GDPR · Access governance # Protect personal data. Explain who can access it. Access governance helps connect a business need to an approval, a current entitlement and a reviewable record. It supports your GDPR programme; it does not replace it. [Explore access reviews](https://easyiga.com/product/access-reviews) [Understand IGA](https://easyiga.com/blog/what-is-iga) ## The legal requirements behind the controls [Regulation (EU) 2016/679](https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng) has applied since 25 May 2018. Article 5(1)(f) establishes integrity and confidentiality; Article 5(2) makes the controller responsible for demonstrating compliance with the principles. Articles 25 and 32 require appropriate safeguards by design and by default, and security measures appropriate to risk. Article 32(4) addresses processing by people acting under the authority of a controller or processor: they should process personal data only on instructions, unless Union or Member State law requires otherwise. Access controls help implement this responsibility alongside organisational policies and training. GDPR does not mandate a named IGA product or a universal quarterly access-review schedule. A spreadsheet is not automatically unlawful, and a software export is not automatically sufficient. Assess whether the control is appropriate, reliable, complete and demonstrably operated. ## Make the scope explicit Identify the processing activities and systems holding personal data. For each, record the accountable owner, relevant user and service accounts, privileged access and the conditions under which access is needed. Connect this work to records of processing where applicable and to the organisation’s risk assessments. Governance tooling does not discover every copy of personal data or establish a lawful basis for each processing activity. Your organisation still needs data mapping, purpose and retention decisions, controller/processor agreements where applicable, and procedures for data-subject rights. ## Access evidence has limits An entitlement shows what an account was authorised to do. A sign-in shows authentication. Application or data-access logs can show what was actually accessed. Use the right evidence for the question. Do not treat these records as interchangeable. ## Turn policy into an operating process Practical access-governance examples, selected according to the risk to personal data. | Situation | Control | What to check | New access | Require a business need and approval from the responsible owner. | Granted rights match the approved scope and duration. | Role change | Review both new and existing access. | Previous rights are removed where no longer justified. | Departure or contract end | Revoke access and verify the outcome. | Target systems, sessions and exceptions are accounted for. | Periodic review | Provide reviewers with accurate context and a risk-based cadence. | Revocation decisions are executed, not merely recorded. | Governance records | Protect the personal data within requests and audit trails. | Lawful basis, access restrictions and retention are documented. ## Use evidence correctly during a breach Article 33 requires a controller to notify the competent supervisory authority without undue delay and, where feasible, within 72 hours after becoming aware of a personal data breach, unless the breach is unlikely to create a risk to people’s rights and freedoms. A processor must notify the controller without undue delay. Article 34 has a separate high-risk test for communication to affected people, subject to its exceptions. Access records can help establish the systems and data an account could reach. They cannot by themselves prove which records were read, copied or disclosed. Combine governance evidence with incident findings and relevant application logs. Keep the legal assessment and reporting decision with the responsible incident and privacy teams. ## Evaluate easyIGA against a real scope In a pilot, choose a system holding personal data and test requests, approval, removal and a review campaign. Compare the evidence with the target system. A failed action or an unavailable last-use signal should remain visible as a limitation. The default [self-hosted model](https://easyiga.com/deployment) keeps governance data on infrastructure you control. The EU-hosted option, available on request, creates a separate processing relationship that requires assessment. Hosting location alone does not establish GDPR compliance or remove transfer, access and subprocessor questions. See [security](https://easyiga.com/security) and the [website privacy notice](https://easyiga.com/privacy) for their distinct scopes. ## Primary source [EUR-Lex: GDPR, Articles 5, 25, 28, 30, 32 to 35 and 99](https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng). Source review: 12 September 2026.