Personal data breaches don’t always involve hackers
Sometimes, the risk comes from someone who already has access. Whether you’re running a small accountancy practice, a recruitment agency, a consultancy or a growing business with a handful of employees, one question matters: Do your staff understand what personal data they can access, why they’re allowed to access it, and what they’re not permitted to do with it?
Recent reports involving NHS staff accessing information about victims of high-profile incidents are a stark reminder that having access to a system doesn’t give someone unlimited permission to browse its contents.
For businesses of every size, this is an important lesson in data protection, staff training and taking responsibility for the information entrusted to you.
The NHS investigation that highlights the problem
In October 2026, the Guardian reported that Yorkshire Ambulance Service NHS Trust was investigating two members of staff following the death of William Chapman, who was killed by a tiger at Yorkshire Wildlife Park.
According to the report, the trust believed there may have been two instances of staff accessing or attempting to access incident or medical information without a legitimate reason. The concern had been reported to the Information Commissioner’s Office (ICO), and the trust said it had identified the issue through proactive audits. The investigation was ongoing at the time of reporting.
This followed wider concerns about unauthorised access to the medical records of people involved in high-profile crimes. In July 2026, NHS England issued guidance to healthcare organisations on preventing and monitoring unlawful access to patient records, emphasising the importance of staff training, clear responsibilities and appropriate monitoring.
These are serious incidents involving highly sensitive information. And while the circumstances differ from those in a typical small business, the underlying lesson is the same. An employee’s curiosity is not a legitimate reason to access someone’s personal information. A member of staff might be interested in a news story, recognise a name, know someone involved or simply want to find out more. None of those reasons automatically gives them permission to look at the relevant records.
The same principle applies in your business. An employee shouldn’t browse a customer’s account, open a colleague’s personnel file or search for a friend’s details simply because the information is available to them.
What does the law say about staff access to personal data?
The UK GDPR’s security principle requires organisations to protect personal data against unauthorised or unlawful processing. This includes putting appropriate technical and organisational measures in place to protect information. That means access should be restricted to people who are authorised to use the information, and those people must act within the scope of the authority they have been given.
Article 29 of the UK GDPR also states that people acting under the authority of a controller or processor who have access to personal data must not process it except on the controller’s or processor’s instructions, unless required to do so by domestic law.
In practical terms, your staff need to understand that:
- Access must have a legitimate work-related purpose. They should only access information when it is necessary for their role and authorised duties.
- Permissions have limits. Being able to log into a system doesn’t mean they can inspect every customer record, personnel file or financial document.
- Information must be handled within the authority granted. Staff must follow your instructions and procedures when viewing, using, changing, sharing or deleting personal data.
This isn’t about asking for an individual’s consent every time an employee performs an authorised work task. It is about ensuring employees have the appropriate authority, follow your instructions and only process data for legitimate purposes.
Your staff need to know what they can, and cannot, access
Many businesses rely on informal assumptions. The office manager can see everything because they have always had broad access. Everyone shares a login because it’s convenient. A former employee’s account remains active because nobody remembered to remove it. These arrangements can create unnecessary risks.
You should be able to explain which staff members need access to particular categories of information and why.
For example:
- Accounts staff may need access to customer contact details, invoices and payment records, but not confidential HR files.
- HR staff may need access to employee records, salary information and recruitment documents, but not unrestricted access to every customer’s account.
- Sales and marketing staff may need customer contact details for approved activities, but shouldn’t automatically be able to access sensitive information unrelated to those activities.
- Managers may need access to certain records to perform their duties, but seniority alone doesn’t mean unrestricted access is always appropriate.
The precise permissions will depend on how your business operates and the responsibilities of each role. The important point is to follow the principle of least privilege: give people the access they reasonably need to do their jobs, rather than giving everyone access to everything.
Staff training isn’t optional
You can have the best policies in the world, but they won’t protect your business if your employees don’t understand them. Your staff need to know what personal data is, how to handle it securely, when they’re authorised to access it, and what to do if something goes wrong. Training should cover more than avoiding suspicious emails or creating strong passwords. It should also explain the rules governing everyday access to information.
For example, employees should understand that they must not:
- Look up information about friends, family members, colleagues or public figures out of curiosity.
- Open files or customer records that aren’t relevant to their work.
- Share information with colleagues who have no legitimate reason to receive it.
- Use personal data for their own purposes or pass it to someone outside the business without appropriate authorisation.
- Use a colleague’s login or allow someone else to use their own account.
- Download or copy information to personal devices or accounts unless an approved business process permits it.
They should also understand how to report suspected unauthorised access, accidental disclosures and other data protection incidents.
The ICO recommends appropriate initial and refresher training to help staff understand their responsibilities and put security policies into practice. Training should reflect the information employees handle and the risks associated with their work.
Make sure your company has authorised the processing
Your employees aren’t free to use personal data simply because they work for you.
Under the UK GDPR, people acting under your authority must follow your instructions when processing personal data, subject to the legal exception described in Article 29. For a small business, this means putting clear arrangements in place so staff understand which activities they are permitted to carry out on the company’s behalf. That could mean authorising an employee to update customer records, process payroll, manage recruitment applications or send approved marketing communications. It does not automatically authorise them to use the same information for an unrelated purpose.
Make sure your expectations are documented in relevant policies and procedures, explained during induction, and reinforced through ongoing training. Employees should also know who to ask when they aren’t sure whether an action is permitted. Don’t rely on a vague instruction to “follow GDPR”. Give people practical examples that reflect the work they actually do.
Five steps to improve staff access controls
You don’t need a huge compliance department to improve your arrangements. Start with these five steps.
1. Review who can access what.
List the systems and files containing personal data. Identify who has access, what they need it for, and whether their permissions are appropriate. Remove access that is no longer necessary.
2. Set clear rules.
Document how staff may access, use, share, amend and delete personal data. Explain that access must be connected to an authorised work purpose.
3. Train staff and keep evidence.
Provide training during induction and refresher training as appropriate. Include realistic scenarios about inappropriate access, confidentiality, data sharing and incident reporting. Keep records of completion so you can demonstrate what training has been delivered.
4. Monitor access appropriately.
Where your systems allow it, review access logs and investigate unusual or unauthorised activity. Make sure appropriate controls are in place and that permissions are updated when employees change roles or leave the business. Monitoring should be proportionate and handled transparently, in line with your legal obligations and workplace policies.
5. Have a clear reporting process.
Employees should know exactly who to contact if they access the wrong information, discover suspicious activity or make a mistake. Respond promptly, investigate the circumstances and assess whether the incident constitutes a personal data breach and whether regulatory or individual notification is required. Remember, a policy sitting unread in a shared folder isn’t enough. Your arrangements need to work in practice.
What happens when staff get it wrong?
Unauthorised access can undermine customer trust, damage your reputation and create significant work for your business. Depending on the circumstances, it may also lead to disciplinary action, regulatory scrutiny or other legal consequences. Deliberate, unauthorised access can be particularly serious. The impact isn’t limited to the organisation. People may feel embarrassed, distressed or exposed when information they expected to remain confidential is accessed without a proper reason.
That’s why staff education, appropriate access controls and routine checks all matter. They help prevent incidents, demonstrate that your business takes its responsibilities seriously and make it easier to identify problems when they occur.
Make staff training part of your ongoing compliance
Data protection isn’t something you can deal with once and forget about. Staff join, responsibilities change, new systems are introduced and existing procedures evolve. Your approach needs to evolve with them.
Data Support Hub helps businesses make data protection more manageable through Data Compliance Pro, including staff training and progress tracking, alongside tools for managing policies, documents and wider compliance activities.
The objective is straightforward: make sure your employees understand their responsibilities, your systems support those responsibilities, and you can demonstrate the steps your business has taken.
Don’t wait until an incident makes you ask who accessed what. Make sure you know now.
Explore Data Support Hub and its staff training options to help strengthen your approach to data protection.