it is organised this way. A planner who suddenly loses access to customer addresses, without explanation, will look for a workaround. Explain what is changing and why before you make it mandatory. That prevents resistance, and it prevents people inventing their own solutions, which is exactly what you were trying to avoid.
Demonstrable, not just a feeling
The end goal is not a vague sense that things are probably fine. The goal is being able to show how things are organised: who owns which data, on what basis retention periods were chosen, and who has access. That is also exactly what NIS2 asks for: not a box ticked, but being demonstrably on track with NIS2 in how you handle data and risk.
For many businesses, that starts with an honest answer to the question this article opened with: who in our company owns the personal data we process? If you cannot name that person right away, you also know exactly where to start tomorrow.
A few questions we’re often asked
Do we need a separate owner for every type of data?
Not for every individual data type, but it helps to group it logically: customer data, personnel data, data on drivers or subcontractors, for example. Too much fragmentation makes it unmanageable, too little lets responsibility evaporate.
Is the director automatically the owner?
Legally, management carries ultimate responsibility, but that is different from day-to-day ownership. It is often wiser to assign daily responsibility to someone close to the data itself, so decisions actually get made instead of sitting untouched.
We already have a data processing register, isn’t that enough?
A register usually describes what is processed, but says little about who decides on it or how current it still is. Many registers were filled in once and never updated since. Ownership ensures someone keeps that register alive.
Does arranging ownership properly take a lot of time?
The first step, mapping what you process and where it lives, usually takes more time than actually assigning responsibility. Once that overview exists, appointing owners is often a matter of a few conversations and writing it down clearly.
Curious where personal data lives within your organisation and who should own it? We are happy to think it through with you, as part of the bigger picture of how your business handles information.
