Does the GDPR prescribe exactly which security measures I must take?

No. Paragraph 1 asks for appropriate measures, matched to the risk, the state of the art, the costs and the nature of the processing. The article does give examples, such as encryption, pseudonymisation, restoration after an incident and regular testing (paragraph 1(a) to (d)). Recital 83 adds that you first evaluate the risks inherent in the processing and then choose measures that mitigate those risks.

Is encryption mandatory?

Encryption is one of the examples in paragraph 1(a), with the qualifier as appropriate. Whether it is appropriate depends on the risk assessment in paragraph 2: the greater the likelihood and severity of damage from loss or unauthorised access, the more weight this measure carries. The article leaves that choice, and the reasoning behind it, to the controller and the processor.

Does this article also apply to my processor, or only to me as the controller?

To both, directly. Paragraphs 1 and 4 name the controller and the processor side by side, so the processor has its own security obligation. In addition, Article 28(3)(c) requires you to stipulate in the data processing agreement that the processor takes all the measures required under Article 32.

Article 32: Security of processingAI-relevant

Praxikon tracks Article 32 (Security of processing) under the GDPR, alongside the EU AI Act, citing the source for every statement.

Chapter IVIn force since 25-05-2018

Article 32 requires both the controller and the processor to secure personal data appropriately. What is appropriate depends on the state of the art, the costs, the nature and scope of the processing and the risks to the people concerned (paragraph 1). The article gives examples of measures: pseudonymisation and encryption, ensuring the ongoing confidentiality, integrity, availability and resilience of systems, timely restoration after an incident and regular testing of the measures (paragraph 1(a) to (d)). In deciding the level of security you look in particular at the risks of destruction, loss, alteration, unauthorised disclosure or unauthorised access (paragraph 2); recital 83 explains that such incidents can lead to physical, material or non-material damage to people. Anyone acting under the authority of the organisation with access to personal data may process them only on instructions from the controller (paragraph 4); if something goes wrong despite these measures, Articles 33 and 34 set out what you must report.

Key term: Risk-based security: the level of security must match the likelihood and severity of the risks to the people concerned (paragraphs 1 and 2)

Directly affects:controllerprocessor

Praxikon’s reading of the text and the recitals; the official text below prevails.

AI Act intersection

Security of processing overlaps with AI Act cybersecurity requirements (Art. 15(4) and (5)).

AI Act Art. 15 →

Official text

Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, the controller and the processor shall implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including inter alia as appropriate: (a) the pseudonymisation and encryption of personal data; (b) the ability to ensure the ongoing confidentiality, integrity, availability and resilience of processing systems and services; (c) the ability to restore the availability and access to personal data in a timely manner in the event of a physical or technical incident; (d) a process for regularly testing, assessing and evaluating the effectiveness of technical and organisational measures for ensuring the security of the processing.

In assessing the appropriate level of security account shall be taken in particular of the risks that are presented by processing, in particular from accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to personal data transmitted, stored or otherwise processed.

Adherence to an approved code of conduct as referred to in Article 40 or an approved certification mechanism as referred to in Article 42 may be used as an element by which to demonstrate compliance with the requirements set out in paragraph 1 of this Article.

The controller and processor shall take steps to ensure that any natural person acting under the authority of the controller or the processor who has access to personal data does not process them except on instructions from the controller, unless he or she is required to do so by Union or Member State law.

Source: EUR-Lex, Regulation (EU) 2016/679. Official text, reproduced without modification.

What does this mean for you?

Controller

Assess for each processing activity what the risks are for the data subjects and record which technical and organisational measures fit those risks (paragraphs 1 and 2). Think of encryption, pseudonymisation, backups that make restoration possible and a fixed rhythm of testing (paragraph 1(a) to (d)). Make sure that staff, including for example staff who enter personal data into an AI tool, process those data only on your instructions (paragraph 4).

Processor

The same security obligation rests directly on you, not only through the contract with the controller (paragraph 1). Assess the risks of the processing you carry out (paragraph 2) and make sure your staff with access to personal data act only on instructions from the controller (paragraph 4).

Compliance checklist

For each processing activity the risks to the rights and freedoms of natural persons have been assessed, with attention to destruction, loss, alteration, unauthorised disclosure and unauthorised access (paragraph 2).The chosen technical and organisational measures are matched to those risks, the state of the art, the costs of implementation and the nature, scope, context and purposes of the processing (paragraph 1).Where appropriate, personal data are pseudonymised or encrypted (paragraph 1(a)).The processing systems and services can ensure ongoing confidentiality, integrity, availability and resilience (paragraph 1(b)).After a physical or technical incident, the availability of and access to personal data can be restored in a timely manner (paragraph 1(c)).There is a process for regularly testing, assessing and evaluating the effectiveness of the security measures (paragraph 1(d)).Anyone acting under the authority of the controller or the processor with access to personal data processes them only on instructions from the controller, unless required otherwise by law (paragraph 4).

Related recitals

(83)

In order to maintain security and to prevent processing in infringement of this Regulation, the controller or processor should evaluate the risks inherent in the processing and implement measures to m...

Cross-references

Art. 40: Codes of conduct Art. 42: Certification

Frequently asked questions

← Art. 31: Cooperation with the supervisory authority Art. 33: Notification of a personal data breach to the supervisory authority →

Connections

Themes where this returns

Security and robustness

The counterpart in the other law