Companies today face the major challenge of not only processing personal data in compliance with the law, but also protecting it appropriately. This is not only an ethical obligation, but also a legal necessity, particularly with regard to the General Data Protection Regulation (GDPR). Technical and organizational measures (TOM) play a central role in this. The key aspects that companies must consider in order to meet the legal requirements.
Technical and organizational measures must be suitable, appropriate and up-to-date
The security of the processing of personal data plays a prominent role in the GDPR. To ensure this, the GDPR sets out the most important points in Art. 32:
"Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, the controller and the processor shall implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk..."
The GDPR focuses on the technical and organizational measures that must be implemented. These measures must meet the following three criteria:
- Suitability
The measure must be suitable for minimizing the occurrence of damage. The measure must be selected accordingly on the basis of a risk assessment. The risk assessment must take into account factors such as the nature, scope, circumstances and purpose of the data processing as well as the likelihood and severity of the risk to the rights and freedoms of the data subjects.
- Appropriateness
The measures must be economically justifiable and appropriate to the risk to be protected. This means that the cost of implementing the measures should be proportionate to the potential damage and risks. Companies should therefore choose measures that are both cost-efficient and effective in order to ensure an appropriate level of security without causing disproportionate effort.
- State of the art
The current state of the art should be taken into account when selecting measures. This means that the security measures used should be state of the art and comply with current security standards and practices. They should be continuously reviewed for their effectiveness and adapted to new threats and developments if necessary.
Technical measures: Multi-layered protection
Technical measures are physical or digital safeguards aimed at protecting data from unauthorized access, loss or destruction. These measures include a wide range of technologies and procedures that should be regularly adapted to the current state of the art.
Encryption: One of the most basic and effective methods of protecting data is encryption. It should be used for both the transmission and storage of data. It must be ensured that the encryption methods used are up-to-date and recognized as secure.
Access controls: Access to personal data should be strictly controlled. This includes physical access controls to server rooms as well as digital controls through user accounts, password policies and two-factor authentication. Only authorized persons should have access to sensitive data.
Network security: Another technical measure is to secure the network environment. This includes the use of firewalls, intrusion detection systems and regular security updates. Network segmentation can also help to minimize the risk of data leaks.
Data backup and restore: Companies need to make regular backups of their data and ensure that it can be restored quickly in the event of data loss. It is crucial that backups are stored securely and protected from unauthorized access.
Organizational measures: Processes and responsibilities
In addition to technical measures, organizational measures are also crucial to ensure data protection. These measures concern the internal organization of the company, in particular the processes that ensure that data protection is taken into account in all areas of the company.
Data protection management: An effective data protection management system (DSMS) should be established. This system includes guidelines and procedures for the collection, processing, storage and deletion of personal data. A DSMS ensures that data protection measures are continuously monitored and improved.
Awareness and training: All employees should receive regular training on data protection policies and practices. Awareness-raising measures help to increase awareness of data protection risks and ensure compliance. Training should take into account current developments in data protection law and IT security.
Documentation and verifiability: Companies must document compliance with data protection regulations. This includes keeping a record of processing activities, documenting data protection impact assessments and logging access to personal data. This documentation is not only a legal requirement, but also serves as proof of compliance during audits or in the event of a data protection incident.
Contractual regulations: If personal data is transferred to third parties, for example to processors, appropriate contractual agreements must be made. These contracts should ensure that third parties also take the necessary technical and organizational measures to protect the data.
Reading tip: Cookie consent management - secure consent for companies
Continuous monitoring and improvement of measures
Once implemented, a data protection concept is not a static structure. The risks and threats to personal data are constantly changing, whether due to technological developments or new legal requirements. Companies must therefore continuously review their technical and organizational measures and adapt them if necessary.
Risk assessment: Regular risk assessments help to identify potential weaknesses in existing data protection measures. On this basis, companies can take targeted measures to increase the security of their data.
Auditing: Internal and external audits should be carried out regularly to check the effectiveness of the measures taken. Audits are an important tool to ensure that all data protection requirements are met and that any deficiencies can be rectified in good time.
Contingency plans: In the event of a data protection incident, such as a data breach, contingency plans should be in place. These plans include measures to limit the damage, to notify those affected and to communicate with the supervisory authorities.
The implementation of technical and organizational measures in data protection is essential for companies in order to comply with legal requirements and maintain customer trust. By combining technical solutions and organizational processes, companies can ensure the security of personal data and protect themselves from legal consequences. The key to success lies in the continuous adaptation and improvement of measures to meet the ever-changing challenges of data protection.
English 
German 
Italian