Technical and organisational measures for personal data protection in practice

What the “appropriate technical and organisational measures” of Article 32 GDPR mean and which concrete measures every company should have.

OfSec 2 min read

Article 32 GDPR requires controllers and processors of personal data to implement “appropriate technical and organisational measures” for security. The Regulation contains no exhaustive list. The measures depend on the risk, the type of data, the cost and the state of the art. In an inspection or after an incident, however, the same core measures are looked for.

The examples in the Regulation

Article 32 mentions:

  • pseudonymisation and encryption of personal data;
  • the ability to ensure the confidentiality, integrity, availability and resilience of systems;
  • the ability to restore the availability of and access to data in a timely manner after an incident;
  • regular testing and evaluation of the effectiveness of the measures.

Technical measures

Access control

Every employee has their own account and access only to the data needed for their work. Administrator rights are limited to as few people as possible. Multi-factor authentication is mandatory for email, cloud services and remote access.

Encryption

Laptops and mobile devices have encrypted disks (BitLocker, FileVault). The website and email use TLS. Backups are encrypted as well.

Backups

Backups run automatically and are kept outside the main network. Restoring is tested regularly, for example once a quarter.

Updates

Operating systems, browsers, the website and its plugins are updated regularly. Systems no longer supported by the vendor are replaced.

Logging and monitoring

Logins and access to data are recorded. Logs are kept long enough for an incident to be investigated.

Network

Guests use a separate Wi-Fi network. Remote access goes through a VPN rather than directly exposed ports.

Organisational measures

  • internal rules for data protection and for the use of company devices;
  • staff training, including recognising phishing;
  • a breach procedure with named responsibilities;
  • contracts with processors (accounting, hosting, IT support) under Article 28 GDPR;
  • regular reviews of access rights, especially when an employee leaves;
  • a record of processing activities.

Evaluating effectiveness

The Regulation also requires the effectiveness of the measures to be evaluated regularly. An independent technical audit or a penetration test shows whether the measures work in practice and produces a document that can be presented during an inspection by the data protection authority.

GDPRData protection