The Shared Payroll Spreadsheet
A 14-person accountancy firm keeps its monthly payroll workbook on a shared network drive. Everyone in the firm has read and write access to the folder because 'it's easier'. The workbook contains staff salaries, national insurance numbers and bank details. Last week a junior employee accidentally overwrote three rows while sorting the file, and the firm cannot tell who changed what. The partner asks you to fix access control without stopping the payroll team from working. There are no budget for new software, and the payroll team works from 09:00 to 17:00, with the partner reviewing figures on Friday afternoons only.
1. Identify the two distinct access-control problems in this setup and explain why each one matters for data protection.
Read the worked answer
Problem 1 - over-broad permissions (no least privilege). All 14 staff have read/write on payroll data, but only a handful need it. Least privilege means granting the minimum access required for a role. A junior employee who only needs to view their own payslip should not be able to write to the whole workbook. Over-broad write access is what allowed the accidental overwrite.
Problem 2 - no accountability (no individual identification). Because the folder is shared with generic access, the firm cannot attribute the change to a person. Data protection principles require you to be able to demonstrate who accessed and changed personal data. Without per-user accounts, logging and a change history, the firm cannot investigate the incident or show due care.
A third, related weakness is the absence of versioning/backup, which turned a small mistake into unrecoverable data loss.
2. Propose a concrete access-control change that keeps the payroll team working, and state one trade-off you accept.
Read the worked answer
Proposal: Create role-based groups. Give the payroll team (say 3 people) read/write to the workbook; give the partner read-only; give everyone else no access to this folder. Use individual named accounts (no shared logins) so changes are attributable. Turn on file versioning so overwrites can be rolled back.
Trade-off accepted: The other 11 staff lose the convenience of 'just opening it'. They must request access or go through the payroll team. This adds a small administrative step and a helpdesk burden, but it is the price of least privilege and accountability.
Why it works within constraints: It uses built-in group and permission features (no new software), and it matches the actual working pattern - payroll edits during the day, partner reviews Friday afternoon with read-only rights.