How to Minimise Staff Access to Personal Data: Designing a Least-Privilege Model
3rd June 2026
In October 2025, the ICO fined Capita £14 million for failings that began with a single employee unintentionally downloading a malicious file. The reason that single click became a breach affecting 6.6 million people? The attacker was able to escalate privileges, move sideways across Capita’s networks and access data they should never have been near. The ICO’s enforcement notice was unusually direct: there was no proper tiered administration, no privileged access management, and no enforcement of the ‘least privilege’ principle.
For most SMEs, that kind of incident feels like a problem of scale. It isn’t. The same principle, that staff should only have access to the personal data they genuinely need, applies whether you have 6 employees or 60,000.
What ‘least privilege’ means
Put simply: every member of staff should only have access to the personal data they need to do their job, and no more. Read access where they need to read. Edit access where they need to edit. Admin access only when there is a clear, documented reason.
Article 5(1)(f) (integrity and confidentiality) and Article 32 (security of processing) of the UK GDPR require ‘appropriate technical and organisational measures’ to keep personal data safe. The ICO has been clear, both in its guidance and in the Capita decision, that least privilege is one of those measures. It isn’t optional, and it isn’t just for large organisations.
Mapping who needs access to what
The starting point is knowing what data you hold, where it lives, and who currently touches it. If you’ve already built a Record of Processing Activities (RoPA), much of this work is done. For each personal data set, ask three questions: who needs to read it, who needs to edit it, and who needs administrative control over the system holding it?
Be specific. ‘The HR team’ is not a useful answer. ‘The HR officer needs full access to staff records; the HR administrator needs read access only; the receptionist needs name and contact number to take phone calls’ is. Defining access by departmental roles is the best solution here.
A small charity illustrates this well. Imagine 20 employees with an HR officer, a finance officer, three programme managers, a receptionist, and some volunteers. The HR officer needs full access to staff records. The finance officer needs payroll details but not safeguarding notes. The programme managers need details of the people they support, but not other teams’ clients. The receptionist needs names and extension numbers. Volunteers should not have system access at all unless it is essential.
Designing the model
For most SMEs, role-based access control (RBAC) is the simplest approach: define roles, define what each role can access, and assign people to roles. A few principles consistently hold up:
- Default to no access. Permissions should be granted, not assumed.
- Separate user and admin accounts. Even your IT lead should have an everyday account and a separate, named admin account used only when needed.
- Use ‘just-in-time’ elevation for sensitive actions. Grant temporary admin rights for a specific task, then revoke them.
- Treat shared logins as a red flag. They make accountability impossible.
Practical steps for SMEs
- Audit current access. Pull permission reports from your main systems (Microsoft 365, HR platform, CRM, finance software). The results are often eye-opening.They will also probably identify employees who have moved job roles and should no longer have access, and worse case scenario identify ex-employers whose access is still valid.
- Build a role-and-data matrix. A simple spreadsheet listing roles down one axis and data sets across the other.
- Tighten permissions to match. Remove anything that doesn’t need to be there.
- Embed it in joiners, movers and leavers. Access changes the day someone’s role changes, and ends the day they leave.
- Review quarterly. Access reviews catch the drift that always creeps in.
- Train managers. They are the gatekeepers and need to challenge unnecessary requests.
- Automatic suspension. If an account has not been accessed in a set number of weeks temporarily disable the access.
These controls won’t prevent every breach, but they dramatically reduce the damage when one happens. If a breach does occur despite your best efforts, our guide on what makes a data breach reportable explains what to do next.
How Griffin House Consultancy Can Help
Designing a least-privilege model from scratch can feel daunting, especially if your current setup has grown organically over years. The good news: it’s easier than it looks once you know where to start. We help organisations audit their access controls, build practical role matrices, draft access control policies, and train managers and IT teams to keep permissions tight as the business grows. Get in touch with us at Griffin House Consultancy, or call us on 01673 885533, and we’ll be happy to help you take stock.
Author: Mike Martin LLM
Mike is an information rights law specialist and one of the founding Directors of the Griffin House Consultancy, a leading specialist data protection and information governance consultancy firm that supports hundreds of clients annually with their training, consulting and auditing requirements.
Sources
ICO, Capita fined £14m for data breach affecting over 6m people (15 October 2025)
ICO, A guide to data security under the UK GDPR
