Information asset owners are senior or responsible individuals involved in running the relevant organisations or business.

Their role is to understand what personal information is held in their department or area of the organisation, what is changed during it’s normal cycle through the organisation, what is added and what is removed, how information is moved, and who has access and why.

As a result, they should understand and address risks to the information and ensure that information is fully used within the legislation.

IAOs must be able to review and mitigate risks to the confidentiality, integrity and availability of their personal information assets and implement proportionate responses.

The IAOs must be trained on their appointment and are expected to provide written input to the SIRO detailing how they have addressed the risks to that information under their responsibility.