Segregation of Duties in IT

I remember the Sarbanes Oxley (SOX) compliance rush for 10 years ago with the Segregation of Duties. I am looking for the equivalent regulation in GDPR. I find article 25 "Data protection by design and by default" and recital 78 which touches on developers roles, but I cannot really find the part that denies a developer access to live data. Is it clearly stated somewhere? May I have misunderstood something?

Why would you not want to have the development <-> production separation?

If you are a consulting company running many small client systems. Systems including development and production where the clients do not want to have their own IT staff. You would develop the system, deploy it in the cloud and thereafter occasionally administer the live system. Having many systems to develop and administer you can see the potential overhead of separation of duties.

  • 1
    It's entirely possible for a consulting company as you describe to want to have separation between developers and live data without that separation being required by regulations. In other words, the absence of a requirement does not constitute a prohibition. But consider a data processor that is a sole proprietorship with no employees. In that case, it would be impossible to create such separation. It's often better to regulate at a higher level and leave the implementation details to those who are subject to the regulation's requirements.
    – phoog
    Apr 23, 2018 at 19:20


You must log in to answer this question.

Browse other questions tagged .