How do organisations know whether GDPR identity controls are actually working?

What “working” means for GDPR identity controls

For GDPR, an identity control is working only if it can be traced back to a concrete data processing purpose and an accountable owner. That means access is not just granted, but governed: the organisation can explain why the access exists, who owns it, how it was verified, and when it will end. Without those links, control may exist in policy but not in practice.

That test matters because GDPR accountability is demonstrated through evidence, not intention. If a team cannot show a current purpose for access, a named owner, a proofing standard, and a revocation trigger tied to offboarding or retention expiry, then the control is too weak to support assurance, review, or audit.

How to measure identity control effectiveness

Measurability starts with mapping each access path to a purpose, a subject, and a lifecycle state. In practice, this means every user, admin, contractor, or delegated account should be attributable to a business activity, with the owner able to confirm why it exists and when it should be removed. Identity data privacy and consent guidance is useful here because it treats lawful use, retention, and delegated access as operational control points rather than abstract privacy ideas.

A useful measurement pattern is to check whether the organisation can produce complete evidence for a sample of access paths. If the sample includes accounts with no current purpose, no owner, no proofing record, or no revocation path, the control is incomplete. If the sample is consistently current and the evidence is repeatable, the control is measurable enough to sustain accountability.

What breaks accountability in practice

The most common failure is treating identity governance as a one-time onboarding exercise. Access that was justified when created can become unjustified after role changes, project completion, outsourcing changes, or data retention deadlines. That is why lifecycle evidence matters as much as initial approval, and why revocation must be linked to both offboarding and retention expiry.

Another weak point is ownership drift. If no one can name the person responsible for an access path, the control cannot be reviewed, challenged, or corrected. Identity Security Regulatory Map is a helpful way to connect that ownership problem to compliance obligations across GDPR and other regimes, while EU General Data Protection Regulation (GDPR) remains the core reference for accountability, data minimisation, and security of processing.

Risk and Threat Considerations

Weak identity controls create hidden access paths that outlive the business purpose that justified them. The risk is not only non-compliance, but also unauthorised processing, excessive retention, and delayed detection when an account or delegated path is misused.

Failure mechanism: Controls fail when ownership, proofing, and revocation are not tied to a live lifecycle record, so stale access continues after role change, offboarding, or retention expiry.

Impact: Organisations lose the ability to demonstrate accountability, and any access review becomes a paper exercise rather than evidence that personal data access is actually governed.

Practitioner Guidance

What to verify: For each access path, verify that the record shows a current purpose, an accountable owner, the proofing standard used at grant time, and the condition that will remove access. If any of those fields are missing, treat the control as unproven rather than partially effective.

What good looks like: A reviewer can sample an access path, follow it from approval to active use to revocation criteria, and see the same story in the identity system, the ticketing record, and the retention schedule. That consistency is the practical sign that the control is measurable.

Practitioner takeaway: GDPR identity controls are working only when they are auditable as lifecycle controls, not just permission settings; if you cannot prove why access exists and how it ends, you do not yet have control.

Related resources from NHI Mgmt Group

• How do organisations know whether financial or identity controls are actually working?
• How do organisations know whether ransomware identity controls are actually working?
• How do organisations know whether NHI controls are actually working?
• How do organisations know whether mobile asset controls are actually working?