Data owner vs data steward in master data: who decides what by domain
How data owner and data steward roles split decisions in master data, with a decision matrix for materials, suppliers and customers and first steps.
The data owner decides and is accountable for the data in a domain: they approve rules, exceptions and sensitive changes. The data steward looks after those rules day to day: defining attributes and allowed values and handling quality issues. The master data team executes, and IT stores and runs the system without owning the data.
An email arrives asking to change a supplier's bank account. The analyst on the master data team opens the record, updates bank, branch and account number, and that week's payment goes to the new account. A few weeks later the supplier calls asking where the money is. The new account was never theirs.
Then the meeting starts. Procurement says bank details belong to finance. Finance says records belong to the master data team. The master data team says they only did what was requested. IT pulls the log: the field was changed by a user with the right permissions. Everyone did their part, and nobody owned the decision. That is the gap a clear split between data owner and data steward closes.
What is a data owner and what is a data steward?
No law defines these roles for private companies. Two public references, however, help separate them.
The first is Brazil's Decreto nº 10.046/2019, a federal decree on data governance in Brazil's federal public administration. It applies to Brazilian federal agencies, not to companies. We use it here only as a conceptual reference, because it draws a clean line between who governs data and who keeps it. Article 2 defines (our translation):
- Data manager (item XIII): the "agency or entity responsible for the governance of a given set of data". This is the closest role to a data owner.
- Data custodian (item XI): the "agency or entity that, wholly or partly, takes care of the storage, operation, administration and preservation of data collected by the federal public administration that does not belong to it but is under its custody". This is the closest role to IT.
- Data governance (item XV): the "exercise of authority and control that enables data to be managed from the perspectives of sharing, architecture, security, quality, operation and other technological aspects".
Note the custodian wording: the data "does not belong to it". Keeping data does not make anyone its owner.
The second reference is the NIST glossary, published by the US government's standards institute and focused on information security. One of its definitions of data steward (sourced from CNSSI 4009-2022) says data stewards are accountable, within an assigned subject area, for "maintaining data names, business definitions, data integrity rules, and domain values", for "analyzing and improving data quality" and for "identifying and resolving related issues".
In master data terms: the steward is the person who knows why a field exists, which values it accepts and what to do when it comes in wrong. If governance and data management still blur together for you, start with the difference between data management and data governance.
How do owner, steward, master data team and IT differ?
There are four roles. When two of them merge, the decision disappears.
| Role | What it does | What it does not do | Who usually holds it |
|---|---|---|---|
| Data owner | Decides and is accountable for the domain's results. Approves rules, exceptions and sensitive changes. | Does not key in records or review each case. | A leader from the area that suffers most when the data is wrong. |
| Data steward | Writes and maintains rules, attributes and allowed values. Analyzes quality issues and proposes fixes. | Does not approve alone anything that touches money, risk or another area's process. | A business specialist in the domain, with time set aside for it. |
| Master data team and requester | The requester asks, with a reason. The team checks, creates and changes records following the rules. | Does not invent new rules on the fly or approve its own requests. | The master data team and users in each area. |
| IT or custodian | Stores, runs and protects the system. Configures validations, access and change history. | Does not decide which value is right or who may approve. | Systems, ERP and infrastructure teams. |
Who decides what for materials, suppliers and customers?
The tables below are a starting point. Which area takes each role varies from company to company. The logic of separating deciding, looking after, executing and operating does not.
Materials
The owner usually comes from whoever is accountable for how the item is used: engineering or planning for production materials, maintenance for spare parts and MRO items. Duplicates are the typical pain here, and knowing how to identify duplicate materials helps the steward write the rule.
| Decision type | Data owner | Data steward | Master data team and requester | IT or custodian |
|---|---|---|---|---|
| Define attribute and rule | Approves the description standard and required fields per material type | Writes the standard, allowed values and duplicate rule | Flags when a rule does not fit a real case | Configures fields and validations |
| Create record | Not involved case by case | Reviews cases outside the standard | Requester asks with a reason; team checks for duplicates and creates | Maintains system and access |
| Approve exception | Approves an off-standard item or an urgent creation | Analyzes and recommends | Records the exception and the reason | Releases only after approval |
| Sensitive change | Approves a change of unit of measure or material type when there is stock or open orders | Assesses the impact across areas | Executes after approval | Keeps the change history |
| Block or deactivate | Sets the blocking criteria | Identifies candidates and duplicates | Executes the block | Runs mass blocking on request |
| Track metric | Follows up and answers for the result | Measures and explains the cause | Fixes pending items | Provides the data extract |
Suppliers
Here the pain is rarely duplicates, since the tax ID usually anchors the record. The pain is unqualified suppliers, expired documents, registration status that does not match the official tax registry, and bank changes with no owner. A common pattern: procurement owns the relationship and supplier qualification, and finance owns the bank and payment data group.
| Decision type | Data owner | Data steward | Master data team and requester | IT or custodian |
|---|---|---|---|---|
| Define attribute and rule | Procurement approves qualification criteria; finance approves bank data rules | Defines required documents, validity and mandatory fields | Flags when a document does not exist for that type of supplier | Configures validations and automated checks |
| Create record | Not involved case by case | Reviews cases with pending items | Buyer requests; team checks documents and registration status and creates | Maintains system and access |
| Approve exception | Procurement approves an emergency supplier with a pending document | Sets the deadline and conditions of the exception | Records the exception and follows up | Releases only after approval |
| Sensitive change | Finance approves bank account changes | Defines how to confirm the change with the supplier | Executes after confirmation; the requester does not approve | Ensures the person who changes is not the person who approves |
| Block or deactivate | Procurement sets criteria for expired documents or inactivity | Identifies the cases | Executes the block | Runs mass blocking on request |
| Track metric | Each owner follows up and answers for its data group | Measures and explains the cause | Fixes pending items | Provides the data extract |
Customers
The owner is usually sales for relationship and sales data, and credit or finance for credit limit, payment terms and blocks due to non-payment. If your company runs SAP S/4HANA, read about business partner master data in S/4HANA before splitting roles between suppliers and customers.
| Decision type | Data owner | Data steward | Master data team and requester | IT or custodian |
|---|---|---|---|---|
| Define attribute and rule | Sales approves sales fields; credit approves credit limit and payment term rules | Defines required fields per customer type and allowed values | Flags when sales reps cannot obtain the information | Configures validations and access profiles |
| Create record | Not involved case by case | Reviews cases outside the standard | Sales rep requests; team checks and creates | Maintains system and access |
| Approve exception | Sales approves selling to a customer with an incomplete record | Defines what may be missing and for how long | Records the exception | Releases only after approval |
| Sensitive change | Credit approves credit limit changes | Defines the evidence required | Executes after approval; the requester does not approve | Keeps the change history |
| Block or deactivate | Credit decides risk blocks; sales decides deactivation for inactivity | Identifies the cases | Executes the block | Runs mass blocking on request |
| Track metric | Each owner follows up and answers for its data group | Measures and explains the cause | Fixes pending items | Provides the data extract |
Whether you govern one domain at a time or all of them together changes how many owners you need. The article on single-domain or multidomain MDM helps with that choice.
How do you choose the data owner for each domain?
Pick the person who suffers the error and answers for the process. Do not pick the person who types.
- Who loses when the data is wrong? A payment to the wrong account is a finance loss. A part bought twice is a procurement and maintenance loss.
- Who has the authority to say no? The owner must be able to turn down an exception requested by another area.
- Who has time to decide? An owner who takes weeks to approve becomes a bottleneck, and the master data team starts deciding in their place.
- Who answers for the metric? If the domain's quality drops, this is the person who has to explain it.
What signs show the roles are poorly defined?
- Every exception goes out by email to several people and nobody replies.
- The master data team decides field values because there is no one to ask.
- The person who requests a change also approves it.
- The filling rule lives in one person's head and is not written down.
- After an error, the discussion is about who typed it, not about who should have decided.
What are the most common mistakes when splitting the roles?
- IT as data owner. IT stores and operates. It cannot tell whether a bank account belongs to the supplier or whether a credit limit makes sense.
- An owner with no time. The title is senior, but the person never approves anything. Decisions end up with whoever executes.
- A steward with no authority. They write the rule, but nobody has to follow it.
- One owner for everything. One person cannot master materials, suppliers and customers at once.
- A committee deciding everything. A committee is for conflicts between areas, not for approving every exception.
Hypothetical example: a bank account change with clear roles
Hypothetical example, for illustration only. A manufacturer receives 40 supplier bank change requests a month. It names the accounts payable manager as owner of bank data and a senior finance analyst as steward.
- The steward writes the rule: every account change requires a letter from the supplier and a phone confirmation to a number that was already on file before the request.
- The owner approves the rule and states that bank changes are never handled as urgent.
- The master data team only executes requests with both pieces of evidence, after approval by someone in accounts payable designated by the owner, who cannot be the requester.
- IT configures the system so the user who changes is different from the user who approves, and keeps the history of every change.
- Each month, the steward shows the owner how many requests came in, how many were rejected and why.
The figure is illustrative. What matters is that, if the fake email from the opening arrived here, there would be a clear owner to stop it.
Where should you start?
- Pick one domain and one decision type that has already caused trouble, such as supplier bank changes or material creation.
- List who decides today, who executes and who is only informed. Write down what really happens, not what should happen.
- Name an owner and a steward for that slice, with name and job title.
- Write the rule on one page and put into the system whatever can be validated.
- Choose a simple metric for the owner to follow. There is a guide on how to measure master data quality.
- Move to the next domain once the first one is running.
If you do not know where the biggest problem is, a free master data diagnostic shows where the issues concentrate before you design the roles. A minimum policy, a committee and monthly metrics come later, each in its own time.
Frequently asked questions
Can one person be both data owner and data steward?
Yes, in a small company or a low-volume domain. The care point is not letting the same person approve what they proposed for sensitive changes. In those cases, someone else needs to review.
Does the data owner have to be a director?
No. They need authority over the process and time to decide. A manager who answers for the domain's results usually works better than a director who never opens the approvals.
How many data stewards does each domain need?
It depends on volume and variety. A domain can have one steward per data group, such as bank data and qualification data for suppliers. What it cannot have is a data group with no steward at all.
Is a key user the same as a data steward?
Not necessarily. A key user masters the system and trains people. A steward answers for the data rule. Sometimes it is the same person, but the responsibilities are different.
What changes when the customer is an individual?
Personal data calls for care over who can see and change it. The owner approves who gets access, the steward defines which fields are really needed and IT applies the access profiles.
What happens when the data owner leaves the company or changes roles?
Record the owner by job title as well as by name, and appoint a substitute before the person leaves, so approvals do not stall.
How 4MDG can help
A bank change with no owner usually shows up alongside messy data. Cleaning again does not solve it if there is no policy, no defined roles and no metric being tracked. 4MDG offers a free diagnostic, subject to an assessment of applicability and availability, on a real slice of your materials, suppliers and customers data: you send a sample as a spreadsheet or extract, and nothing is installed in your environment. In MDM Engineering, data owner and data steward roles are defined in a RACI matrix, attribute by attribute and step by step, together with the master data team operating model. If you want to discuss your case, get in touch.
Sources
The criteria in this article are practice recommendations, not legal requirements for private companies.
- Presidency of the Republic of Brazil. Decreto nº 10.046, of October 9, 2019, Article 2. https://www.planalto.gov.br/ccivil_03/_ato2019-2022/2019/decreto/d10046.htm. Accessed on October 16, 2026.
- NIST, Computer Security Resource Center. Glossary: data steward (source: CNSSI 4009-2022). https://csrc.nist.gov/glossary/term/data_steward. Accessed on October 16, 2026.