Access restriction

Access restriction means that only authorised individuals are permitted to access personal data or other sensitive information.

Glossary
Access restriction

Explained – what does access restriction mean?

Access restriction is a security measure ensuring that only those who need the data for their role may access it. A GDPR lawyer can assess how access restriction should be designed to meet the requirements in Article 32 of the GDPR. Access restriction is closely linked to both technical security measures—for example, passwords and two factor authentication—and organisational security measures, such as authorisation routines and internal policies.

When does the question of access restriction arise?

The question arises in every organisation that handles personal data or other sensitive information. It is particularly important when data are stored in IT systems, shared across departments or transferred between partners. Access restriction is used to ensure that only those with a legitimate need can view and handle the information, supported where appropriate by access control services.

Illustration of access restriction and approval, showing a staff member handing over an authorised document with a checkmark.

Access restriction and access control services – what to consider

When implementing access restriction, organisations should take account of several important factors. Below are some central points.

Adopt the need to know principle: only those who require the data for their work should have access (need to know access reflects the principle of least privilege).
Implement technical solutions such as strong authentication, two factor authentication implementation and role based access control.
Establish routines to review and update authorisations regularly, including access recertification.
Train staff on why access restriction is necessary and how it is applied, and ensure user activity logging is in place.
Maintain access control documentation for all authorisation decisions to meet the accountability requirement under the GDPR and to support authorization management.
Ensure that access restriction covers both internal systems and external collaborations, leveraging access control services where proportionate.

By working systematically with access restriction, the organisation can prevent unauthorized access and ensure proper application of data protection rules.

Access restriction

Why is access restriction important?

Access restriction is one of the most fundamental security measures under the GDPR. It protects personal data from disclosure to unauthorised parties and makes it easier to govern how data are handled within the organisation.

By combining access restriction with other safeguards—such as encryption and pseudonymisation—organisations can build comprehensive data protection. This strengthens trust among customers, employees and authorities and reduces the risk of personal data breaches.

Well-executed access restriction is not only a legal obligation but also a precondition for effective information management and long-term security.

It means that access to personal data is governed through authorisation levels, role based access control and technical controls such as passwords and strong authentication, supported by access control services.

Access restriction should be in place in every organisation that processes personal data. It is particularly important when handling sensitive data or large datasets.

There are several common technical methods.

Strong authentication, for example two factor authentication.
Role based access control in systems.
User activity logging of access and actions.

Organisational measures ensure that access restriction works in practice, for example through routines to grant, change and revoke access, periodic access recertification and clear authorization management.

Encryption protects data technically so they cannot be read without a key, whereas access restriction regulates who may attempt to access the data at all. Together they provide stronger protection.

The controller is ultimately responsible, while the IT function and business managers must ensure that authorisations are managed and followed up correctly, with appropriate access control documentation to demonstrate compliance and prevent unauthorized access.