Security measures
Learn about security measures under the GDPR.
🔍 Introduction
The GDPR (Article 32) requires data controllers and processors to guarantee the security of personal data through appropriate technical and organisational measures. These measures must be proportionate to the risks presented by the processing, the nature of the data and the purposes pursued.
🎯 Objective: ensure the confidentiality, integrity, availability and resilience of systems and data.
⚖️ A risk-based approach
Before choosing measures, you must:
Identify the elements to protect (data, systems, flows).
Assess the threats and vulnerabilities (human error, attack, failure, etc.).
Determine the potential impacts (loss, disclosure, alteration…).
Choose appropriate measures to reduce these risks to an acceptable level.
🧩 The GDPR does not prescribe a fixed list of measures: it imposes a reinforced obligation of means. Each organisation must adapt its approach to its context and be able to demonstrate it.
🧱 Categories of security measures
🔧 Technical measures
Access control
Strong authentication (MFA), rights management, logging
Encryption
Data at rest and in transit, TLS certificates, managed and renewed keys
Pseudonymisation / anonymisation
Logical separation, hashing, tokens
Backups and resilience
Regular backups, restoration tests, redundancy
Application security
Penetration tests, patches, server hardening
Monitoring
SIEM, alerts for abnormal access, incident detection
🧭 Organisational measures
Security policy
IT charter, information security governance, incident management plan
Training & awareness
Internal campaigns, e-learning modules, phishing simulations
Third-party management
Contractual clauses, processor audits, regular assessments
Internal procedures
Authorisation process, business continuity plan, periodic review
🏢 Physical measures
Physical access
Badge control, CCTV, restricted areas
Hardware protection
Safes, secured racks, backup power supplies
Secure destruction
Shredding, certified erasure, IT waste management
🔁 Security management cycle
Identify: data, systems, vulnerabilities, threats.
Assess: risks and potential impacts.
Protect: define and apply security measures.
Monitor: detect incidents, audit controls.
Improve: correct, strengthen, document actions.
💼 Security measures in Dastra
🧩 Map your measures in the record of processing activities, by activity or by processor.
🔍 Assess risks with the risk management module.
🧠 Plan corrective actions and track their progress.
🧾 Trace compliance evidence (policies, audits, proof of execution).
📚 Useful resources
💡 Good practice: Every new project, processor or tool must be subject to a risk assessment and an update of the associated measures.
Last updated
Was this helpful?