Access Control

Access control is the operational core of the security-safeguards duty every privacy regime imposes (GDPR Article 32, DPDP Section 8(5), PDPA Protection Obligation). It covers authentication (confirming identity), authorisation (deciding what that identity may do), separation of duties (preventing one actor from completing a sensitive end-to-end action), least-privilege provisioning, and periodic access review. The technical layer typically combines SSO, MFA, role-based or attribute-based access control, just-in-time access elevation and privileged access management.

For personal data specifically, access control must map to purpose. A user granted access to a customer record for support should not be able to export the same record for marketing. This is enforced through purpose-scoped roles rather than coarse 'who can view X' permissions. The access log is itself personal data about the viewer, and must be retained (DPDP Rule 8(3) sets a one-year minimum) so that in a breach or an audit the Fiduciary can show who accessed what and when.