Regulation & Compliance
GDPR & IT Security: Technical Measures under Art. 32
The GDPR is not purely a data protection topic - it imposes concrete requirements on your IT security. Art. 32 obliges organisations to implement demonstrable technical and organisational measures (TOMs). Ignoring this exposes you to fines of up to EUR 20 million or 4% of global annual turnover.
- Maximum fine
- EUR 20M
- Technical measures
- Art. 32
- Breach notification
- 72h
- of global annual turnover
- 4%
Fundamentals
GDPR and IT Security: Why data protection requires technical security
The General Data Protection Regulation (Regulation EU 2016/679) has applied directly in all EU member states since 25 May 2018. It protects the fundamental rights of natural persons in the processing of their personal data. What many organisations underestimate: the GDPR contains concrete security requirements that go far beyond a privacy policy on a website.
Data breaches arise almost exclusively from IT vulnerabilities: unprotected databases, missing encryption, inadequate access management, successful phishing attacks or unpatched weaknesses. The GDPR holds the controller liable for these vulnerabilities - with significant fine exposure.
Crucially, the GDPR does not prescribe specific technologies but requires a risk-based approach. The measures implemented must be appropriate to the risk to the individuals concerned - meaning organisations must know and systematically mitigate the risks of their processing activities.
Art. 32 GDPR
Technical and Organisational Measures (TOMs): What your organisation must implement
Art. 32 GDPR specifies four explicit technical measures and additionally requires a risk-based approach. The following areas are directly relevant for every organisation that processes personal data.
Encryption
Personal data must be encrypted at rest (databases, backups) and in transit (TLS 1.2+, HTTPS). AES-256 for stored data, proper certificate management, no weak cipher suites.
Pseudonymisation
Separation of identifying attributes and content data by technical measures. Re-identification only possible with a separately and securely stored key. Reduces fine exposure in the event of a data breach.
Resilience of systems
Ongoing assurance of confidentiality, integrity and availability. Redundancy concepts, DDoS protection, high-availability architectures. No single points of failure for critical systems.
Recoverability
Ability to restore availability and access to personal data in a timely manner following an incident. Tested backup concepts (3-2-1 rule), documented recovery procedures, regular restore tests.
Regular testing
A process for regularly testing, assessing and evaluating the effectiveness of the TOMs. Penetration tests, vulnerability scans, internal audits and risk reviews are recognised methods.
Access & authorisation control
Role-based access control (RBAC), multi-factor authentication for sensitive systems, regular access reviews, secure password management and comprehensive access logging.
Art. 35 GDPR
Data Protection Impact Assessment (DPIA)
A Data Protection Impact Assessment (DPIA) under Art. 35 GDPR is a structured risk analysis that must be carried out before certain processing activities are commenced. It is methodologically comparable to an IT security risk assessment - and therefore benefits significantly from security expertise.
Each EU supervisory authority publishes a list of processing types that always require a DPIA - including systematic profiling, biometric processing and the use of new technologies involving health data. Beyond these lists, the obligation applies whenever processing is likely to result in a high risk to individuals.
A DPIA must at minimum contain: a systematic description of the processing, an assessment of the necessity and proportionality, an assessment of risks to data subjects, and the measures envisaged to address the risks. An inadequate or missing DPIA is itself subject to fines.
When is a DPIA mandatory?
- Systematic and extensive evaluation of personal aspects by automated processing, including profiling with significant effects on individuals
- Large-scale processing of special categories of data (Art. 9 GDPR: health, religion, ethnicity, political opinions, biometric data)
- Systematic large-scale monitoring of publicly accessible areas (e.g. video surveillance)
- Use of new technologies with insufficiently known risk profiles (AI, IoT, behavioural analytics)
- Processing data of vulnerable individuals (children, employees under employer surveillance)
- Matching or combining datasets from different sources
- Processing biometric or genetic data for unique identification
Source: Art. 35(4) GDPR requires each supervisory authority to establish and publish a list of processing operations subject to the DPIA requirement. See your national supervisory authority's published list for jurisdiction-specific guidance.
Art. 33 & 34 GDPR
Data breach notification obligations
When a personal data breach occurs, the 72-hour clock starts from the moment of discovery. Without prepared incident response processes, meeting this deadline is nearly impossible.
Notify supervisory authority
- Nature and extent of the breach
- Categories of personal data affected
- Approximate number of individuals affected
- Contact details of the DPO
- Likely consequences of the breach
- Measures taken or proposed to address it
Art. 33 GDPR - Report to your lead supervisory authority (or local authority for domestic breaches)
Notify affected individuals
- Only where high risk to individuals exists
- In clear and plain language
- Description of the nature of the breach
- Contact details of the DPO
- Likely consequences
- Recommendations for individuals to mitigate risk
Art. 34 GDPR - Exception applies where affected data was effectively encrypted
Internal documentation
- Full documentation of all breaches
- Record even non-notifiable incidents
- Root cause analysis and remediation measures
- Basis for decision on notification obligation
- Evidence for supervisory authorities
- Retain for at least 3 years
Art. 33(5) GDPR - Accountability principle under Art. 5(2)
Enforcement
GDPR fines and enforcement cases
EU supervisory authorities have imposed significant fines since 2018. These cases illustrate which technical deficiencies most commonly lead to sanctions.
Deutsche Wohnen SE
Archiving system without the ability to delete tenant data that was no longer necessary. Personal data was retained beyond its required retention period, with no technical mechanism for deletion.
Notebooksbilliger.de
Video surveillance of employees without adequate legal basis - for over six years. Absence of purpose limitation and proportionality. A case study in unlawful systematic monitoring of workers.
1&1 Telecom GmbH
Inadequate authentication in the call centre: customers' data could be accessed simply by providing a name and date of birth - without sufficient identity verification. Direct Art. 32 violation.
Bochum retailer
Unencrypted storage of customer data on a server with insufficient access controls. Data breach caused by misconfiguration, with delayed notification to the supervisory authority.
AWARE7 Services
How AWARE7 supports GDPR compliance
GDPR compliance requires technical know-how, not just legal knowledge. Our cybersecurity specialists address exactly the technical requirements that Art. 32 GDPR prescribes.
Penetration Testing
Regular penetration tests directly fulfil the Art. 32(1)(d) obligation to test the effectiveness of TOMs. We uncover vulnerabilities before they lead to notifiable data breaches.
ISMS / ISO 27001
An ISO-27001-conformant information security management system systematically addresses all key Art. 32 requirements and provides documented evidence of TOMs for supervisory authorities.
Vulnerability Scanning
Automated, regular vulnerability scans complement manual penetration tests and ensure continuous monitoring of IT systems at manageable cost.
Security Awareness Training
Over 90% of data breaches start with human error. Our training programmes and phishing simulations demonstrably reduce risk and strengthen TOMs in the area of staff awareness.
Privacy by Design Consulting
We support the technical implementation of Privacy by Design and Default, secure architecture design and the selection of appropriate cryptographic controls.
SME Security Analysis
For organisations without a dedicated security team: a structured assessment of your GDPR security posture with a concrete action plan, clearly prioritised by risk exposure.
Why AWARE7 for GDPR compliance
What sets us apart from other providers
Pure awareness platforms don't test systems. Pure consulting firms are too far removed. AWARE7 combines both: we hack your infrastructure and train your employees: tailored to mid-sized companies, personal, without enterprise overhead.
Research and teaching as our foundation
20 %Around 20% of our revenue comes from research projects for the BSI and the BMBF. Our studies, published at ACM and Springer conferences, analyse millions of websites and tens of thousands of phishing emails. Three of our executives are professors at German universities at the same time.
Digital sovereignty: no compromises
100 %All data is stored and processed exclusively in Germany, without US cloud providers. All staff are permanently employed, covered by social insurance and bound by uniform legal obligations.
Fixed price within 24h: predictable project timelines
24 hWithin 24 hours you receive a binding fixed-price quote without hourly rate risk. A well-practised team and standardised processes ensure a clear schedule with a defined start and end date.
Your dedicated contact
1:1A personal project manager accompanies you from the first meeting to the retest. You book appointments directly with your contact person and keep the same contact throughout the project.
Peer-reviewed publications
Different Seas, Different Phishes - Large-Scale Analysis of Phishing Simulations
ACM AsiaCCS 2025
Oskar Braun, Jan Hörnemann, Norbert Pohlmann, Matteo Große-Kampmann
A Platform for Physiological and Behavioral Security
NSPW 2025
Jan Hörnemann
Privacy from 5 PM to 6 AM: Tracking and Transparency in the HbbTV Ecosystem
IEEE/IFIP DSN 2025
Jan Hörnemann, Norbert Pohlmann, Matteo Große-Kampmann
Understanding Regional Filter Lists: Efficacy and Impact
PoPETS 2025
Jan Hörnemann, Norbert Pohlmann, Matteo Große-Kampmann
Who is AWARE7 the right partner for?
Mid-sized companies with 50-2,000 employees
Companies that need real security, without paying for a DAX-corporation provider. Fixed price, clear scope, one point of contact.
IT managers & CISOs
Who have to argue convincingly in-house and need a report in boardroom language for that, not just technical findings.
Regulated industries
Critical infrastructure, healthcare, financial services: NIS-2, ISO 27001, DORA. We know the requirements and deliver evidence that auditors accept.
„Art. 32 GDPR is systematically underestimated by many organisations. It does not prescribe specific technologies - but it does require demonstrable, risk-based security measures. Ignoring this creates not just legal liability, but genuine responsibility towards the individuals whose data you process.“
Jan Hornemann
Researcher in Privacy and GDPR · AWARE7 GmbH
Frequently asked questions about GDPR
Answers to the most common questions about GDPR compliance and technical security measures.
What does Art. 32 GDPR require from organisations?
What is a Data Protection Impact Assessment (DPIA) and when is it mandatory?
What fines can be imposed for GDPR violations?
What must be done within 72 hours in the event of a data breach?
Do we need to appoint a Data Protection Officer (DPO)?
What is Privacy by Design and what does it require technically?
How does GDPR relate to information security (ISO 27001)?
Is penetration testing relevant for GDPR compliance?
Aus dem Blog
Weiterführende Artikel
Der Informationssicherheitsbeauftragte - Zuständigkeiten und Aufgaben!
Der Informationssicherheitsbeauftragte ist der Ansprechpartner für Informationssicherheit im Unternehmen. Diese Aufgaben hat er!
Jan Hörnemann 
DSGVO-Compliance: Anforderungen, Bußgelder und praktische Umsetzung
DSGVO-Compliance: Rechtsgrundlagen, Bußgeldrahmen, AVV, Datenpanne-Meldepflicht, DSFA und Verarbeitungsverzeichnis - mit Praxisbeispielen.
Chris Wojzechowski 
Datenschutz-Folgenabschätzung (DSFA): Wann, Wie und Warum
DSFA nach Art. 35 DSGVO: Wann Pflicht, Schritt-für-Schritt-Anleitung, Blacklist der Aufsichtsbehörden und typische Fehler in der Praxis.
Oskar Braun Book a free GDPR security consultation
We assess your technical measures against Art. 32 GDPR and show you where action is required - specific, prioritised and with a fixed-price proposal.
Kostenlos · 30 Minuten · Unverbindlich
