Which security principle restricts access to information to authorized individuals?

• A. Data Ownership
• B. Data Recovery
• C. Audit Trail
• D. Access Control

Answer: (D)

Access control is the security principle that ensures information is accessible only to people who have explicit permission. In a skincare setting, this means client records, treatment notes, and payment details are viewable or editable only by authorized staff. It directly addresses who can access data, helping protect client privacy and meet data-protection requirements.

Data ownership is about who owns the data and who decides how it’s used, not who can access it. Data recovery concerns restoring information after a loss or failure, not restricting access. An audit trail records who accessed data and what actions they took, which supports accountability but does not itself restrict access. In practice, you implement access control through authenticated logins, role-based permissions, and the principle of least privilege.