Zero Trust

Zero Trust replaces the perimeter-security assumption ('inside the network is trusted, outside is not') with a per-request verification model: every access attempt is authenticated, authorised against least-privilege policy, and logged, regardless of whether the request comes from the corporate office, home network or coffee shop. The NIST SP 800-207 Zero Trust Architecture reference defines the policy decision point, policy enforcement point and policy information point as the core architectural components.

For privacy, Zero Trust aligns with GDPR Article 32 and DPDP Section 8(5)'s 'reasonable security safeguards' and PDPA's Protection Obligation in two specific ways. First, access to personal data is purpose-scoped and continuously verified, which is a stronger foundation for the accountability principle than static VPN-gated access. Second, the per-request audit trail makes DSR fulfilment, breach-scoping and insider-threat detection materially easier — you know who accessed what, when, and from where. Mature Zero Trust implementations are typically layered on identity (SSO + MFA + device posture) and segmentation (microsegmentation of workloads) rather than any single product.