Access Control
Limiting who can see or change personal data and systems.
Access control decides who may see, change or delete personal data and the systems that hold it, and makes sure everyone else is kept out.
Meaning of Access Control
Rule 6 requires appropriate access control to computer resources. Good practice is role-based access, so each person sees only what the job needs, with quick removal of access when roles change.
Access control has two halves. Authentication checks who a user is, through a password, a device or a second factor. Authorisation then decides what that verified user may do: read, edit, export or delete, and in which systems. Strong access control applies both, and keeps them tied to a named person, not a shared login.
Rule 6 of the DPDP Rules 2025 requires appropriate measures to control access to the computer resources used by the Data Fiduciary or by a Data Processor on its behalf. This is part of the reasonable security safeguards duty in Section 8(5) of the Act. Because the Rule covers a processor's systems too, a fiduciary cannot rely on a vendor's open environment and then say its own network was secure.
The best-known model is role-based access control, where permissions attach to a job role such as billing clerk or nurse, and people receive the role they need. Related ideas include least privilege, giving the minimum rights to do the work; need-to-know, which limits access to records that relate to a user's own cases; and separation of duties, so that no single person can both create and approve a sensitive action.
Access control is often confused with encryption, which protects the data itself, and with logging, which records what happened afterwards. They work together: encryption stops a stolen disk being useful, access control stops a staff member opening records unnecessarily, and logs reveal when the controls are bypassed. Insider misuse, such as employees browsing celebrity records, is a leading reason for strict need-to-know rules.
Examples of Access Control
A hospital lets billing staff see invoices but not clinical notes.
A hospital grants billing staff access to invoices but not clinical notes, and lets doctors open only their own patients' files unless an emergency override is used. Every override is logged and reviewed the next day.
An HR system stores salary slips, medical certificates and bank details. When an HR executive moves to the finance department, her access to medical certificates is removed within a day, following the transfer workflow.
A start-up gives all engineers production database access for convenience. After a developer accidentally exports customer data to a personal drive, the founders introduce read-only roles and a break-glass process with approval.
Why Access Control matters
Many breaches begin with excessive or forgotten access: a former employee's account that still works, a contractor with administrator rights, a shared spreadsheet open to anyone with the link. Tight control reduces the number of people and systems that could cause or suffer a breach, which also makes breaches easier to investigate.
A failure here sits within the highest penalty band, up to ₹250 crore for breach of the duty to take reasonable security safeguards. Practically, good access control also supports purpose limitation inside the organisation, because staff see data only for the task they are authorised to do.
How it works in practice
- 1List every system holding personal data, and for each define roles, the permissions each role carries and the business owner who approves access.
- 2Give each person a unique account, remove shared logins, and apply least privilege so that new joiners get a standard role and nothing more.
- 3Run a joiner-mover-leaver process linked to HR, so that access is added on joining, changed on transfer and removed on the last working day.
- 4Review access every quarter for sensitive systems, asking owners to confirm each user, and remove dormant accounts.
- 5Protect privileged and remote access with multi-factor authentication, and monitor administrator activity closely.
- 6Extend the same controls to processors and contractors through contract terms, time-limited accounts and periodic checks.
Where it appears in the DPDP Act and Rules
Common mistakes to avoid
Giving broad access "to avoid delays": convenience becomes exposure, so start narrow and grant more with approval.
Forgetting leavers and contractors: stale accounts are a favourite entry point for attackers.
Sharing admin passwords in a team chat or spreadsheet: a shared login destroys accountability.
Controlling the application but not the database or backup storage, where direct access may bypass the rules.
Compliance tips
Treat access reviews as an auditable record, with dates, reviewers and removals.
Use groups and roles instead of individual permissions to keep things manageable.
Alert on unusual patterns, such as bulk downloads, out-of-hours logins or access to unrelated records.
Common questions about Access Control
What does access control mean under the DPDP Rules?
Rule 6 requires appropriate measures to control access to the computer resources used by a Data Fiduciary or its Data Processor. In practice this means unique accounts, role-based permissions and prompt removal of access.
What is role-based access control?
It is a method where permissions are linked to job roles. A person gets the role needed for the job, so a billing clerk sees invoices and not medical notes, and changes in role change the access.
Is access control the same as authentication?
No. Authentication proves who someone is. Access control, through authorisation, decides what that person may do once verified. Both are needed for secure handling of personal data.