Controlling who can access your company computers, systems, and network is a critical part of safeguarding your data. Implementing hierarchical access controls ensures that only authorised personnel can view or edit sensitive information, reducing the risk of accidental leaks or malicious activity.
Why Access Control Matters
Every business, whether a sole trader or a large corporation, stores significant amounts of data.
This can include:
HR records and employee files
Financial and accounting information
Client records and contact details
Supplier and partner information
Not all staff should have access to all types of data. Access should be granted strictly on a “need-to-know” basis. For example, payroll data should be available to HR and finance staff, but not to general employees.
Determining Access Levels
To protect your organisation’s data, different datasets should be identified and classified (see our Data Classification page). Once classified, you can set access rules using a variety of methods, such as:
Hardware-based access control: e.g., restricting certain data to specific computers or devices
Role-based access control (RBAC): granting permissions according to job role or position in the company
User account permissions: using software or operating system settings to restrict files and folders
Network segmentation: isolating sensitive data on separate parts of the network
Subject Access Requests (SARs) and Data Rights
It’s important to remember that any individual or organisation whose data you hold has the legal right to access it. This is known as a Data Access Request (DAR) or Subject Access Request (SAR).
A SAR is a formal request for copies of all personal data your company holds on that person or organisation. Under data protection laws such as GDPR, you must respond within a set timeframe, typically one month, and provide the information in a clear, accessible format.
While this page focuses mainly on staff access control, don’t forget that clients, suppliers, and other third parties may also exercise their right to see what information you store about them.