Is personal data stored securely and access limited to those who need it?

You have no idea who has access to what data. Customer files sit in shared folders, databases have one login everyone uses, and paper records are in an open cupboard that anyone can walk into.

You've made a mental note of who 'should' have access, but there's no formal process or system to enforce it. The operations manager has a spreadsheet of customer data, the finance person has an old laptop with client lists, and passwords are often shared or written on sticky notes.

You've assigned basic access roles (like 'accountant can see invoices, sales person can see customer contact info'), but there's no regular review of who actually has access. You're using some password protection, but the same person who left last year might still have a login, and you haven't checked in three months.

You've created a documented access policy that says which roles can see which data types, and you've set up basic user accounts with individual logins. You review access every quarter when someone joins or leaves, and you've disabled old logins—but you haven't tested whether the access controls actually work or logged who accessed what data.

You maintain an up-to-date access control list showing exactly who can see what data and why. Your systems log who accessed which data and when, you review access quarterly against current employee roles, and you can quickly spot if someone accessed data they shouldn't have. You've tested that the controls actually prevent unauthorized access.

Your access controls are automated—the system grants or revokes access based on job role, and access is reviewed and updated in real time. You have detailed audit logs of every data access, automated alerts if someone tries to access data outside their role, regular penetration testing to confirm controls work, and a documented incident response plan for access breaches. You review effectiveness quarterly and adjust based on risk changes.