Data Access Governance

Data Access Governance (DAG) is a narrower slice of cloud data governance focused on the access control decision itself: who is allowed to read, modify, export or delete each category of personal data; the lawful purpose for that access; and the review cadence that keeps the grant current. GDPR Articles 5(1)(f) and 32, DPDP Section 8(5) and the PDPA Protection Obligation all turn on being able to show that access to personal data is restricted to those who need it.

In practice, DAG combines role / attribute-based access control, access certification campaigns (periodic reviews that confirm whether each grant is still needed), joiner-mover-leaver workflows that automatically reconcile access when roles change, and continuous audit of effective access. It is distinguished from Identity Access Management by its data-centric framing — DAG asks 'who touches this customer record', IAM asks 'what systems can this user log in to'. Mature programmes feed DAG metadata back into the Record of Processing Activities so the RoPA shows actual access, not aspirational policy.