I'm a programmer who works closely with an engineering firm to create tools for the automation of business processes.

One of which I'm working on currently requires that have the access (although I will actively avoid accessing,) of some of my fellow co-workers sensitive data, like billable hours, billable rate, among other information, through an API.

I want to make sure that I take proper measures to ensure that I am in good legal standing before obtaining access to such information. What measures should I take to make sure that I have legal access to such data?

  • 1
    Usually an NDA covers you with privacy concerns, but can get more complicated if you have access to more sensitive data like social security numbers, personal health information, etc. What jurisdiction are you asking about? Are you asking about "making sure you have legal access" or are you asking about what you should do to protect yourself if you have access? Getting legal access may be as simple as the customer giving you the API details, protecting yourself is a bit different.
    – Ron Beyer
    Apr 2 '19 at 13:35
  • Don't intend to commit identity theft will put you on a good start.
    – A. K.
    Apr 2 '19 at 15:10

If you have a legitimate need for access to the API and its underlying data, and have been duly authorized by the appropriate person, and do not abuse the access by examining data beyond your legitimate need, keeping copies of the data, bypassing or compromising security in any way, or sharing with anyone else any information you learn through your access, you should be OK. Your employer or client may want you to sign a confidentially agreement or an NDA, promising that you will follow proper procedures and not improperly disclose info. You should sign if asked to.

Often it is possible to create a test database with "John Doe", "Jane Roe" and similar fake names and corresponding fake data for use in development and testing. This is a good practice, but is not always feasible.

  • Thank you for your advice: just wanted to ensure I'm not crossing any legal boundaries. If my employer would like to establish an NDA I'll sign it, and that will be the extent of it. Apr 2 '19 at 22:22

I respect that you want to keep the information private and secure, but as the comment said, really all you have to do is not abuse it.

While writing the program, only look at the personal information that you have to and don't tell anyone what you saw.

It's simple, honestly.

  • Thanks! Just wanted to make sure I wasn't trespassing. Apr 2 '19 at 22:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.