You're facing a client's request for sensitive data access. How do you ensure proper justification is met?

Before a user is given access to a sensitive dataset (e.g. patient records, criminal records), you should verify that the individual is who they say they are and that they definitely require access for their job role. Active directories with distinct usernames allow developers to track permissions across various reports and databases, distinct log on credentials (as opposed to log on credentials for an entire team) allow for proper verification of identity. Sometimes full teams or departments may have a log on to an individual system, however it is not good information governance practice to allow this if sensitive data can be accessed.

- Verify the requestor’s identity by checking their credentials, such as username, employee ID, or other relevant identification methods used within your organization. - Ensure that the requestor’s role or position within the organization aligns with the level of data access they are requesting. - Cross-check the requestor’s contact information with internal records to ensure they are a legitimate employee or authorized individual. - Verify that the details provided in the request match known information about the requestor, such as their department, project, or current tasks. - Use internal identity and access management systems to check the requestor’s access history and current permissions.

- Ask the requestor to provide a detailed, written explanation of why the data is needed. - Assess whether the purpose of the request aligns with the requestor’s role, responsibilities, and current projects within the organization. - Verify that the requestor is asking for only the data necessary to achieve their objective - Seek approval from the requestor’s manager or relevant department heads to confirm that the purpose is valid and aligns with departmental objectives. - Evaluate the potential benefits of granting access, such as improved decision-making, operational efficiency, or project success. - Document the purpose of the request and the assessment process for future reference and auditing purposes.

Access to sensitive datasets should only be granted where individuals absolutely need this to perform their role properly. Keep records of access requests and the justification for this, it would be beneficial to track this through an organised method (e.g. an e-form) rather than just receiving access requests by email, as it is likely emails will get missed if the volume of requests is high. Ensure that access requests are checked and approved by your organisation's information governance specialist.

- Request a precise description of the data needed, including data fields, categories, and any specific parameters - Ensure that the data scope is limited to what is required for the specific project, analysis, or task outlined in the request. - Break down the data into relevant subsets and provide only those subsets necessary for the requestor’s needs - Provide clear guidelines on how the data should be handled, processed, and stored. Include instructions for secure data management and disposal. - Ensure that the defined scope of access is reviewed and approved by relevant stakeholders, such as data owners, managers, or compliance officers.

Sensitive data can come in various forms and levels, there can be multiple levels of aggregation before you reach the absolute bottom level of data a dataset is complied from. For example, in a British county, geographic data could be aggregated by town, council ward, then post code, it may only be appropriate for certain individuals to see the bottom level of data for data security reasons. Additionally, in rare instances low numbers in aggregate datasets (e.g. single digit) can lead to the bottom level of data becoming identifiable, so this is something to keep in mind (e.g. patients with a specific condition admitted to a hospital).

Access to specific datasets can be controlled in multiple ways, different methods are appropriate in different circumstances. For example, an active directory can be a great tool to control access of users on an individual level, if someone does not require access to a specific level of data then permission to view is simply not granted. Another benefit of active directories is that the level of permissions can extend to what can be done within the dataset as well as which datasets can be viewed (e.g. read only or permission to edit). Role based access can be a simpler way to control access to datasets, if someone working in a particular team or position requires access to a dataset then this is applied to their role rather than user id.

Data analytics and business intelligence tools are continuously evolving, so information governance and data security policy need to keep up with new tools. For example, Power BI has become increasingly popular in recent years, most organisations will manage access to reports through the integrated active directory, however admins should be careful since Power BI users can have varying levels of permissions in a workspace (e.g. read only, admin) and reports can have varying levels of visibility (e.g. public, permission only). Additionally, when utilising AI tools such as co-pilot, ensure that sensitive data is not included in datasets that may be used to further train AI, as this would likely breach your organisational policy.