The security of data must be guaranteed by appropriate technical and organizational measures. Important objectives include protection against unauthorized access, data loss and manipulation.
This principle refers to a wealth of technical and organizational measures that must be taken when storing and processing personal data. Since the terms pseudonymization and encryption are mentioned several times in the GDPR, this principle is often translated as data encryption. However, this is by no means sufficient and sometimes even not necessary!
Experts translate the technical and organizational measures with the controls of the ISO/IEC 27001 series of standards. The series of standards defines a variety of technical methods for correctly implementing IT security, as well as requirements for written guidelines and defined processes for data processing. Only a combination of technical and organizational measures can protect data sustainably and reliably.
Previous article: Employee data protection awareness: #7 Defined deletion obligations
