An Organisation has 10,000 employees. All 10,000 employees have unrestricted access to ALL Customer PII data stored by the Organisation. Only 200 employees require access to the PII data for the purpose of their Job.

The 10,000 employee contracts cover an agreement with the Organisation that the Employee will not abuse any PII data.

Does the contract protect the Organisation, removing the need to implement Technical measures to restrict data access to the relevant 200 employees?


Almost surely not

It is difficult to see how this meets the “secure by design” and “accountability” requirements of the directive.

A system that allows unnecessary organisation wide access to PII (particularly unencrypted PII) is prima facie not “secure by design”.

Similarly, if a data breach occurs, say by a disgruntled loading dock employee copying it to a USB key and uploading it at home, where is the “accountability”? Finding a leak among 10,000 people is way harder than among 200.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.