Getting access rights right: who should see which documents?
The basic rule for access rights is need-to-know: everyone sees what they need for their work – and nothing more. For documents containing personal data, the GDPR makes this an obligation, because it requires confidentiality and appropriate safeguards. The opposite direction matters just as much, though: knowledge the whole team needs – instructions, reports, standards – must not vanish behind needless barriers. Good access rights protect what is sensitive and open up what is useful. This article shows how the two fit together; it sets out the main principles and is no substitute for legal advice on an individual case.
In brief
- The GDPR requires confidentiality and measures appropriate to the risk (Art. 5 and 32) – an access policy is the standard way of achieving this.
- Need-to-know means access based on the job, not on rank or convenience.
- Most real incidents happen inside the company: the open salary folder, the job application PDF on the general drive, accounts of former employees that still have rights.
- Roles instead of individual rights: you define rights for each function and assign people to roles – this stays manageable for years.
- In an AI knowledge base, permissions must extend to the answers: the AI may only quote what the person asking is allowed to see.
Why are access rights a GDPR issue?
Article 5 of the GDPR sets out the principle of “integrity and confidentiality”: personal data must be processed in a way that protects it against unauthorised access. Article 32 spells this out as technical and organisational measures appropriate to the risk – and deciding who can access what is central to those measures.
The point that is easily overlooked: your own colleague can be unauthorised too. A data protection breach doesn’t need a hacker. If everyone can read the salary list on the network drive, or job applications end up in the general scan folder, people are accessing data they have no work reason – and therefore no authorisation – to see. Depending on the case, this can become a notifiable data breach – the authority responsible is the Austrian Data Protection Authority (Datenschutzbehörde, dsb.gv.at). And the damage goes beyond the legal side: nothing sours the atmosphere at work more reliably than a salary folder anyone can look at.
What does need-to-know mean in practice?
Need-to-know means that access is determined by the job – not by curiosity, rank or what is convenient for IT. Two examples make the principle tangible:
- Every technician should be able to find the maintenance instructions for the vehicle lift – quickly, ideally, and that includes the first-year apprentice. They contain no personal data that needs protecting; locking them away only does harm.
- An employee’s payslip is a matter for payroll and management only. It contains salary data and, through payroll, even special category data.
So need-to-know has two sides, and everyday practice gets both wrong: systems that are too open expose personal data; systems that are too closed hide the experience the company depends on. The skill lies in drawing the line – and it runs between types of document, not between departments’ egos.
Who needs access to what? Examples from everyday work
| Document type | Access makes sense for | No access needed for |
|---|---|---|
| Maintenance and operating instructions, service reports | All technicians, often the whole company | – (keep as open as possible) |
| Quotation and costing templates | Sales, management | Workshop, warehouse |
| Customer contracts | Management, responsible account managers | Rest of the workforce |
| Payslips, salary data, sick leave | Payroll, management | Everyone else – without exception |
| Job applications | Management, hiring manager | Everyone else |
| Recipes/formulations, design data | Production or development | Areas not involved |
The table is deliberately broad-brush – it shows the pattern: knowledge open to many, personal data to few, trade secrets only to those who need them.
How do you set up a role-based access plan in five steps?
- Identify the document types: Not every file individually, but categories – instructions, contracts, personnel documents, cost calculations, project folders. One hour with the heads of department is enough for a first overview.
- Define roles – by function, not by person: Technical, sales, accounts/payroll, management, apprentices, external parties. In an SME, five to eight roles are almost always enough.
- Set the principle: Company knowledge as open as possible, personal data and secrets as restricted as necessary. Put this sentence in writing in the plan, so that future decisions have a yardstick.
- Set rules for special cases: Cover arrangements (who steps in during holidays?), external parties (tax adviser, IT service provider – for a limited period), changes of role within the company (remove old rights, don’t just add new ones).
- Tidy up regularly: Check twice a year: are the assignments still correct? Have the rights of people who have left been deactivated? Leftover rights are the most common gap in the plan – and the least noticeable.
Documentation matters: a short, up-to-date access policy is worth its weight in gold when it counts – for example if the data protection authority makes an enquiry – and it is one of the records the Austrian Federal Economic Chamber (WKO, wko.at) also recommends in its data protection guides for businesses.
What are the most common access rights mistakes?
The drive where everything is open. It grew over time and nobody ever questioned it: a network drive where everyone has been able to read everything for fifteen years – including the “Personnel” and “Salaries” folders. If you are restructuring, that is the best place to start.
Rights granted but never removed. The former apprentice now works in sales but still has the rights from three previous roles. And when someone leaves, the account is deactivated – but individual folder shares often live on for years.
The boss-gets-everything syndrome. Understandable, but risky: an account with full access to everything is the most attractive target for attackers and does the most damage on its own if its password is stolen.
Copies get round every policy. The best-protected document is of little use if it is forwarded as an email attachment or downloaded to a private device. Access policies therefore also need simple rules on sharing and exporting.
How does an AI knowledge base change access rights?
AI search makes documents radically easier to find – that is the whole point. Which is precisely why the access policy has to extend to the answers: if an employee asks “How much does our workshop manager earn?”, the system must neither show the payslip nor summarise its content in an answer – even if the document is somewhere in the indexed collection. The rule is: to answer a question, the AI may only use sources the person asking would also be allowed to open directly.
So when choosing a system, make sure the AI knowledge base enforces roles and access rights and backs up every answer with the source document – so you can always see where a statement comes from and check it. Used properly, the knowledge base becomes the place where both apply: every technician finds the maintenance knowledge quickly, and the personnel documents stay where they belong. Access rights are one of several building blocks for using AI in line with the GDPR – the article AI and the GDPR in Austria gives the full picture, including a checklist for choosing a provider.
As a next step, take the five-step list and draw up a first version of your role-based access plan – an afternoon is enough to get started, and every future system (AI included) builds on it. You can see how a knowledge base with role-based access is introduced under how the introduction works.
Frequently asked questions
What does the need-to-know principle mean?
Each employee gets access to the data and documents they need for their job – and nothing more. The technician needs the maintenance instructions but not the salary list; payroll needs the salary list but not the design data.
Does the GDPR require an access policy?
Not in so many words – but it does require confidentiality and technical and organisational measures appropriate to the risk (Art. 5 and 32 GDPR). For documents containing personal data, a documented set of roles is the recognised standard way of meeting this obligation.
Are overly broad access rights a data breach?
They can become one: if unauthorised people actually access personal data – even within the company – this may be a notifiable personal data breach. The salary folder on the network drive that anyone can open is a classic example.
What is the difference between roles and individual rights?
Individual rights are granted person by person and multiply out of control over the years. Roles group rights by function – for example technical, sales, payroll, management – and people are assigned to roles. This stays easy to follow, even as people join and leave.
How do access rights work in an AI knowledge base?
The permissions have to extend into the AI search itself: to answer a question, the system may only use documents the person asking would also be allowed to see. Otherwise the AI blurts out content that folder permissions were supposed to protect.
For your company
To see what this looks like in practice, visit the page for your industry – with the questions people there ask and the documents the answers come from.