DP004Access control and least privilege

The entitlements each person actually holds, held to what their task requires and no wider. The measure is the state of the entitlements, not the policy that describes the state they ought to be in.

Pillar: DP | Data and asset protection
Sources cited: 17
Added: 30 AUGUST 2026
Updated: 5 OCTOBER 2026

Control	Jurisdiction	Source	What it establishes	Prerequisite or recommendation
DP004/EUMandatory	European Union	Directive (EU) 2022/2555, article 21European Parliament and Council · read 29 Aug 2026Commission Implementing Regulation (EU) 2024/2690European Commission · read 29 Aug 2026	That asset management, access control policies, human resources security, cryptography, and training are among the measures an entity in scope has to take, without saying what any of them holds.	Access control policies are named among the measures an entity in scope has to take, and for one class of entity the implementing rules say what they hold: rights assigned and revoked on need to know, least privilege, and separation of duties, modified on termination or change of employment, authorized by the relevant persons, limited in scope and duration for suppliers and visitors, held in a register, and logged.
DP004/HRMandatory	Croatia	Zakon o kibernetičkoj sigurnosti, članci 4, 29, 30, 37, and 38Hrvatski sabor · read 5 Oct 2026Uredba o kibernetičkoj sigurnostiVlada Republike Hrvatske · read 5 Oct 2026	For key and important entities, that the members of the management bodies answer for the risk management measures, approve them, control their implementation, and follow and offer employees suitable training; that the measures include human resources security, access control policies and management of software and hardware assets with a regularly updated inventory, incident handling with monitoring, recording, and reporting, cyber hygiene and training, and multi-factor or continuous authentication; that a significant incident is notified to the competent CSIRT and, where there are grounds to suspect a criminal offence, to the law enforcement bodies; and that the measures and their implementation are set by the Government’s regulation.	For key and important entities, the measures include access control policies and multi-factor or continuous authentication where needed. For key and important entities, an owner is defined for each application and each role, the owner approves the assignment of rights, and a record is kept of who approved the assignment, with rights assigned, changed, revoked, and documented under the access control policy.
DP004/GRMandatory	Greece	Νόμος 5160/2024, άρθρα 8, 14, 15, and 16Βουλή των Ελλήνων · read 5 Oct 2026Οδηγός για τη Συμμόρφωση των Επιχειρήσεων με τον Ν. 5160/2024 και την Οδηγία NIS2ΣΕΒ (Hellenic Federation of Enterprises), with material from the Εθνική Αρχή Κυβερνοασφάλειας · read 5 Oct 2026	For essential and important entities, that the Εθνική Αρχή Κυβερνοασφάλειας is the competent authority and single point of contact, that the management bodies approve the risk management measures within three months of the Act’s entry into force, supervise their implementation, and are responsible for breaches, that their members follow training and the entity gives employees similar training at least annually, that the measures include incident handling, cyber hygiene and training, human resources security, access control policies, and asset management, and multi-factor or continuous authentication, that the entity designates a Υπεύθυνος Ασφάλειας Συστημάτων Πληροφορικής και Επικοινωνιών (Υ.Α.Σ.Π.Ε.) whose duties are incompatible with the Data Protection Officer’s, keeps a single cybersecurity policy and an inventory of assets ranked by criticality, and that a significant incident is reported in an early warning within 24 hours, a notification within 72 hours, and a final report within one month.	For essential and important entities, the measures include access control policies and the use of multi-factor or continuous authentication where appropriate. Access is granted on a role with least privilege, the user reaches only the systems and data needed, and access is reviewed; the policies reach internal and external personnel over the whole access lifecycle.
DP004/HUMandatory	Hungary	2012. évi I. törvény a munka törvénykönyvéről, 9. §, 10. §, 11. §, and 11/A. §Országgyűlés · read 5 Oct 2026	That an employee’s personality right may be restricted only where strictly necessary for a reason directly connected with the purpose of the employment and proportionate, with prior written information on the manner, conditions, expected duration, and the circumstances supporting necessity and proportionality; that the employee may be checked in the conduct connected with the employment, by technical means too, after prior written information; that a device provided for work is used only for the employment unless agreed otherwise and the employer may inspect the employment-related data stored on it; that biometric data serve identification only against grave unauthorized access; and that criminal record data may be processed to check a restriction or exclusion the employer has set out in writing beforehand.	Biometric data of an employee may be processed for identification only where needed to prevent an unauthorized access to a thing or data that would risk grave or mass, irreversible harm to life, health, or a significant interest protected by law, the list naming classified data, firearms, dangerous substances, nuclear material, and property of especially large value.
DP004/ITMandatory	Italy	Determinazione ACN n. 379907 del 18 dicembre 2025Agenzia per la cybersicurezza nazionale · read 29 Aug 2026	The baseline security measures an Italian NIS subject has to adopt, among them the recording of remote and administrative access and its central retention, the detection of privilege abuse, and the vetting of the people admitted to the systems that matter.	For a subject in the national NIS register, permissions are assigned on least privilege, separation of functions, and need to know. How an account authenticates is set against the risk, weighed on the privileges it holds, the criticality of the systems, and the kind of operations it can perform on them, and multi-factor authentication is used on the systems that matter.
DP004/LUMandatory	Luxembourg	Délibération n° 11FR/2021Commission nationale pour la protection des données, formation restreinte · read 5 Oct 2026	That location data kept two years and four months for geographic tracking, protection of goods, and working time of travelling employees exceeded what the purposes needed, that a retention set per purpose is owed, two months for location, one year for billing evidence, three years for working time, that the employees were not informed as article 13 requires, and that access to the geolocation software through shared accounts breached article 32, individual accounts being owed only to those for whom access is strictly necessary to their tasks.	Access to the geolocation software is by individual accounts, identifier and password, created only for the persons for whom access is strictly necessary to their tasks; shared accounts breached article 32.
DP004/PTMandatory	Portugal	Regulamento n.º 756/2026, Regulamento do Regime Jurídico da CibersegurançaCentro Nacional de Cibersegurança · read 5 Oct 2026Deliberação n.º 1638/2013, Princípios aplicáveis aos tratamentos de dados pessoais decorrentes do controlo da utilização para fins privados das tecnologias de informação e comunicação no contexto laboralComissão Nacional de Proteção de Dados · read 5 Oct 2026	For entities in scope, that HR processes, selection, hiring, position categorization, and termination, are assessed against the entity’s cybersecurity requirements, that identities and credentials are issued, managed, verified, revoked, and audited, that access follows need to know and least privilege, that privileged passwords sit in a password manager and remote and privileged access carries multi-factor authentication, that logs are collected, stored, protected, and reviewed regularly, their retention set by risk and proportionality, failures in log processing raising alerts and critical systems’ logs stored on an autonomous system, that internal and external threats, intentional or accidental, are identified, that all staff receive awareness and training under a measured plan which includes awareness of internal threats, and that a significant incident is notified through the CNCS platform in an initial notification, an end-of-impact notification, and a final or interim report.	For entities in scope, access and permissions are granted on need to know and least privilege under an access and permissions policy, and identities and credentials are issued, managed, verified, revoked, and audited. Commercial, industrial, and intellectual property secrecy is protected upstream by strict access control to the confidential information, and not by reading email.
DP004/ROMandatory	Romania	Ordonanța de urgență nr. 155/2024, articolele 11 la 15Guvernul României · read 5 Oct 2026	For essential and important entities, that the measures include the logging and traceability of all activities in the networks and information systems, human resources security, access control policies and asset management, and incident handling; that the management bodies approve the measures, supervise them, and answer for breaches, follow accredited training and ensure training of all personnel; that an annual self-assessment of maturity goes to the DNSC; and that a significant incident is notified in an early warning within 24 hours, a notification within 72 hours, and a final report within one month.	For essential and important entities, the measures include access control policies and asset management.
DP004/ESMandatory	Spain	Real Decreto 311/2022, Esquema Nacional de SeguridadGobierno de España · read 29 Aug 2026	The security measures a Spanish public sector body has to apply, graded by category, among them the concurrence of two people on critical tasks so that no single authorized individual can abuse their rights, an access control on the activity records themselves, and the recording of evidence where an incident may end in disciplinary action.	The access control system is organized so that two or more people have to concur on a critical task, and the decree says what that is for: to cancel the possibility that a single authorized individual could abuse their rights to commit an unlawful or unauthorized act. All access is forbidden save on express authorization, privileges are cut to the minimum needed to do the work, and only staff with the competence to do so may grant, alter, or annul an authorization.
DP004/SEMandatory	Sweden	Cybersäkerhetslag (2025:1506)Riksdag · read 5 Oct 2026MSBFS 2020:7, föreskrifter om säkerhetsåtgärder i informationssystem för statliga myndigheterMyndigheten för samhällsskydd och beredskap · read 5 Oct 2026	That operators in scope take appropriate and proportionate technical, operational, and organizational measures that include access control and asset management, personnel security, cryptography, and cyber hygiene and training, that the persons in an operator’s management undergo training on security measures, that a significant incident is notified within 24 hours of knowledge and reported within 72 hours with a final report within one month, and that the government designates the supervisory authority or authorities.	For operators in scope, the measures taken include access control and asset management. For state authorities, only authorized users and systems reach the IT environment, and no digital identity holds more access than it needs.
Recommended	Germanywhere written	IT-Grundschutz-Kompendium, Edition 2023Bundesamt für Sicherheit in der Informationstechnik · read 29 Aug 2026	What the German federal authority holds to be the state of the art, in numbered requirements, among them the checking of a candidate’s own account of themselves, a logging infrastructure the administrators who run it cannot alter, a regular audit of the detection systems against the state they are supposed to be in, and how evidence is secured.	An identifier or an entitlement may be granted only on actual need and on what the task requires, and what is no longer needed is removed when the person changes. Anything beyond the standard is granted only after a further justification and a check of it. Every entitlement is set up through separate administrative roles, and the duties the organization has declared incompatible are held apart by the entitlement system itself.
Recommended	Irelandwhere written	Cyber Security Baseline Standards, Revision 1National Cyber Security Centre and Department of the Environment, Climate and Communications · read 5 Oct 2026	For Public Service Bodies, that an access control policy on least privilege is defined and communicated, that a joiner, mover, leaver policy revokes access no longer required, that user permissions are reviewed monthly and on role change and privileged accounts on a defined schedule, that logging is enabled with a monitoring capability able to tie a user to suspicious activity, and that awareness training is mandatory for all staff.	For Public Service Bodies, an access control policy on least privilege is defined, approved by management, published, and communicated to employees and external parties, and it separates the request of access from its authorization.