What are Technical and Organizational Measures?
Technical and organizational measures (TOMs) are all the safeguards you put in place to protect personal data. Art. 32 GDPR requires you to implement appropriate measures and document them — appropriate in relation to the risk involved.
TOMs are not a one-off exercise; they must be continuously reviewed and adapted to the state of the art.
What TOMs are required?
The GDPR names the following as examples:
- Pseudonymization and encryption of personal data
- Confidentiality, integrity, and availability maintained on an ongoing basis
- Resilience of systems and services
- Recoverability after an incident
- Regular testing and evaluation of effectiveness
In practice, this includes access controls, password policies, data backups, encrypted communication, physical security, and employee training.
Technical measures (selection)
- Encryption of hard drives, emails, and data transmissions (TLS/SSL)
- Firewall, antivirus software, regular updates
- Permission concept (need-to-know principle)
- Strong passwords and multi-factor authentication
- Regular data backups and restore testing
- Logging of access to critical systems
Organizational measures (selection)
- Confidentiality commitments for employees
- Data protection training and awareness measures
- Physical and access controls (office, server room)
- Policies for BYOD, mobile devices, and remote work
- Processes for handling data breaches
- Rules for data retention and deletion
Documentation as an accountability obligation
The GDPR requires not only the implementation of TOMs but also their written documentation (accountability principle, Art. 5(2) GDPR). Without documentation, you cannot prove what you do in the event of an incident — even if your measures are sound in practice.
AGIDAT prepares complete, audit-ready TOM documentation for you that you can use as evidence towards authorities, customers, and partners.