An organization suffered a personal data breach. The attackers gained access to their database through a user account that had unlimited access to dat a. What should the DPO advise the organization to do in order to prevent the recurrence of similar scenarios?

The root cause of the breach was a user account with excessive permissions ("unlimited access"). This signifies a failure in implementing the principle of least privilege. The most effective preventative measure is to address the systemic issue in access control management. Reviewing the entire lifecycle of user accounts—from creation and approval (ensuring appropriate, role-based permissions are granted) to periodic review (verifying permissions remain necessary) and timely deletion—directly remedies the control weakness. This aligns with GDPR's requirement for appropriate technical and organizational measures under Articles 25 (Data Protection by Design and by Default) and 32 (Security of Processing) to ensure the ongoing confidentiality and integrity of personal data.

B. Using cloud services is not a direct solution. The responsibility for configuring and managing user access controls remains with the organization, regardless of where the data is hosted.
C. Shared accounts are contrary to security best practices. They eliminate individual accountability, making it impossible to trace actions to a specific person, thereby increasing security risks.

1. Regulation (EU) 2016/679 (General Data Protection Regulation), Article 32(1)(b) mandates implementing measures to ensure "the ongoing confidentiality, integrity, availability and resilience of processing systems and services." A robust access control system is a fundamental measure for ensuring confidentiality and integrity.

2. Regulation (EU) 2016/679 (General Data Protection Regulation), Article 25(2) requires the controller to implement measures ensuring that "by default, personal data are not made accessible without the individual's intervention to an indefinite number of natural persons." This directly supports the principle of least privilege, which is managed through user account lifecycle controls.

3. PECB. (2022). Certified Data Protection Officer - Course Material. The module on "Security Controls for PII Protection" explicitly details User Access Management as a critical domain. It outlines the necessity of formal processes for user registration, privilege management, regular review of access rights, and de-provisioning of accounts to enforce the principle of least privilege and prevent unauthorized access.

4. Purtova, N. (2018). The law of everything. Broad concept of personal data and future of data protection. Law, Innovation and Technology, 10(1), 40-81. https://doi.org/10.1080/17579961.2018.1452176. This academic paper discusses the implementation of GDPR principles, where data protection by design (Article 25) is interpreted as requiring technical measures like granular access control systems from the very beginning of any data processing design.