A chronological record of who accessed, modified, or deleted data, when, and from where — used for accountability, security monitoring, and compliance.
An audit trail (also called an audit log) captures a history of data access and changes. It records events such as: who logged in, what records they viewed or modified, what changes were made, and when. Audit trails are essential for detecting unauthorized access, investigating incidents, and demonstrating compliance with regulations.
Example: A health information system maintains an audit trail for every patient record. When a nurse accesses a patient's file, the system logs the nurse's user ID, the patient record accessed, the date and time, and the type of access (view, edit, print). If a patient later complains that their record was accessed without authorization, the audit trail provides the evidence needed to investigate.
Audit trails must themselves be protected from tampering — an audit log that can be modified is not a reliable record of what happened.