Back to Module
5 of 14|Obligations of Data Fiduciary
video 20 min•Security Safeguards
Access Control
The principle of least privilege.
🎯 Learning Objectives
- ▸ Understand the principle of least privilege
- ▸ Implement access control matrices
Least Privilege
If a marketing intern can access the HR database containing salaries, your access controls are broken. The Principle of Least Privilege (PoLP) states that a user should be given the minimum levels of access necessary to perform their job functions.
Lack of access control is a major reason for insider threats. A disgruntled employee with broad access can steal or destroy data.
📖 Glossary
- Principle of Least Privilege
- A security concept in which a user is given the minimum levels of access necessary to perform their job functions.
🔑 Key Takeaways
- No one should have "super admin" access by default.
- Regularly revoke access when employees leave or change roles.
- Segregate sensitive data from general data.
📚 Further Reading
- DPDPA Section 8(5) — Government of India (2023)
Course Author
Shilpi Kulshrestha
Shilpi is a corporate lawyer with over a decade of experience in data protection, company law, and regulatory compliance. She has advised 50+ startups and enterprises on DPDPA readiness, privacy gover...