GDPR Article 32 — security of processing
Article 32 requires controllers and processors to implement technical and organisational measures appropriate to the risk. It is deliberately risk-based rather than prescriptive: the four measures it names in 32(1)(a) to (d) are examples of what may be appropriate, not a checklist that can be completed. The UK GDPR carries a materially identical Article 32.
Does this apply to you?
Article 32 has no company-size threshold. If you process personal data, it binds you — and almost every business processes personal data, because staff and customer contact details are personal data.
You are likely in scope if
- You process personal data as a controller or as a processor. Article 32 binds both, and Article 28(3)(c) pushes the same obligation down into processor contracts.
- You are established in the EU, or you offer goods or services to people in the EU, or you monitor their behaviour there (Article 3). For the UK, the UK GDPR applies the same duty.
- You are a small company. The 250-employee exemption people remember is in Article 30, on records of processing activities. It is not in Article 32 and does not reduce this duty.
You are probably not in scope if
- You process no personal data whatsoever. In practice this is close to nonexistent for an operating business.
- The processing is purely personal or household activity, which Article 2(2)(c) excludes from the Regulation.
What the framework asks for.
Named as the framework names them, with its own references, so you can check this page against the source below.
Pseudonymisation and encryption of personal data
Named as an example measure. Whether either is appropriate — and where in your systems it applies — follows from your risk assessment rather than from the article.
Ongoing confidentiality, integrity, availability and resilience of processing systems and services
A continuing property of the systems that process personal data, not a one-time configuration.
Ability to restore availability and access in a timely manner after a physical or technical incident
In practice: backups that exist, and restores that have been tested and shown to work.
A process for regularly testing, assessing and evaluating effectiveness
The article asks for a repeating process with a record, not an annual point-in-time exercise.
Risk assessment
In assessing appropriate security, account must be taken of the risks from accidental or unlawful destruction, loss, alteration, or unauthorised disclosure of or access to personal data.
What Fortoxa puts against each requirement.
Fortoxa evidences transport encryption, access and detection history, and the record of control checks. It does not evidence restoration, and 32(1)(c) is shown as not supported rather than quietly omitted.
GDPR Article 32 — security of processing — control register
Pseudonymisation and encryption of personal data
LiveOngoing confidentiality, integrity, availability and resilience
LiveAbility to restore availability and access in a timely manner
Not supported yetRegular testing, assessing and evaluating effectiveness
CalculatedRisk assessment informing the measures
Not configured
What stays your job.
Fortoxa evidences what it can observe on the servers you install the agent on. Everything below is outside that, and the register marks it as not measured rather than as a pass.
The risk assessment
Article 32 is proportionate by construction: the measures must match the risk to the people whose data you hold. Deciding what that risk is, and therefore what is appropriate, is yours and cannot be delegated to a monitoring tool.
Pseudonymisation
Whether personal data is pseudonymised is a decision inside your own application design and data model. Fortoxa observes transport encryption on monitored services; it does not see what you store or how.
Restoration — 32(1)(c)
Backups, and restore tests that prove they work. Fortoxa does not run, hold, or verify your backups, so this requirement is marked not supported in the register rather than assumed.
Breach notification
Article 33 gives 72 hours to notify the supervisory authority once aware of a personal data breach, and Article 34 covers telling the individuals. Fortoxa’s incident timeline is evidence you can attach to such a notification. Deciding whether one is required, and making it, is yours.
Records of processing — Article 30
A separate article with a separate obligation and its own partial exemption. Fortoxa does not produce an Article 30 record.
Organisational measures
Article 32 says technical *and organisational*. Policies, training, confidentiality undertakings and the Article 32(4) duty to ensure staff act only on instructions are organisational, and sit outside what an agent on a server can observe.
Check this page against the text.
Everything above is Fortoxa's reading of the framework. It is not the framework, and it is not advice about your obligations. The publishers below are authoritative; this page is not.
See what your own servers produce.
Install the agent on one server and the register builds itself from what it finds — including the requirements it cannot see.