GDPR / RULE REFERENCE

Art. 32 — Security of processing

Article 32 is the "show me" article: it does not mandate specific technology, it mandates demonstrability. The listed measures — pseudonymisation, confidentiality and integrity of systems, restoration ability, regular testing — are exactly what an assessor asks evidence for, and the "regularly tested" clause is what makes a one-off penetration report insufficient.

The rule

You must implement "appropriate technical and organisational measures" — encryption, integrity, resilience, and the ability to demonstrate them on demand.

What it means for how you build

Security claims need evidence. Tamper-evident logging, scoped credentials, and verifiable integrity proofs are the artifacts an assessor actually asks for.

Self-check

Could you produce evidence of security controls from the last 90 days — not just the policy that mandates them?
Are credentials scoped and short-lived enough that a leak has a bounded blast radius?
Is integrity verifiable — can you detect tampering inside your own audit trail?
Do you test restores, or only backups?

Common pitfalls

Compliance-by-inventory: a spreadsheet of controls is not a technical measure — assessors want executed evidence.
Encrypting storage while PII leaks through logs, error reports, and analytics side-channels.
An "append-only" audit trail you can still UPDATE is decoration, not a control.

How the engine checks it

Hash-chained append-only audit vault with signed exports — integrity you verify cryptographically, not attest.

Sources

Related rules

Last reviewed 2026-11-01.