Anyway to create a SQL Server DDL trigger for "SELECT" statements?

Yes, it is possible by creating an Event Notification on the AUDIT_DATABASE_OBJECT_ACCESS_EVENT event. The cost of doing something like this would be overwhelming though.

It is much better to use the audit infrastructure, or using custom access wrapper as gbn recommends.

You have 3 options:

• allow access via stored procedures if you want to log (and remove table rights)
• hide the table behind a view if you want to restrict and keep "direct" access
• run a permanent trace

I'd go for options 1 or 2 because they are part of your application and self contained.

Although, this does sound a bit late to start logging: access to the table should have been restricted up front.

Also, any solution fails if end users do not correct directly (eg via web server or service account). Unless you use stored procs to send in the end user name...

View example:

CREATE VIEW dbo.MyTableMaskASSELECT *FROM    MyTable    CROSS JOIN    (SELECT 1 FROM SecurityList WHERE name = SUSER_SNAME())--WHERE could use NOT EXISTS too with tableGO

    --In the master database create a server auditUSE masterGOCREATE SERVER AUDIT [Audit_Select_HumanResources_Employee]TO FILE(     FILEPATH = N'C:\Program Files\Microsoft SQL Server\MSSQL12.MSSQLSERVER\MSSQL\Backup'      ,MAXSIZE = 0 MB      ,MAX_ROLLOVER_FILES = 2147483647      ,RESERVE_DISK_SPACE = OFF)WITH(QUEUE_DELAY = 1000, state=  on)ALTER SERVER AUDIT Audit_Select_HumanResources_Employee WITH (STATE = ON) ;GO--In the database to monitor create a database auditUSE [AdventureWorks2012]goCREATE DATABASE AUDIT SPECIFICATION [Database-Audit]FOR SERVER AUDIT [Audit_Select_HumanResources_Employee]--In this example, we are monitoring the humanResources.employeeADD (SELECT ON OBJECT::[HumanResources].[Employee] BY [dbo])with (state=on)--Now you can see the activity in the audit file createdSELECT * FROM sys.fn_get_audit_file ('c:\Program Files\Microsoft SQL Server\MSSQL12.MSSQLSERVER\MSSQL\Backup\Audit_Select_HumanResources_Employee.sqlaudit',default,default);GO

I just added some code for you. The code creates a server audit, a database audit for select activities and finally the sys.fn_get_audit_file is used to retrieve the information from the file. You have to do that individually for each table. If you want a more automated query, you can use other tools like Apex SQL Audit or other third party tool of your preference.