GDPR and Security: Appropriate Technical Measures

Under the GDPR, "appropriate technical and organisational measures" means security controls that are proportionate to the risk your processing creates for people, judged on the nature of the data, how you use it, what could go wrong and the cost and state of available technology. There is no fixed checklist in the law. In practice that means controlling access, encrypting where sensible, keeping systems patched, backing up and being able to restore, testing your defences, training staff, and having a process for breaches. This article explains what that looks like for a business in Ireland or the EU. It is general information, not legal advice, and the Data Protection Commission (DPC) is the Irish regulator whose guidance you should consult.

What the law actually says

Article 5 of the GDPR sets out principles, including that personal data must be processed securely, protecting against unauthorised or unlawful processing and against accidental loss, destruction or damage. Article 32, headed security of processing, asks controllers and processors to implement measures appropriate to the risk, taking account of the state of the art, the costs of implementation, and the nature, scope, context and purposes of processing, as well as the risks to individuals' rights and freedoms. It lists, as examples where appropriate:

• pseudonymisation and encryption of personal data;
• the ability to ensure ongoing confidentiality, integrity, availability and resilience of systems and services;
• the ability to restore availability and access to personal data in a timely manner after an incident;
• a process for regularly testing, assessing and evaluating the effectiveness of the measures.

Article 25 adds data protection by design and by default: build protection into systems from the start, and collect and expose only what is needed. Always read the actual text and the DPC's guidance, because wording and interpretation matter.

Technical measures versus organisational measures

The word "technical" tends to get the attention, but the law says technical and organisational. Technical measures are controls in systems; organisational measures are how people and processes work. You need both.

Technical measures	Organisational measures
Multi-factor authentication and strong access control	Policies for access, acceptable use and data handling
Encryption at rest and in transit	Staff awareness training and confidentiality commitments
Patching and secure configuration	Onboarding and offboarding procedures
Backups and tested restore	Supplier due diligence and data processing agreements
Logging and monitoring	Incident and breach response procedure
Network protection and endpoint security	Regular review, audit and record of decisions

A risk-based approach

"Appropriate" is a risk judgement, so document how you made it. A sensible method is:

1. Map your personal data. What do you hold, about whom, where is it stored and who can access it? Include backups, exports and third-party tools.
2. Assess the risk to individuals, not just to your business. What harm could result from loss, theft or misuse: financial loss, identity theft, distress, discrimination? Health, financial and children's data typically raise the bar.
3. Choose measures proportionate to that risk. A mailing list of newsletter subscribers differs from a database of medical or financial records.
4. Record the decisions and the reasons, so you can explain them to a regulator, customer or auditor.
5. Test and review regularly, and whenever something changes.

Where processing is likely to result in a high risk to individuals, a data protection impact assessment may be required. The DPC publishes guidance on when and how.

What good looks like in practice

Control who can access what

Give staff access only to the personal data they need, remove access promptly when roles change, and use MFA on systems holding personal data. Log access to the most sensitive records. See our MFA rollout guide.

Protect data in storage and movement

Encrypt laptops, phones and removable media, use HTTPS everywhere and encrypt backups. A lost encrypted device is generally a far smaller problem than a lost unencrypted one. See encryption at rest vs in transit.

Keep systems current and recoverable

Apply security updates, retire unsupported systems, and maintain backups with tested restores. The regulation's reference to restoring availability after an incident is essentially a requirement to be able to recover.

Minimise and delete

Data you do not hold cannot leak. Collect only what you need, set retention periods, and delete data when it is no longer required, including in old exports, test systems and archived mailboxes.

Manage suppliers

If a supplier processes personal data for you, you need a written agreement setting out security obligations, and reasonable checks that they meet them. Cloud tools, payroll providers and agencies all count.

Build security into software

If you develop applications that handle personal data, apply data protection by design: secure coding, testing, dependency management and least privilege. See secure SDLC basics and the OWASP Top 10 explainer.

Prepare for breaches

A personal data breach is a security incident that leads to accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data. Where a breach is likely to result in a risk to individuals, the controller must notify the supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware; high-risk breaches may also require informing the individuals affected. Keep an internal record of all breaches, even those you do not report. Have a procedure ready so you are not working out roles under pressure. Our ransomware response plan shows what such a procedure can include.

Demonstrating that you take it seriously

GDPR emphasises accountability: it is not enough to be careful, you should be able to show it. Keep a short record of your data map, risk assessment, policies, training dates, supplier agreements, test results and breach log. Periodic security audits provide dated, independent evidence that measures are tested and reviewed. No audit or certificate makes you automatically compliant, and no tool does either.

Proportionality in practice

A five-person design studio and a clinic holding patient records both owe security, but the measures will differ. The studio may be well served by MFA, encrypted laptops, a password manager, reliable backups and a short incident procedure. The clinic should add stricter access control and logging, tighter supplier checks, more frequent testing and a more formal risk assessment. Regulators generally expect that the more sensitive the data and the greater the possible harm, the stronger and better evidenced your measures are. Cost is a legitimate factor, but it is not an excuse to skip basic protections that are cheap and widely available.

Common mistakes

• Believing encryption equals compliance. It is one measure among many.
• Treating GDPR as a legal document exercise. Policies mean little if systems and behaviour do not match them.
• Not knowing where personal data lives. Spreadsheets, email and exports are often the weak point.
• No process for breach decisions. The 72-hour window is easy to miss without one.
• Forgetting processors. Your supplier's weakness can become your incident.
• Keeping data indefinitely. Old data is liability without benefit.

Where to get authoritative guidance

The Data Protection Commission publishes guidance for organisations, including on security, breach notification and impact assessments. The National Cyber Security Centre provides practical cyber security advice. For decisions with legal consequences, take advice from a qualified data protection or legal professional. Nothing in this article replaces that advice.

Next steps

Begin with a data map and a short risk assessment, then close the most significant technical gaps and record your reasoning. If you would like support with the technical side, our cybersecurity solutions include encryption, authentication, audits and threat monitoring, and we can discuss how they might fit your situation.