Lesson 4.62: Insider risk: lawful and proportionate
Some of the most damaging incidents come from people with legitimate access: an employee leaving with the customer list, an administrator abusing their rights. An insider risk programme looks for those signals, but it monitors employees, so it has to respect privacy law, employee representatives and proportionality, or it becomes the problem itself. In the lab you apply Northwind's procedure to a week of signals: open a case only where the threshold is met, refuse a manager's request that goes too far, fix a case file's access list and log each decision with its legal basis.
17 min
You will learn to
- Explain insider risk signals and their limits
- Apply a case-opening threshold consistently
- Recognise disproportionate monitoring requests
- Enforce need-to-know on case files
- Log decisions with their legal basis
Key terms
- Insider risk
- Harm caused, intentionally or not, by people with legitimate access.
- Proportionality
- Monitoring no more than necessary for a legitimate aim, by the least intrusive means.
- DPIA
- Data protection impact assessment, required by GDPR Article 35 for high-risk processing such as systematic employee monitoring.
- Works council
- Elected employee body; in countries such as Germany it has co-determination rights over monitoring technology.
- Need-to-know
- Access only for those who need the information for their role in the case.
← Coordinated vulnerability disclosure · All lessons · A full data protection impact assessment →