Time data protection requires which of the following?

• A. Time data is public
• B. Access to time data is restricted to administrators
• C. Access to time data is restricted to personnel with a business need
• D. Time data is stored offline only

Answer: (C)

Access to time data should be restricted to people who need it to do their job. This reflects the principle of least privilege and need-to-know: only roles that require time data for their work get access, and access is reviewed and revoked when no longer needed. This minimizes the chance of exposure or misuse and aligns with PCI DSS guidance to limit access to cardholder data by business need-to-know.

If time data were public, it would undermine confidentiality and increase risk. Limiting access only to administrators is too narrow, excluding other legitimate roles that must work with the data. Storing data offline only isn’t a requirement for protecting access; it addresses storage method rather than who can access the data.