A subject accesses, views, searches, queries, retrieves, or otherwise examines organizational data without a legitimate business purpose or authorization to do so. The subject may use their own valid account and may possess the technical permissions required to access the data; however, the access falls outside their approved role, assigned duties, operational need, or other authorized purpose.

Unauthorized Data Access may involve customer records, employee information, commercially sensitive material, security information, investigative records, financial data, intellectual property, or other restricted organizational information. Examples include accessing the records of colleagues, acquaintances, public figures, or customers without a business requirement; searching sensitive datasets out of curiosity or personal interest; or reviewing information for an external, financial, or otherwise unauthorized purpose.

The infringement occurs through the unauthorized access itself and does not require the subject to modify, disclose, copy, or exfiltrate the information. Where the subject subsequently transfers, exposes, alters, or otherwise misuses the accessed data, additional Infringement Sections or Sub-sections may also apply.

Subsections (4)

ID	Name	Description
IF045.001	Unauthorized Access to Customer Data	A subject accesses, views, searches, queries, or retrieves customer data without a legitimate business purpose or authorization to do so. The subject may possess valid technical access to the relevant system or dataset but uses that access outside the requirements of their role, assigned duties, customer relationships, cases, transactions, or other approved activity. Customer data may include personally identifiable information, account details, transactional records, financial information, support interactions, communications, location information, or other information relating to customers, clients, patients, subscribers, or account holders. The infringement occurs through the unauthorized access itself and does not require the information to be subsequently disclosed, modified, copied, or exfiltrated.
IF045.003	Unauthorized Access to Sensitive Organizational Data	A subject accesses, views, searches, queries, or retrieves sensitive organizational data without a legitimate business purpose or authorization to do so. The subject may possess valid technical access to the relevant system, repository, or dataset but uses that access outside the requirements of their role, assigned responsibilities, project involvement, or other approved activity. Sensitive organizational data may include intellectual property, financial information, strategic plans, merger and acquisition material, legal information, internal investigations, security documentation, detection logic, source code, research data, executive communications, or other information whose confidentiality is important to the organization.
IF045.004	Unauthorized Access to Third-Party Data	A subject accesses, views, searches, queries, or retrieves data belonging to, supplied by, or maintained on behalf of a third party without a legitimate business purpose or authorization to do so. The subject may possess valid technical access to the relevant system or dataset but uses that access outside the requirements of their role, assigned duties, contractual responsibilities, or other approved activity. Third-party data may include information relating to suppliers, vendors, business partners, applicants, professional advisers, counterparties, acquisition targets, or other external parties. The infringement occurs through the unauthorized access itself, regardless of whether the information is subsequently disclosed, altered, copied, or exfiltrated.
IF045.002	Unauthorized Access to Workforce Data	A subject accesses, views, searches, queries, or retrieves information relating to members of the organization’s workforce without a legitimate business purpose or authorization to do so. The subject may possess valid technical access to the relevant system or dataset but uses that access outside the requirements of their role, assigned duties, casework, management responsibilities, or other approved activity. Workforce data may relate to employees, contractors, consultants, temporary workers, secondees, or other individuals working for or on behalf of the organization. This may include personnel records, payroll and compensation data, performance or disciplinary records, absence or medical information, internal communications, security records, investigation material, or other information relating to an identifiable member of the workforce.

Preventions (7)

Detections (10)