Data Security for Finance Teams: Classification, Access Control and GDPR Article 32

Finance teams hold some of the most sensitive data in any organisation: payroll, bank details, supplier terms, forecasts and customer information. Good data security for a finance team comes down to a few repeatable habits: know what data you have and how sensitive it is (classification), limit who can reach it (access control), protect it in storage and transit (encryption), keep a record of who did what (logging), and be ready to act if something goes wrong (breach response). This guide ties those habits to Article 32 of the GDPR and to Irish official guidance. Where we offer practical steps of our own, we label them as suggestions.

Security is also a skills issue, because most incidents start with a person. Our overview of cybersecurity training for finance professionals covers that side in more depth.

What GDPR Article 32 says

Article 32 of the GDPR (Regulation (EU) 2016/679, read on EUR-Lex) requires the controller and processor to implement "appropriate technical and organisational measures to ensure a level of security appropriate to the risk". It tells you to consider the state of the art, implementation costs, and the nature, scope, context and purposes of processing. The measures it lists as examples include:

• the pseudonymisation and encryption of personal data;
• ensuring ongoing confidentiality, integrity, availability and resilience of processing systems and services;
• restoring availability of and access to personal data in a timely manner after a physical or technical incident; and
• regularly testing, assessing and evaluating the effectiveness of the measures.

Article 32 also says that anyone acting under the authority of the controller or processor who has access to personal data must not process it except on instructions, unless required by law. The key idea is that the Article is risk-based. It does not give a fixed checklist, which is why finance teams need to document their reasoning.

The Data Protection Commission (DPC) says the same in its Guidance for Controllers on Data Security (version dated February 2020): the GDPR does not prescribe specific security measures, and controllers weigh the likelihood and severity of risk to individuals. Because that guidance is several years old, check the DPC site for the current version.

Classification: knowing what needs protecting

The official sources we read do not set out a single classification scheme for private-sector finance teams. The NCSC's "12 Steps to Cyber Security" (version 1.2, October 2018) says to keep a central inventory that ranks assets by criticality to the business. The NCSC's Cyber Security Baseline Standards, which are written for public service bodies, suggest using the Traffic Light Protocol when sharing incident information if a body has no information classification policy. Both are useful context, but neither prescribes a scheme for your team.

Our suggestion is a simple scheme that people can remember. An illustrative example is four levels:

• Public: information you already publish.
• Internal: ordinary business information not meant for outsiders.
• Confidential: payroll, bank details, personal data, contract terms.
• Restricted: the small set of data where exposure would cause serious harm, such as bulk bank details or unpublished results.

Whatever labels you choose, write down which controls each level needs (who can access, where it may be stored, whether it may be emailed) and keep the number of levels small enough that staff actually use them. Your GDPR records of processing are a natural place to start identifying where your most sensitive data sits.

Access control and least privilege

The DPC guidance uses the phrase "need to know" and says access should be limited to what each role requires, with stricter controls for more sensitive data. It also recommends good practice such as unique user IDs, no shared credentials, procedures for movers, leavers and joiners, and separate administrator accounts subject to vetting and oversight. The NCSC's 12 Steps document states the principle directly: "only give people access to what they need to do their job", and says only specifically trained and vetted individuals should have access to administer systems. The NCSC's guidance for small business also recommends multi-factor authentication where possible and strong passwords of at least 12 characters.

Our suggestions for a finance team:

• review who has access to payment platforms, payroll and banking each quarter, and remove access promptly when people move or leave;
• avoid shared logins for shared mailboxes or bank portals where an individual login is possible;
• separate the people who set up payees from those who approve payments.

Access control also matters inside everyday tools. If staff use workplace assistants that search across shared files, over-broad permissions can expose data. Our guide to Microsoft 365 Copilot data governance and permissions covers permissions in one widely used workplace tool.

Encryption, backups and logging

The DPC guidance says encryption is considered essential where personal data is stored on a portable device or sent over a public network, and it cites 256-bit whole-disk encryption as an acceptable standard at the time of writing. The NCSC's 12 Steps recommends full disk encryption on laptops and removable media such as USB keys. Treat those figures as a snapshot from the guidance dates and check current recommendations.

On backups, the DPC says that the security standards for back-up data are the same as for live data. The NCSC's small business guidance advises regular backups of critical data, kept separate from the originals and tested, with strict access controls and multi-factor authentication protecting the backups.

On logging, the DPC says a system should be able to identify the user name that accessed a file and the time of access, that changes should be logged with the author, and that logs should be reviewed regularly. The 12 Steps document asks you to decide which activities should be logged and how long logs are retained. Logs only help if somebody looks at them, so assign that responsibility.

Patching and people

The DPC says organisations need regular, consistent and comprehensive patch management, and that the most important security measure is to ensure that staff are aware of their responsibilities. The NCSC's small business guidance recommends automatic security updates and replacing hardware or software the vendor no longer supports.

If something goes wrong: breach notification

Article 33(1) GDPR says that in the case of a personal data breach, the controller must notify the competent supervisory authority without undue delay and, where feasible, not later than 72 hours after becoming aware of it, unless the breach is unlikely to result in a risk to the rights and freedoms of natural persons. A late notification must be accompanied by reasons for the delay. The DPC's breach notification page repeats the 72-hour period, says affected individuals must be told without undue delay where there is a high risk to them, and says organisations need to keep an internal record even where they judge there is no risk. That page shows no last-updated date, so check the DPC site for current forms and guidance.

Our suggestion: agree in advance who decides whether an incident is a breach, who contacts the DPC, and who tells affected people, because 72 hours passes quickly. The DPC guidance also says to plan your response before a breach occurs and not to assume breaches are only lost devices.

Learnsignal's offices are off Baggot Street in Dublin, and we offer in-person training from there. For current details, see our CPD pages.

Frequently asked questions

Does GDPR Article 32 list specific security tools I must use?

No. It gives examples such as pseudonymisation and encryption, and requires measures appropriate to the risk. The DPC guidance also says the GDPR does not prescribe specific measures.

What is the deadline for notifying a personal data breach?

Article 33(1) says without undue delay and, where feasible, not later than 72 hours after becoming aware, unless the breach is unlikely to result in a risk to individuals.

Is there an official data classification scheme for businesses?

We did not find one in the official sources we read. The NCSC refers to ranking assets by criticality, so a simple internal scheme documented in policy is a reasonable approach.

Where should a small finance team start?

The NCSC's small business guidance gives six starting points: identify what matters most, keep devices and software up to date, implement basic protections, turn on multi-factor authentication, back up your information and create strong complex passwords.

Pick one area, such as access reviews for payment systems, and complete it this quarter.