Getting access rights right: who may see which documents?
The basic rule for access rights is need-to-know: everyone sees what they need for their work – and no more. For documents containing personal data, the GDPR makes this an obligation, because it requires confidentiality and appropriate protective measures. Just as important, however, is the opposite direction: knowledge that the whole team needs – instructions, reports, standards – must not disappear behind unnecessary barriers. Good access rights protect what is sensitive and open up what is useful. This article shows how the two fit together; it sets out the main principles and does not replace legal advice in an individual case.
In brief
- The GDPR requires confidentiality and measures appropriate to the risk (Art. 5 and 32) – an access concept is the standard way of achieving this.
- Need-to-know means: access according to task, not according to hierarchy or convenience.
- Most real incidents are internal: the open salary folder, the job application PDF on the general drive, rights of former employees.
- Roles instead of individual rights: rights are defined per function and people are assigned to roles – this remains maintainable over years.
- In an AI knowledge base, permissions must reach right into the answers: the AI may only quote what the person asking is allowed to see.
Why are access rights a GDPR issue?
In Art. 5, the GDPR sets out the principles of ‘integrity and confidentiality’: personal data must be processed in a manner that protects it against unauthorised access. Art. 32 specifies this in the form of technical and organisational measures that must be appropriate to the risk – and controlling who can access what is at the core of these measures.
The point that is easily overlooked: your own colleague can also be unauthorised. A data protection breach does not require a hacker. If the salary list is readable by everyone on the network drive or job applications end up in the general scan folder, people access data for which they have no task and therefore no authorisation. Depending on the case, this can become a notifiable data breach – the competent authority is the Austrian Data Protection Authority (Datenschutzbehörde, dsb.gv.at). On top of this comes damage beyond the legal side: nothing poisons the working atmosphere more reliably than a salary folder that anyone can look at.
What does need-to-know mean in practice?
Need-to-know means: the yardstick for access is the task, not curiosity, not the level in the hierarchy and not the convenience of IT. Two examples make the principle tangible:
- Every technician should be able to find the maintenance instructions for the vehicle lift – ideally quickly, including the first-year apprentice. They contain no personal data that needs protecting; locking them away only does harm.
- An employee’s payslip is the business of payroll and management only. It contains salary data and, via payroll, even specially protected information.
Need-to-know therefore has two sides, and both are violated in everyday work: systems that are too open expose personal data; systems that are too closed hide the experience the business lives on. The art lies in the dividing line – and it runs between document types, not between departmental vanities.
Who needs access to what? Examples from everyday business
| Document type | Access makes sense for | No access needed for |
|---|---|---|
| Maintenance and operating instructions, service reports | All technicians, often the whole business | – (keep as open as possible) |
| Quote and costing templates | Sales, management | Workshop, warehouse |
| Customer contracts | Management, responsible clerks | Rest of the workforce |
| Payslips, salary data, sick leave | Payroll, management | Everyone else – without exception |
| Job applications | Management, hiring manager | Everyone else |
| Recipes/formulations, design data | Production or development | Areas not involved |
The table is deliberately rough – it shows the pattern: knowledge broad, personal data narrow, trade secrets targeted.
How do you build a role concept in five steps?
- Identify the document types: Not every file individually, but categories – instructions, contracts, personnel documents, cost calculations, project folders. One hour with the heads of department is enough for the first map.
- Define roles – by function, not by person: Technical, sales, accounts/payroll, management, apprentices, external parties. In an SME, five to eight roles are almost always enough.
- Set the principle: Business knowledge as open as possible, personal data and secrets as narrow as necessary. This sentence belongs in the concept in writing, so that future decisions have a yardstick.
- Regulate special cases: Cover arrangements (who takes over during holidays?), external parties (tax adviser, IT service provider – for a limited time), changes of role within the company (withdraw old rights, do not just grant new ones).
- Clean up regularly: Check twice a year: are the assignments still correct? Have the rights of people who have left been deactivated? Legacy rights are the most common hole in the concept – and the quietest one.
Documentation is important: a short, up-to-date access concept is worth its weight in gold when it matters – for example in the event of an enquiry from the data protection authority – and is one of the records that the Austrian Federal Economic Chamber (WKO, wko.at) also recommends in its data protection guides for businesses.
Which mistakes happen most often with access rights?
The everything-open drive. Grown over time, never questioned: a network drive on which everything has been readable by everyone for fifteen years – including the ‘Personnel’ and ‘Salaries’ folders. If you are restructuring, it is best to start right there.
Rights are granted but never withdrawn. The apprentice from back then now works in sales but still carries the rights from three previous roles. And when someone leaves, the account is deactivated – but individual shares at folder level often survive for years.
The boss-has-everything syndrome. Understandable, but risky: an account with full access to everything is the most attractive target for attackers and causes the greatest single damage if a password is stolen.
Copies bypass every concept. The best-protected document is of little use if it travels on as an email attachment or private download. Access concepts therefore also need simple rules for passing on and exporting.
What does an AI knowledge base change about access rights?
An AI search makes documents radically findable – that is its purpose. That is exactly why the access concept has to reach right into the answers: if an employee asks ‘How much does our workshop manager actually earn?’, the system must neither display the payslip nor summarise its content in an answer – not even if the document is somewhere in the indexed collection. The rule is: for an answer, the AI may only use sources that the person asking would also be allowed to open directly.
When choosing a system, therefore, make sure that an AI knowledge base enforces roles and access rights and backs up every answer with the source document – so you can always see where a statement comes from and check it. Used correctly, the knowledge base thus becomes the place where both apply: every technician finds the maintenance knowledge quickly, and the personnel documents stay where they belong. Access rights are one of several building blocks of GDPR-compliant use of AI – the article AI and the GDPR in Austria shows the overall picture, including a provider checklist.
As a next step: take the five-step list and draw up the first version of your role concept – an afternoon is enough to get started, and every future system (AI included) builds on it. You can see how a knowledge base with a role concept is introduced under how the introduction works.
Frequently asked questions
What does the need-to-know principle mean?
Every employee gets access to exactly the data and documents they need for their task – no more. The technician needs the maintenance instructions but not the salary list; payroll needs the salary list but not the design data.
Does the GDPR require an access concept?
Not literally – but it does require confidentiality and technical and organisational measures appropriate to the risk (Art. 5 and 32 GDPR). A documented role concept is the recognised standard way of fulfilling this obligation for documents containing personal data.
Are access rights granted too widely a data breach?
They can become one: if unauthorised persons actually access personal data – even internally – this may be a notifiable personal data breach. The salary folder that anyone can read on the network drive is a classic example.
What is the difference between roles and individual rights?
Individual rights are granted per person and proliferate uncontrollably over the years. Roles bundle rights by function – for example technical, sales, payroll, management – and people are assigned to roles. This remains traceable, even when people join and leave.
How do access rights work in an AI knowledge base?
The permissions have to reach right into the AI search: for an answer, the system may only use documents that the person asking would also be allowed to see. Otherwise the AI blurts out content that was actually protected by folder permissions.
For your company
What this looks like in practice is on the page for your industry — with the questions asked there and the document the answer comes from.