DrewTech Chapter 16: Speak, friend, and enter - access controls and authorised users 28 May 2025 A key element in any security system is ensuring that only persons who should have access to something (whether physical premises or data) are able to obtain access to that thing. This article looks at some security measures in the context of decisions by the Personal Data Protection Commission, and how well they have fared. Please click here to read more about the update. If you missed any of the chapters in our DrewTech series, you can read them below: Chapter 1: The Importance of an Exit Strategy in Tech Contracts Chapter 2: Employees, technology and a legal hangover - bring your own problems? Chapter 3: I host, you post, I get sued? Chapter 4: Diabolus ex machina - Artificial (un)Intelligence and liability Chapter 5: Bringing Hygiene Online - The MAS Notice on Cyber Hygiene Chapter 6: Signing without signing – contactless contracts Chapter 7: My Kingdom for a Horse – When your Systems are Held to Ransom Chapter 8: New risks in new skins - Updates to the Guidelines on Risk Management Practices – Technology Risk Chapter 9: Of blockchains and stumbling blocks Chapter 10: Service by airdrop - no parachutes required Chapter 11: Large language models and larger legal minefields Chapter 12: Beset on all sides – liability for data breaches Chapter 13: Pitfalls of user-generated content Chapter 14: Red queen races – vulnerability disclosure programs Chapter 15: Looking at the man in the middle (in a cyber breach) – allocation of risk