Fiche 45/54 Part 5 — Operational Obligations & Sanctions Intermediate Reviewed 2026-08-23

Security of Processing: Technical Measures (Art. 32)

Article 32 obliges controllers and processors to implement technical measures ensuring a level of security appropriate to the risk. Measures must reflect the state of the art, implementation costs, an

Open in interactive reader

⚖️ State-of-the-Art Security 📋 CIA-R Triad (Art. 32.1)

Security of Processing: Technical Measures (Art. 32)

⚡ In 30 seconds

Under Article 32(1), taking into account the state of the art, the costs of implementation, and the risks of varying likelihood and severity for natural persons, controllers and processors must implement appropriate technical measures to ensure a level of security appropriate to the risk, encompassing confidentiality, integrity, availability, and resilience.

Technical Domain	Article 32 Benchmark	Production Best Practice
Encryption (Art. 32.1.a)	Cryptographic protection of data in transit and at rest.	TLS 1.3 for all web and API endpoints; AES-256 or ChaCha20 for database volumes and backups.
Pseudonymisation	Preventing direct attribution without separately stored keys.	Tokenization of user IDs; isolated key management via cloud Hardware Security Modules (HSMs).
Resilience (Art. 32.1.b)	Ability to withstand DDoS, hardware failures, and systemic outages.	Multi-zone redundancy, container orchestration, rate-limiting, web application firewalls (WAF).
Restoration (Art. 32.1.c)	Restore availability and access to personal data in a timely manner.	Immutable air-gapped backups, tested Disaster Recovery Plans (DRP), Recovery Time Objective (RTO) metrics.

⚡ Key Takeaways

Testing duty (Art. 32.1.d): regular penetration testing and vulnerability assessments are a strict legal requirement.
Proportionality: systems storing health or financial data require far stricter cryptographic safeguards than basic mailing lists.
Processors share direct statutory liability under Article 32 and can be sanctioned directly for technical negligence.

⚠️ Common Pitfall

Having disaster recovery backups on paper that have never been subjected to actual restoration drill testing.

🛠️ In Practice

Schedule an annual independent penetration test and establish an automated weekly backup restoration verification routine.

⚖️ Official Sources: Art. 32 GDPR · Recital 83 · ENISA Guidelines on Security of Personal Data Processing ✓ Legal review: 23 August 2026