A hospital asks whether access controls that limit which staff can open patient records count only as organisational paperwork, or also as technical security measures under the GDPR. Which view is most accurate?
Select an answer to reveal the explanation.
Short Explanation
Who can open the file is a technical gate, not just a memo on the wall. Access control sits squarely among the technical measures that keep personal data from wandering into the wrong hands. Policies still matter—but the control itself is a tech measure.
Full Explanation
Access controls that limit which staff can open patient records are classic technical measures within appropriate TOMs that protect personal data against unauthorised access under Article 32. Hospitals should not demote them to mere organisational paperwork: authentication and authorisation mechanisms are technical controls, complemented by policies and training. Access controls are not never-technical because humans set permissions. They do not replace the need for organisational policies or staff training. They are not relevant only for passwords stored as special-category data. Exam caveat: access control is a paradigmatic Article 32 technical measure. Operational check: verify patient-record systems enforce role-based access, unique credentials, and access logging—and pair those technical controls with procedures for joiner-mover-leaver reviews. For municipal teams, keep a one-page decision note that states the governing instrument, why competing labels fail, and what evidence would change the conclusion. Document the decision trail so auditors can see how the civic team matched facts to the correct legal category rather than to a slogan. Revisit the conclusion when facts, recipients, or processing purposes change, and record who approved the updated analysis.