Article 32
Table of contents
Article 28Article 30Article 6 Article 9Authorized AgentsCalifornia Consumer Privacy Act (CCPA)California Privacy Protection Agency (CPPA)California Privacy Rights Act (CPRA)Colorado Privacy Act (CPA)Consent Dark PatternsData ControllerData MappingData ProcessorData SubjectData Subject Access RequestDo Not TrackDo not sell/Do not share Facebook Limited Data Use (LDU)GDPR Personal DataGDPR PrinciplesGDPR RightsGeneral Data Protection Regulation (GDPR)Global Privacy Control (GPC)Gramm-Leach-Bliley ActHIPAALGDP (Brazil's Privacy Law)Personally Identifiable Information (PII)PseudonymizationRecord of Processing Activities (ROPA)Schrems IITracking CookiesUtah Consumer Privacy Act (UCPA)Verifiable Consumer Request (VCR)Virginia Consumer Data Protection Act (VCDPA)
Article 32 requires that data controllers and data processors secure consumer data using the “appropriate technical and organizational measures.”
Recommended security practices include:
- Encrypting and anonymising personal data
- Keeping processing systems and services confidential and available
- Taking steps to maintain system resiliency and integrity
- If an incident occurs, ensuring personal data access can be restored as soon as possible
- Implementing a process for security evaluation
In short, businesses under the GDPR are expected to ensure security for any personal data they process and Article 32 outlines specific guidelines for what's required.