GDPR Article 32, explained
Article 32 requires both controllers and processors to "implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk". What is appropriate depends on the state of the art, the cost of implementation, the nature, scope, context and purposes of the processing, and how likely and how severe the risks to people are. Article 32(1) then lists four measures, to be used "as appropriate":
| Article 32(1) | What it says | What it usually means in practice |
|---|---|---|
| (a) | Pseudonymisation and encryption of personal data | Encryption at rest and in transit, managed keys, and pseudonymised data for analytics and testing |
| (b) | The ability to ensure the ongoing confidentiality, integrity, availability and resilience of processing systems and services | Access control with MFA, least privilege, hardening and patching, monitoring, and redundancy |
| (c) | The ability to restore the availability of and access to personal data in a timely manner after a physical or technical incident | Backups kept apart from production, restore tests, and a recovery plan with target times |
| (d) | A process for regularly testing, assessing and evaluating the effectiveness of the measures | Penetration testing, vulnerability scanning, control reviews and breach exercises |
The rest of the article: Article 32(2) says the level of security must reflect the risks of accidental or unlawful destruction, loss, alteration, unauthorised disclosure of or access to personal data. Article 32(3) lets an approved code of conduct or an approved certification mechanism count as one element of showing compliance. Article 32(4) requires that anyone with access to personal data processes it only on the controller's instructions.
How Article 32 maps to ISO 27001
ISO 27001 is not a GDPR certification mechanism, but its Annex A (2022) covers the same ground, which is why the two programmes share most of their evidence:
| Article 32 | ISO/IEC 27001:2022 Annex A controls |
|---|---|
| (1)(a) Encryption, pseudonymisation | 8.24 Use of cryptography; 8.11 Data masking |
| (1)(b) Confidentiality, integrity, availability, resilience | 5.15 Access control; 5.18 Access rights; 8.5 Secure authentication; 8.8 Management of technical vulnerabilities; 8.16 Monitoring activities; 8.14 Redundancy of information processing facilities |
| (1)(c) Restore after an incident | 8.13 Information backup; 5.29 Information security during disruption; 5.30 ICT readiness for business continuity |
| (1)(d) Regular testing | 8.29 Security testing in development and acceptance; 5.35 Independent review of information security; 5.36 Compliance with policies, rules and standards |
| (4) People act on instructions | 6.3 Information security awareness, education and training; 5.10 Acceptable use of information and other associated assets |
What regulators have fined companies for
In October 2020 the UK's Information Commissioner fined British Airways £20 million and Marriott International £18.4 million, in both cases for failing to keep personal data secure under Articles 5(1)(f) and 32. In Marriott's case the regulator named four failures: insufficient monitoring of privileged accounts, insufficient monitoring of databases, no server hardening, and some personal data, including some passport numbers, left unencrypted. Each one is an Article 32(1) measure: (a) encryption, (b) monitoring and hardening, and (d) the testing that would have exposed the gaps.
Article 33: the 72-hour clock depends on Article 32
After a personal data breach, the controller must notify the supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of it, unless the breach is unlikely to result in a risk to people's rights and freedoms. You can only meet that deadline if your monitoring notices the breach in the first place. More in our guide to the 72-hour breach notification clock.
An Article 32 checklist
- List the systems and stores that hold personal data, and who can reach them.
- Encrypt personal data at rest and in transit; control and rotate the keys.
- Use pseudonymised or masked data outside production.
- Enforce MFA and least privilege, and review access, especially privileged accounts.
- Harden and patch servers and applications on a schedule.
- Log and monitor access to personal-data stores, with alerts someone acts on.
- Back up separately from production, and test restores.
- Test effectiveness regularly: penetration tests, scans and control reviews.
- Rehearse breach response, so the 72-hour clock is achievable.
- Put security terms in every processor contract, and check processors keep them.
Sources: GDPR (Regulation (EU) 2016/679), Articles 32 and 33, EUR-Lex; ICO fines British Airways £20 million (Hunton, 16 October 2020); ICO fines Marriott £18.4 million (Hunton, October 2020). General information, not legal advice.