Data owner vs data custodian vs data steward: who can authorize a data license?

Which role can authorize a data license?

The authorized sponsor can: the owner, CEO, CFO or another authorized representative who can bind the company to a contract. A data custodian (the IT or platform team that keeps the data safe) and a data steward (the person who keeps definitions and quality in order) are essential to preparing a license, but neither can sign off on one by title alone.

This matters in practice because the person who knows where the records live is usually not the person with authority to license them. A smooth process needs both in the room.

The three governance roles side by side

Titles vary. Smaller companies often combine all three in one or two people, and some use "data controller" or "data processor" in the legal sense, which is a separate concept tied to privacy law rather than an internal governance role.

Owner vs authorized sponsor

Governance documents often name a "data owner" for each domain, such as the head of sales for CRM data. That person is accountable for how data is used inside the business. Licensing it to an outside party is a contract decision, so it needs someone with signature authority: the owner, CEO, CFO or an authorized representative. In a company with a board or investors, that person may need approvals first. The data license agreement page explains what is typically covered once the sponsor decides to proceed.

When each role is the right person to talk to

Why this is not just terminology

Three common mistakes slow companies down.

• Treating an administrator as authority. A cloud admin can export a mailbox but cannot decide to license it, and an export alone does not create rights.
• Skipping the steward. Records without definitions are hard for buyers to evaluate, so the company loses time later.
• Assuming the custodian owns the data. Hosting providers and outsourced IT keep data safe; they do not own it. Ownership is a question of contract and law, covered in the customer data ownership clause explainer.

For a company, the practical lesson is to name one sponsor early and give the custodian and steward defined roles. The what is a data asset and what is unstructured data pages explain what the records themselves look like.

When A wins and when B wins

Choose the owner or authorized sponsor when the question is whether, on what terms and at what price. Choose the custodian when the question is where the records live, how complete they are and whether they can be preserved. Choose the steward when buyers will need to understand what a field, status code or category means.

Illustrative scenario: a fictional 180-person logistics company, Meridian Dispatch Group, keeps ten years of shipment tickets in a helpdesk tool and a legacy dispatch system. Its IT director (custodian) confirms both archives can be exported. An operations analyst (steward) explains how ticket statuses map to outcomes. The CFO (authorized sponsor) decides whether to explore a license and signs if price and terms are acceptable. Each person is necessary, but only one decision-maker can commit the company.

Red flags in role confusion

• The only person who knows the systems is an outside IT contractor with no authority to bind the company.
• Several executives each assume another one is the data owner.
• A department head says "it's our data" without having read customer contracts.
• Nobody is accountable for retention, so archives are deleted on a vendor's schedule.

How SourceX fits

SourceX manages data licensing between companies that hold proprietary data and AI developers, from sourcing and rights review to delivery and payment. The company keeps ownership, data is licensed rather than sold, and nothing is binding until the company agrees price and terms and signs. The authorized sponsor leads those decisions, with the company's IT custodian supporting the inventory of systems and exports. De-identification and redaction requirements are agreed before any work begins, and data is delivered only after an executed agreement and the company's authorization. The exit readiness guide shows how the same role questions come up in sale planning.

To check basic eligibility first, the company fit checker is a preliminary, non-binding screen that needs no contact details, and the who qualifies page lists the baseline: US company, 50+ full-time employees at peak (contractors excluded), several years of documented operations, rights to license the data and an authorized sponsor.

Questions to settle internally

• Who in the company has signature authority for a data license?
• Which executive is accountable for each major system's data?
• Who can run exports, and have they confirmed archives still exist?
• Who can explain the fields, statuses and definitions?
• Do customer and vendor contracts restrict use of the records?

Next step

Business owners can start at sourcex.si/apply once the sponsor is identified. Advisors who work with owners can register as a partner and make the introduction.