GDPR and IT: technical and organisational measures
Article 32 GDPR requires "appropriate" technical and organisational measures (TOMs). What that means in IT in practice and how to document it traceably.
Controllers must ensure the security of processing personal data through suitable measures. The yardstick is the state of the art, implementation costs, the nature and scope of processing and the risk to data subjects. There is no fixed checklist but there are typical building blocks.
Typical measures
Physical access control: protecting rooms and servers.
System and data access control: user accounts, password rules, MFA, permission concept.
Transfer control: encryption in transit and at rest.
Availability and resilience: backup, emergency plan, redundancy.
Separation: keep data for different purposes or clients apart.
Logging: trace who accessed what and when.
Effectiveness checks: regular tests and review of measures.
Documentation
A TOM list describes each measure briefly and verifiably: what is done, who is responsible, when it was last reviewed. It is part of the record of processing activities and the basis for data processing agreements. This article is not legal advice; for legal assessment turn to data protection officers or specialist lawyers.
TOMs GDPRArt. 32 GDPRtechnical organisational measuresdata protection IT
Frequently asked questions
What are TOMs?
Technical and organisational measures with which companies protect personal data, such as access control, encryption, backup and training.
Do TOMs have to be documented?
Yes, the measures must be demonstrable. In practice this is done through a TOM list that is reviewed regularly.
Which IT measures count?
Among others MFA, permission concept, encryption, backups, logging, updates and an emergency plan.