• In the full Eventbase client record keeping system, as well as basic name and date of birth data there is more confidential and sensitive information held about the clients including addresses, credit card data, health/accessibility requirements (to be able to advise on location accessibility and/or event first aid facilities), car registration details for car-park booking, and so on.

  Eventbase exchange data with outside companies for some of the services they arrange for their clients. For example:

• when they send brochures to clients they send the name and address data to a bulk mailing company,
• when a client books car-parking at a location, the local car-park management company are sent the client name and car registration data for that event.

• When obtaining GDPR permissions, the clients are informed that Eventbase will hold all client data securely on their data servers and itemise the specific data items that will be shared with outside companies.

Considering the security and data management facilities for relational databases presented in this module, describe how the company could ensure the client information can be adequately protected.

Your description should consider the full client table (which would contain all the details of their clients) and how only selected data can be made available to the applications and users that share data with the outside companies. You should assume that different users (marketing, sales, event handling, etc.) should only be given access to the data relevant to their roles within Eventbase.

You should draw on the principle of least privilege and the rules for controlled sharing when answering this question.