Access Control: Who Can See Customer, Payroll and Bank Data?
A least-privilege access framework using roles, approvals, privileged access, logs, periodic review and emergency control.
Most access failures are employees, vendors or administrators retaining more access than their current job requires.
The DPDP framework is phased. The 14 November 2025 commencement notification brought specified institutional and enabling provisions into force immediately; section 6(9), section 27(1)(d) and rule 4 follow after one year; most operating duties and rules follow eighteen months after Gazette publication. As of 22 June 2026, readiness should distinguish current law from future-state DPDP controls.
Rule 6’s future minimum safeguards include access control, logs, monitoring, investigation and remediation.
Access should be purpose-based, with stronger controls for payroll, bank, health, identity and production data.
Privileged access should be time-bound, monitored and separate from normal use.
What the organisation should understand
- The DPDP framework is phased. The 14 November 2025 commencement notification brought specified institutional and enabling provisions into force immediately; section 6(9), section 27(1)(d) and rule 4 follow after one year; most operating duties and rules follow eighteen months after Gazette publication. As of 22 June 2026, readiness should distinguish current law from future-state DPDP controls.
- Rule 6’s future minimum safeguards include access control, logs, monitoring, investigation and remediation.
- Access should be purpose-based, with stronger controls for payroll, bank, health, identity and production data.
- Privileged access should be time-bound, monitored and separate from normal use.
- Joiner, mover and leaver events should update access across cloud, drives, databases and vendor portals.
The five-point review
| Check | What to examine |
|---|---|
| Role | Job requirement and purpose. |
| Privilege | Read, edit, export, approve or administer. |
| Approval | Data and system owner. |
| Monitoring | Logs and alerts. |
| Lifecycle | Joiner, transfer, leave and emergency. |
Practical example
A finance analyst moves to sales but retains payroll export and bank-payment access because only the email group changed. The role-transfer checklist should remove old privileges first.
How to apply the framework
Create a role-to-data matrix and prohibit access based only on seniority.
Review high-risk access quarterly and after incidents, including exports and unusual access.
Operating workflow
Define the processing or incident precisely
Identify the people, data, system, purpose, owner, vendor and transaction or event. Review role, privilege and approval together. Do not start from a policy template or software feature; start from what the business and system actually do.
Separate current duties from future-state DPDP readiness
Apply the 14 November 2025 commencement notification provision by provision. Continue complying with currently operative IT, CERT-In, telecom, banking, insurance, employment, consumer, contract and criminal-law requirements. Build the future DPDP process now, but do not describe a scheduled rule as already legally operative.
Preserve proof and improve the system
Keep the approved decision, notice or workflow version, access or event logs, vendor evidence, user communications and remediation record. Update product design, role access, retention, support scripts or incident playbooks so the same weakness does not recur.
Implementation checkpoint
Before closing the review, assign a named owner, a completion date and a live-system test that proves the control works. A policy statement is not enough when the product, vendor, support team, payment process or access configuration behaves differently. Preserve the test result, exception approval and remediation ticket so management can distinguish an operating control from an intention that has not yet been implemented.
Action checklist
- Define roles.
- Require owner approval.
- Use MFA and privileged controls.
- Log sensitive access.
- Review periodically.
- Revoke on exit or transfer.
Evidence to keep
- Role matrix
- Approval tickets
- Privileged logs
- Review evidence
- Lifecycle records
Warning signs
- Shared administrator account
- Everyone can export payroll
- Vendor access never expires
- No query logs
- Emergency access permanent
Finin2min takeaway
Privacy governance is an operating system, not a policy PDF. The data map, purpose, access, vendor, retention, user workflow, incident response and evidence file must all tell the same story.