A key element in any security system is ensuring that only persons who should have access to something (whether physical premises or data) are able to obtain access to that thing. This article looks at some security measures in the context of decisions by the Personal Data Protection Commission, and how well they have fared.