Security principles for protecting the most sensitive personal information in datasets

Data access logging

Data access logging helps to identify who or what has accessed personal data and determines if there has been inappropriate access.

You might do one or more of the following:

• Implement data access logging for all personal data so that there is a persistent record of actual and attempted access to personal data.

• Monitor or audit the logs to find out who or what has been accessing any SPI, and whether it is appropriate.  This will also detect if there are inappropriate or unscheduled attempts to access sensitive data by other system components.

• Prioritise your access logging alerts to the higher risk sensitive data to help it respond to the higher impact incidents. This is particularly useful for systems which hold and process large amounts of personal data generating large volumes of data access logs.

Controlling access to the data access logs

Data contained in access logs can contain information valuable to an attacker.  In the case of data about SPI access attempts, data logs could readily contain SPI or highlight records which contain SPI.

When designing the logging system, you should also follow the principles in this guidance, paying particular attention to the following:

• only log the data which are necessary
• control access to logs so that only authorised persons can access them
• ensure access logging is performed across all personal data, but SPI related logging records can only be accessed by those with specific permissions to do so
• ensure any alerting criteria for SPI access violations are not accessible to those without specific authorisation