diff --git a/dspace-server-webapp/src/main/java/org/dspace/app/rest/repository/ProcessRestRepository.java b/dspace-server-webapp/src/main/java/org/dspace/app/rest/repository/ProcessRestRepository.java
index 4c0bbf5e160..3ae8600f83a 100644
--- a/dspace-server-webapp/src/main/java/org/dspace/app/rest/repository/ProcessRestRepository.java
+++ b/dspace-server-webapp/src/main/java/org/dspace/app/rest/repository/ProcessRestRepository.java
@@ -164,12 +164,13 @@ public BitstreamRest getProcessBitstreamByType(Integer processId, String type)
     }
 
     @Override
-    protected void delete(Context context, Integer integer)
+    @PreAuthorize("hasPermission(#id, 'PROCESS', 'DELETE')")
+    protected void delete(Context context, Integer id)
         throws AuthorizeException, RepositoryMethodNotImplementedException {
         try {
-            processService.delete(context, processService.find(context, integer));
+            processService.delete(context, processService.find(context, id));
         } catch (SQLException | IOException e) {
-            log.error("Something went wrong trying to find Process with id: " + integer, e);
+            log.error("Something went wrong trying to find Process with id: " + id, e);
             throw new RuntimeException(e.getMessage(), e);
         }
     }
diff --git a/dspace-server-webapp/src/test/java/org/dspace/app/rest/ProcessRestRepositoryIT.java b/dspace-server-webapp/src/test/java/org/dspace/app/rest/ProcessRestRepositoryIT.java
index 6c018df6d07..e95d5b9a0cb 100644
--- a/dspace-server-webapp/src/test/java/org/dspace/app/rest/ProcessRestRepositoryIT.java
+++ b/dspace-server-webapp/src/test/java/org/dspace/app/rest/ProcessRestRepositoryIT.java
@@ -12,6 +12,7 @@
 import static org.hamcrest.Matchers.contains;
 import static org.hamcrest.Matchers.containsInAnyOrder;
 import static org.hamcrest.Matchers.is;
+import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.delete;
 import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.get;
 import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.jsonPath;
 import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.status;
@@ -126,6 +127,41 @@ public void getProcessForDifferentUserForbiddenException() throws Exception {
 
     }
 
+    @Test
+    public void deleteProcessAdmin() throws Exception {
+        // "process" (from setup) is SCHEDULED with no bitstreams - the exact shape that
+        // previously bypassed authorization entirely.
+        String token = getAuthToken(admin.getEmail(), password);
+
+        getClient(token).perform(delete("/api/system/processes/" + process.getID()))
+                        .andExpect(status().isNoContent());
+
+        getClient(token).perform(get("/api/system/processes/" + process.getID()))
+                        .andExpect(status().isNotFound());
+    }
+
+    @Test
+    public void deleteProcessAnonymousUnauthorizedException() throws Exception {
+        getClient().perform(delete("/api/system/processes/" + process.getID()))
+                   .andExpect(status().isUnauthorized());
+
+        String token = getAuthToken(admin.getEmail(), password);
+        getClient(token).perform(get("/api/system/processes/" + process.getID()))
+                        .andExpect(status().isOk());
+    }
+
+    @Test
+    public void deleteProcessForDifferentUserForbiddenException() throws Exception {
+        String token = getAuthToken(eperson.getEmail(), password);
+
+        getClient(token).perform(delete("/api/system/processes/" + process.getID()))
+                        .andExpect(status().isForbidden());
+
+        String adminToken = getAuthToken(admin.getEmail(), password);
+        getClient(adminToken).perform(get("/api/system/processes/" + process.getID()))
+                             .andExpect(status().isOk());
+    }
+
     @Test
     public void getProcessNotExisting() throws Exception {
         String token = getAuthToken(eperson.getEmail(), password);