Preparing Practice Exam…
Please wait a moment while the system generates the exam questions, answers, and study session.
Please wait a moment while the system generates the exam questions, answers, and study session.
ISACA Certified in Risk and Information Systems Control · Isaca
Select one answer.
Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.
If the IT team were external (e.g., a third-party vendor), then they would be considered a data processor. But since the question specifies the internal IT team, they are not a separate legal entity and thus not a processor in the regulatory sense.
Data processors are typically external entities or teams that process data on behalf of a data controller. While the internal IT team is responsible for processing data through applications, in a broader context, data processor refers to an entity that processes personal data as part of their contractual relationship with the data controller. In this case, if the internal IT team is directly involved in processing data but under the control and direction of the data owner (e.g., business units), they act as data custodians, not as independent processors.
B. Data Custodians: This role is responsible for the safe custody, transport, storage of the data and implementation of business rules. Essentially, they are in charge of the technical environment and database systems where data is stored and managed. They ensure that data is accessible to those who need it and protected from those who don't.