Skip to content 
Need-to-know-Prinzip
Not everyone in the company needs to know everything. What sounds self-evident in everyday life is a firm principle with clear rules in information security. It applies to personnel files just as much as to classified information – and to the old devices on which this data still resides.
In brief
The need-to-know principle (German: Kenntnis nur, wenn nötig) is a principle of information security under which a person may only access the information they need for their specific task. It limits the circle of those in the know and thus the risk of misuse and data leakage. In IT decommissioning, it determines who gets access to old devices, data carriers and erasure proofs.
What does need-to-know mean?
The principle comes from state secrecy protection. For classified information it applies in Germany that only persons may be given knowledge who need it to perform their duties. A security clearance or a senior position alone is not enough.
In companies, need-to-know is a standard building block today. The ISO/IEC 27001 standard requires access rules that are based on business requirements. The GDPR requires protection against unauthorized access with the principle of confidentiality (Art. 5(1)(f)) and with the technical and organizational measures under Art. 32, protection against unauthorized access.
Distinction from similar principles
| Principle | Question behind it | Example |
|---|---|---|
| Need-to-know | Which information does this person need for their task? | Accounting sees invoices, but not sick notes. |
| Least privilege (minimal rights) | What technical rights does this account need at a minimum? | A service account may only read, not write. |
| Four-eyes principle | Who monitors critical processes? | A second person confirms the release for destruction. |
| Segregation of duties | Which tasks must not rest in one hand? | Whoever books devices out does not themselves sign off the handover. |
Need-to-know in IT decommissioning
Old devices are an often overlooked gap. If laptops sit in an open storage area, any employee can access them, even if they should never have seen the data. The principle can be implemented simply here:
- Collect old devices in a locked room with Access control .
- Only named persons may pack and hand over devices and sign reports.
- At the service provider, only employees responsible for erasure or destruction have access to data carriers.
- Erasure and destruction certificates go to a fixed contact person, not to an open distribution list.
For public authorities and those subject to classified-information protection, additional requirements apply to disposal. More on this in the guide VS-NfD: decommissioning IT hardware.
A common mistake: old devices are placed in a hallway for pickup so that the courier can find them more easily. For a few hours, cleaning staff, visitors and employees from other departments then have access. Plan the handover directly from the secured room.
Rule of thumb: need-to-know does not ask "Who may?" but "Who must?". Every person without a concrete need stays out.
Need-to-know at Second IT
Second IT processes data carriers in areas with access control and video surveillance. All employees are committed to data secrecy or confidentiality; individual NDAs are added on request. Processing according to VS-NfD requirements is possible. More about Data secrecy and confidentiality.
Frequently asked questions about the need-to-know principle
Is the need-to-know principle required by law?
For classified information, yes, through the Classified Information Directive (Verschlusssachenanweisung). For companies, it follows indirectly from the GDPR, which requires appropriate protection against unauthorized access. Standards such as ISO/IEC 27001 make it a requirement.
Does need-to-know also apply to managers?
Yes. What matters is the task, not the hierarchy. A managing director does not automatically need insight into every personnel file or every data carrier.
How do I implement the principle technically?
Through role and permission concepts, groups in the directory service, encryption and regular review of permissions. Physically, locked rooms, access logs and clear responsibilities help.
What is the difference between need-to-know and least privilege?
Need-to-know asks which information a person needs for their task. Least privilege asks which technical rights an account needs at a minimum. One limits the circle of knowledge, the other the system rights. The two complement each other.
How do I protect old devices before pickup according to the need-to-know principle?
Collect the devices in a locked room with access control. Only named persons pack and hand them over. Never place old devices in a hallway for pickup, because visitors and other departments have access there.
Data carriers only in authorized hands – from pickup to certificate.
Send us your device list. You will receive your offer in 48 hours on average.