Access control is the part of security that decides who can see what. It is also where the criminal law meets data protection: an employee who accesses records without a business reason commits the s.170 offence, and the organisation that let them do it has a security failure.
Least privilege
Each person should have the access their role needs, and no more, for as long as they need it. Three tests:
- Role. Is access defined by role, not granted person by person on request?
- Need. Does every role’s access map to a task it actually performs?
- Time. Is temporary access removed when the task ends, and all access when the person moves or leaves?
Controls that work
| Control | Why it matters |
|---|---|
| Role-based access with a named approver | Stops access creep and makes reviews possible |
| Joiner, mover, leaver process tied to HR | Movers are where excess access accumulates |
| Multi-factor authentication | Absent or incomplete MFA was central to the 2022 ransomware attack behind the first UK processorProcessorProcesses personal data on a controller's instructions, such as a cloud host or payroll bureau, with its own security and breach duties. penalty |
| Privileged access management | Admin accounts are the target; separate and monitor them |
| Logging of access to sensitive records | Detects curiosity browsing and enables prosecution |
| Periodic access reviews | Owners confirm who still needs access |
| Break-glass with review | Emergency access that is always looked at afterwards |
Insider misuse
Prosecutions under s.170 are overwhelmingly about insiders: a claims adviser who looked up 1,550 customer records without a business reason, call centre staff who sold accident victims’ details, a sales consultant who took 3,600 records to competitors. In each case the employer’s logs were the evidence. Monitoring access is therefore both a security control and the means of proving misuse.
Tell staff that access is logged and checked. It deters, and it removes any argument that monitoring was unexpected.
Processors and shared accounts
Processors’ staff need access governed by the contract and by Article 29: they act only on instructions. Shared or generic accounts defeat logging and should be eliminated for personal data systems.
Evidence
An access control policy, role definitions, review records and access logs. The regulator asks for review records after a breach; not having them is a finding in itself.