Which security measures does the GDPR require?

Direct answer · GDPR

Security of processing

The controller and the processor implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk (Article 32(1)). What is appropriate depends on the state of the art, the costs of implementation, the nature, scope, context and purposes of the processing, and the likelihood and severity of the risks to people. As appropriate, this includes pseudonymisation and encryption, the ability to ensure the ongoing confidentiality, integrity, availability and resilience of systems and services, the ability to restore access to the data in a timely manner after an incident, and a process for regularly testing and evaluating the measures (Article 32(1)(a) to (d)). The assessment takes particular account of the risk of destruction, loss, alteration, unauthorised disclosure of or access to data (Article 32(2)). This follows from the principle of integrity and confidentiality (Article 5(1)(f)). The Court of Justice held in Natsionalna agentsia za prihodite that a successful hack does not in itself prove that the measures fell short: the court assesses them concretely against the risks, and in a damages claim the controller must prove that they were appropriate. In MediaMarktSaturn the Court held the same for a document that employees handed to a third party by mistake.