They should be able to show that each personal data access path has a current purpose, a named owner, a proofing level, and a revocation path tied to offboarding or retention expiry. If those links are missing, the control is not measurable enough to support accountability.
What “working” means for GDPR identity controls
For GDPR, an identity control is working only if it can be traced back to a concrete data processing purpose and an accountable owner. That means access is not just granted, but governed: the organisation can explain why the access exists, who owns it, how it was verified, and when it will end. Without those links, control may exist in policy but not in practice.
That test matters because GDPR accountability is demonstrated through evidence, not intention. If a team cannot show a current purpose for access, a named owner, a proofing standard, and a revocation trigger tied to offboarding or retention expiry, then the control is too weak to support assurance, review, or audit.
How to measure identity control effectiveness
Measurability starts with mapping each access path to a purpose, a subject, and a lifecycle state. In practice, this means every user, admin, contractor, or delegated account should be attributable to a business activity, with the owner able to confirm why it exists and when it should be removed. Identity data privacy and consent guidance is useful here because it treats lawful use, retention, and delegated access as operational control points rather than abstract privacy ideas.
A useful measurement pattern is to check whether the organisation can produce complete evidence for a sample of access paths. If the sample includes accounts with no current purpose, no owner, no proofing record, or no revocation path, the control is incomplete. If the sample is consistently current and the evidence is repeatable, the control is measurable enough to sustain accountability.
What breaks accountability in practice
The most common failure is treating identity governance as a one-time onboarding exercise. Access that was justified when created can become unjustified after role changes, project completion, outsourcing changes, or data retention deadlines. That is why lifecycle evidence matters as much as initial approval, and why revocation must be linked to both offboarding and retention expiry.
Another weak point is ownership drift. If no one can name the person responsible for an access path, the control cannot be reviewed, challenged, or corrected. Identity Security Regulatory Map is a helpful way to connect that ownership problem to compliance obligations across GDPR and other regimes, while EU General Data Protection Regulation (GDPR) remains the core reference for accountability, data minimisation, and security of processing.
Risk and Threat Considerations
Weak identity controls create hidden access paths that outlive the business purpose that justified them. The risk is not only non-compliance, but also unauthorised processing, excessive retention, and delayed detection when an account or delegated path is misused.
Failure mechanism: Controls fail when ownership, proofing, and revocation are not tied to a live lifecycle record, so stale access continues after role change, offboarding, or retention expiry.
Impact: Organisations lose the ability to demonstrate accountability, and any access review becomes a paper exercise rather than evidence that personal data access is actually governed.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
GDPR provides the primary governance reference for this topic.
| Framework | Control / Reference | Relevance |
|---|---|---|
| GDPR | Art. 5 — Principles relating to processing of personal data | Sets accountability, minimisation and purpose limitation for personal data access controls. |
| Art. 25 — Data protection by design and by default | Requires privacy controls to be built into access governance and lifecycle handling. | |
| Art. 32 — Security of processing | Supports verifying whether identity controls protect personal data with appropriate access security. | |
| Recommendation — Document the purpose and ownership of each personal-data access path and review it against retention needs. Embed revocation, minimisation and default-deny access handling into identity workflows. Use access review and revocation evidence to prove personal-data access is secured appropriately. | ||
Practitioner Guidance
What to verify: For each access path, verify that the record shows a current purpose, an accountable owner, the proofing standard used at grant time, and the condition that will remove access. If any of those fields are missing, treat the control as unproven rather than partially effective.
What good looks like: A reviewer can sample an access path, follow it from approval to active use to revocation criteria, and see the same story in the identity system, the ticketing record, and the retention schedule. That consistency is the practical sign that the control is measurable.
Practitioner takeaway: GDPR identity controls are working only when they are auditable as lifecycle controls, not just permission settings; if you cannot prove why access exists and how it ends, you do not yet have control.
Related resources from NHI Mgmt Group
- How do organisations know whether financial or identity controls are actually working?
- How do organisations know whether ransomware identity controls are actually working?
- How do organisations know whether NHI controls are actually working?
- How do organisations know whether mobile asset controls are actually working?