Security principles for protecting the most sensitive personal information in datasets
How to identify and protect against the risks associated with sensitive personal information in your data holdings.
Pages
Page 5 of 10
Principle 4. Make sure access to sensitive data cannot be misused
You should ensure that sensitive data can only be used for the authorised purposes and that there are suitable methods to enforce this.
Considerations for technical implementation
Personal data might be of interest to authorised system users for reasons beyond their agreed business purposes. An authorised user might seek access to personal data out of general interest or prejudice, or on behalf of someone else who does not have such access.
It is important to protect SPI from inappropriate use by legitimate system users. Potential ways you can do this includes:
restricting access to SPI data to within normal working hours
not permitting access to sensitive data by lone operators
