Access Controls

Legal Framework

Access controls sit at the intersection of data protection and cybersecurity law. Under the GDPR, Article 32 requires controllers and processors to implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk — a provision that directly encompasses access management, authentication, and authorisation protocols. NIS2 reinforces this for essential and important entities by mandating a baseline of cybersecurity measures. Article 21(2)(a) NIS2 requires:

"policies on risk analysis and information system security;"
— NIS2 Art. 21(2)(a)

The same article extends to supply chain security, vulnerability handling, and policies to assess the effectiveness of cybersecurity measures — all of which implicate how access is provisioned, monitored, and revoked across interconnected systems. The AI Act definitions further distinguish between providers and deployers, allocating responsibility for AI-system access depending on who controls the system's operation.

Key Developments

Dutch courts have grappled with access controls in the context of data subject access requests, where the question is whether searches were conducted by personnel with sufficient authorisation. In a police case, the court recorded that:

"een politiemedewerker met een hoge autorisatie-bevoegdheid de zoekslag heeft verricht"
— Rechtbank ¶18

The AIVD court similarly upheld a search where it found no reason to doubt the authorisation level of the employee who performed it (Rechtbank ¶6.3). These rulings establish that access rights must be demonstrable and proportionate to the task — courts will scrutinise whether the person executing a search held the appropriate clearance.

The UMCG patient-dossier litigation reveals a sharper conflict: a father sought access via a specially created administrator account, accompanied by counsel and a party expert, with the hospital barred from restricting the expert's access rights. The dispute centred on whether the hospital could control the terms of access even when the underlying right to access was undisputed (Rechtbank ¶4.3.1). The court also addressed a wrongly configured setting that caused a document to be withheld — a direct access-control failure (Rechtbank ¶4.7.8).

Enforcement actions confirm the financial stakes. The CNIL sanctioned two companies after attackers exploited weak authentication, finding that:

"the two companies had breached their obligation to maintain the security of customers' personal data under Article 32 of the GDR"
— CNIL §2

The Dutch DPA fined Transavia €400,000 after a hacker penetrated systems through two IT-department accounts — a failure of privileged-access management that exposed data on 25 million passengers (AP §1).

Status of the Debate

This topic is actively contested. Courts have not split on a single doctrinal question, but they diverge on how granular access controls must be when balancing data-subject rights against institutional security constraints. The UMCG litigation illustrates the tension: courts recognise the right of access but have not settled how far a controller must go in reconfiguring access mechanisms to accommodate a requester's chosen representative. Enforcement authorities, meanwhile, are setting de facto thresholds through fines — privileging speed of response and privileged-account protection as measurable compliance benchmarks. What would resolve the open questions is clearer judicial guidance on whether access-control configurations must be adapted case-by-case for data-subject requests, or whether standardised role-based access suffices.

Practical Guidance

• Implement role-based access with documented authorisation levels. Both the police and AIVD cases show courts expect evidence that the person performing a search held appropriate clearance. Maintain logs mapping each role to its authorisation scope.
• Lock down privileged and shared IT accounts. Transavia's fine stemmed from compromise of two IT-department accounts. Apply multi-factor authentication, credential rotation, and continuous monitoring to all administrative accounts.
• Act swiftly on repeated authentication attacks. The CNIL penalised companies that prioritised detection tools over timely remediation. Incident response must include immediate access revocation and credential resets.
• Configure access settings to prevent inadvertent withholding. The UMCG case shows that a misconfigured setting caused a document to be excluded from disclosure. Audit access-control configurations regularly to ensure they align with disclosure obligations.
• Prepare to justify access-control choices in litigation. Courts will examine whether the chosen access mechanism was proportionate. Document the rationale for role assignments, search methodologies, and any temporary access elevations.