If your company processes personal data, you must control who can access it and within what scope. An authorization procedure helps organize this: it sets rules for granting, changing and revoking permissions. Without one, you risk unauthorized access to data, a GDPR breach and consequences from UODO.
What is an authorization procedure for?
A personal data processing authorization procedure is a document that sets out the rules for granting, changing and revoking authorizations for people who access personal data in an organization. It is part of the personal data protection system and is consistent with the requirements of the GDPR and national regulations.
Implementing a procedure gives you specific benefits:
- Control over data access: you determine who may process personal data and within what scope.
- GDPR compliance: under Article 32 GDPR, organizations must implement technical and organizational measures to ensure processing security, including access control.
- Protection against unauthorized access: you reduce the risk of data leaks or improper use.
- Minimizing the risk of breaches: you ensure that only authorized people can access specific data.
- Process transparency: you clearly assign responsibility for data processing.
- Activity monitoring: you track who has access to data and what actions they perform.
- Readiness for an inspection: the authorization register provides evidence that procedures compliant with the law have been implemented in the event of an inspection by the supervisory authority, such as UODO.
What should an authorization procedure contain?
Check that your procedure covers each of the following elements:
- Purpose of the procedure: explain why it is being implemented, such as to control access or protect data.
- Scope of the procedure: identify which personal data it applies to, such as customer or employee data.
- Legal basis: refer to the GDPR and national regulations.
- Roles and responsibilities: identify the people responsible for:
- granting authorizations, such as the data controller or department managers,
- managing authorizations,
- monitoring access.
- Authorization-granting process:
- Request for authorization: for example, a paper or electronic form.
- Defining the authorization scope: which data the employee will access and for what purpose.
- Issuing the authorization: granting a formal document, such as an authorization issued to a named person.
- Employee training: training the employee in personal data protection.
- Changing authorizations: establish a process for updating permissions, for example, when a person’s position or duties change.
- Revoking authorizations:
- identify the situations in which revocation is required, such as the end of cooperation or a change in duties,
- set out the process for retrieving the authorization and securing the data.
- Authorization register: require a register of authorized people who process personal data, including names, authorization scope and grant and revocation dates.
- Responsibility for breaches: explain the consequences of failing to comply with authorizations.
What should you do with the procedure after preparing it?
Creating a document is not enough. Here is what you need to do at each stage:
- Create and implement it: develop a procedure tailored to the organization’s needs and processes.
- Provide training: employees must know the rules for handling personal data and understand why authorizations matter.
- Grant authorizations: formally grant selected people access to personal data based on the need to process it.
- Keep an authorization register: record all authorizations granted and update the register on an ongoing basis.
- Monitor compliance with permissions: regularly check whether employees act within their granted permissions.
- Update and revoke authorizations: change or revoke permissions when an employee changes position or duties, or leaves the organization.
- Audit the procedure: periodically assess how effective the procedure is and make corrections.
- Make it available to supervisory authorities: during an inspection, the authorization register is evidence that GDPR requirements are met.
Steps for granting an authorization
A typical authorization process in a company looks like this:
- A supervisor submits an authorization request for an employee.
- The data controller or an authorized person reviews the request.
- The employee signs a statement confirming that they have read the data-protection rules.
- A written or electronic authorization is issued.
- The employee is entered in the register of authorized people.
- The employee receives training in data-protection rules.
- Use of the authorization is monitored.
How AI can support the authorization procedure
If your company manages a large number of authorizations, consider using AI-based tools. Examples include:
Automatically assigning authorizations
AI can automatically assign authorizations based on an employee’s role in the organization and the type of data they process. This makes the process faster and less prone to errors.
Tracking changes to authorizations
AI-based systems can monitor changes to authorizations, including revocations and new assignments, and automatically update the register.
Detecting unauthorized access
AI analyzes system logs and monitors whether authorized people access only the information needed to perform their tasks.
Compliance reporting
AI tools can generate reports on compliance with the authorization procedure, making regular audits and ongoing GDPR compliance easier.
Summary
An authorization procedure gives you control over who in the company processes personal data. It ensures that only authorized people have access to data and that the process is documented and GDPR-compliant. Regularly monitoring and updating authorizations reduces the risk of breaches and strengthens data protection.
If you need support developing or implementing a procedure, we can help at every stage, from an audit and preparing documentation to GDPR compliance advice.
Frequently asked questions
Which data requires authorization to process?
All personal data processed by the company requires authorization: employee, customer and contractor data, as well as sensitive data such as health data.
What should you do if an employee does not follow the data-processing rules?
If an employee breaches the data-processing rules:
- conduct an internal investigation,
- take disciplinary action if necessary,
- revoke the employee’s authorization to process data.
How often should the authorization register be updated?
Update the authorization register on an ongoing basis, whenever the staff composition, an employee’s role in the organization or the scope of data processed changes.
