Entity integrity is the rule that each row or record in a dataset must be uniquely identifiable and not null in its primary key. In relational databases, it is enforced by primary key constraints so duplicate or missing key values cannot create ambiguous records or break references from other tables.
What Entity Integrity Means in a Database
Entity integrity is the database rule that every row must be uniquely identifiable and that the identifier cannot be null. In practice, it is the guarantee that a table can reliably distinguish one record from another, which is why primary key constraints are central to relational design.
This matters because a table without entity integrity can contain ambiguous, duplicate, or unaddressable rows. Once that happens, joins, updates, deletes, audit trails, and application logic can all start to behave unpredictably, even if the data still looks superficially valid.
Why Primary Keys Enforce Record Identity
Entity integrity is usually implemented through a primary key, which is the column or set of columns that serves as the row’s stable identifier. The constraint prevents null values and duplicate key values, so the database can enforce one and only one identity for each record.
That enforcement is stronger than application-side checks because the database applies it consistently at write time. If developers rely only on code to prevent bad keys, race conditions, bulk imports, migrations, or manual fixes can still introduce broken records.
How Entity Integrity Supports Referential Integrity
Entity integrity also underpins referential integrity. Other tables depend on a primary key being stable and non-null so foreign key references remain meaningful and can point to exactly one parent row.
When the primary key is weak or missing, downstream relationships become fragile. A child row may point to nothing, point to the wrong row, or become impossible to reconcile during reporting, replication, or data restoration.
This is why entity integrity is not just a modelling preference. It is a structural requirement for trustworthy relationships across a relational database schema, especially in systems that support transactions, joins, and long-lived records.
Why Entity Integrity Matters for Data Quality and Control
Entity integrity protects the accuracy of operational data by preventing record ambiguity at the database layer. It helps ensure that business entities such as customers, transactions, assets, and events can be tracked, updated, and audited without confusion.
It also reduces the risk of silent corruption. Without a dependable primary key, duplicate inserts, failed deduplication, and inconsistent imports can create records that appear valid to one system but are interpreted differently by another.
Risk and Threat Considerations
Weak entity integrity creates a data trust problem: if records are not uniquely identifiable, attackers or faulty processes can exploit ambiguity, overwrite the wrong row, or hide duplicate data inside normal operations. The same failure mode also increases the chance of integrity loss during migration, replication, and integration.
Failure mechanism: Missing or duplicate primary key values weaken the database’s ability to enforce a single authoritative record, which can break joins, corrupt references, and make unauthorized or mistaken updates harder to detect.
Impact: Organisations can end up with inaccurate reporting, failed reconciliation, broken downstream workflows, and compromised auditability, especially where multiple systems rely on the same dataset as a source of truth.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5, CIS Controls v8 and NIST CSF 2.0 set the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | Stable record identifiers support controlled lifecycle handling of database-linked identities and records. |
| Recommendation — Enforce identifier lifecycle controls so records cannot be created or updated with ambiguous key values. | ||
| ISO/IEC 27001:2022 | A.8.13 — Information backup | Entity integrity depends on recoverable records that preserve authoritative row identity after restoration. |
| Recommendation — Validate that backups and restores preserve primary key constraints and record uniqueness. | ||
| CIS Controls v8 | CIS-7 — Continuous Vulnerability Management | Databases and data pipelines need ongoing validation to catch integrity weaknesses before they spread. |
| Recommendation — Continuously review data stores for schema drift, duplicate keys, and missing identifiers. | ||
| NIST CSF 2.0 | ID.AM-02 — Hardware and software platforms are inventoried | Accurate data inventories depend on uniquely identifiable records for reliable asset and record tracking. |
| Recommendation — Maintain authoritative inventories so records can be reconciled to a single source of truth. | ||
Practitioner Guidance
Why practitioners should care: Entity integrity should be treated as a schema-level control, not a naming convention or application habit. If the database does not enforce uniqueness and non-null constraints, data quality depends on every producer behaving perfectly, which is an unsafe assumption.
Practitioner takeaway: Use stable primary keys, enforce them in the database, and review legacy tables or imports that permit null or duplicate identifiers before they spread inconsistency across dependent systems.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on November 3, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org