When an enterprise outsources to a third-party data center, who is accountable for the governance...

The enterprise’s data owner retains accountabilityfor the governance of data retention, even when the data is transferred to a third party. Outsourcing does not eliminate governance responsibilities; the data owner must ensure compliance with policies, regulations, and contractual terms, including how long data is retained and under what conditions.

While third parties execute controls,the enterprise remains accountable for the data and its governance outcomes.