Segregation of Duties in IT
I remember the Sarbanes Oxley (SOX) compliance rush for 10 years ago with the Segregation of Duties. I am looking for the equivalent regulation in GDPR. I find article 25 "Data protection by design and by default" and recital 78 which touches on developers roles, but I cannot really find the part that denies a developer access to live data. Is it clearly stated somewhere? May I have misunderstood something?
Why would you not want to have the development <-> production separation?
If you are a consulting company running many small client systems. Systems including development and production where the clients do not want to have their own IT staff. You would develop the system, deploy it in the cloud and thereafter occasionally administer the live system. Having many systems to develop and administer you can see the potential overhead of separation of duties.