Technical and Organisational Measures (TOMs)
What Article 32 requires organisations to implement as ‘appropriate technical and organisational measures’ — the risk-proportionate approach, the categories of measures, and how to document TOMs for DPA investigations and enterprise client security questionnaires.
Explore Resource
Encryption, Pseudonymisation, and Anonymisation
The practical distinctions between encryption, pseudonymisation, and anonymisation under GDPR — when each applies, the security standards required, how pseudonymisation reduces (but does not eliminate) GDPR obligations, and why true anonymisation is harder than most organisations assume.
Explore Resource
Access Control and Identity Management
Implementing the principle of access limitation under GDPR — role-based access control for personal data, privileged access management, access reviews, and the identity management lifecycle for staff who process personal data.
Explore Resource
Data Retention, Deletion, and Minimisation
Building a retention and deletion programme that satisfies GDPR’s storage limitation principle — defining retention periods by data category, implementing automated and procedural deletion, handling the right to erasure technically, and maintaining retention schedules as documented evidence.
Explore Resource
Security of Processing
A complete implementation guide to Article 32 — the risk-based security standard, the four specific measures referenced (pseudonymisation, confidentiality/integrity/availability/resilience, recovery capability, regular testing), and how to document the security programme as GDPR-compliant evidence.
Explore Resource
ISO 27001 and GDPR — Mapping Controls
How ISO 27001:2022 Annex A controls map to GDPR’s Article 32 security requirements and the broader accountability principle — which controls directly satisfy GDPR obligations, where the gaps are, and how to build a unified ISO 27001 + GDPR compliance programme that avoids duplicated effort.
Explore Resource
Building the GDPR Evidence Portfolio
How to assemble and maintain the documented information that demonstrates GDPR compliance — the minimum evidence set for each obligation, document retention requirements, how to organise evidence for DPA investigation response, and how a GRC platform structures evidence for multi-framework compliance.
Explore Resource