To ensure that access to personal confidential data (PCD) is limited to authorised individuals only, in line with the Data Security and Protection Toolkit (DSPT) Standard 1. This policy implements the principle of least privilege and supports secure handling of patient information.
This policy applies to all employees, contractors, and third-party users who process or have access to personal confidential data within Veripath Limited.
1. Authorisation
Access to PCD will be granted only on the basis of a legitimate business need. No individual may access PCD without prior written approval from the Data Protection Officer (DPO) or Information Governance lead.
2. Role-Based Access
Access levels are defined by job role. Each role has a documented data access profile specifying the minimum data necessary to perform duties. (See Appendix A – Role Access Matrix.)
3. Access Control Methods
4. Review and Revocation
5. Remote Access
Remote access to PCD is permitted only via an encrypted VPN and on devices managed by the organisation (see Standard 7 encryption requirements).
6. Breach Reporting
Any unauthorised access or suspicion thereof must be reported immediately to the DPO using the incident reporting procedure.
This policy will be reviewed annually or after any significant change to systems or data processing.